# CVEs published 2020-08-03

32 CVEs were published on August 3, 2020: 0 critical, 9 high. Days are UTC.

- [CVE-2020-11583](https://cve.now/CVE-2020-11583.md): A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, (no CVSS)
- [CVE-2020-11584](https://cve.now/CVE-2020-11584.md): A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or C (no CVSS)
- [CVE-2020-5771](https://cve.now/CVE-2020-5771.md): Improper Input Validation in Teltonika firmware TRB2\_R\_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by upload (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5770](https://cve.now/CVE-2020-5770.md): Cross-site request forgery in Teltonika firmware TRB2\_R\_00.02.04.01 allows a remote attacker to perform sensitive application actions by tri (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5773](https://cve.now/CVE-2020-5773.md): Improper Access Control in Teltonika firmware TRB2\_R\_00.02.04.01 allows a low privileged user to perform unauthorized write operations. (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-5772](https://cve.now/CVE-2020-5772.md): Improper Input Validation in Teltonika firmware TRB2\_R\_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by upload (no CVSS, Teltonika Gateway TRB245)
- [CVE-2020-16116](https://cve.now/CVE-2020-16116.md): In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory trav (no CVSS)
- [CVE-2020-8574](https://cve.now/CVE-2020-8574.md): Active IQ Unified Manager for Linux versions prior to 9.6 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service (no CVSS, Active IQ Unified Manager for Linux 7.3 and above)
- [CVE-2020-8575](https://cve.now/CVE-2020-8575.md): Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which allows administrativ (no CVSS, Active IQ Unified Manager for VMware vSphere and Windows 7.…)
- [CVE-2020-16131](https://cve.now/CVE-2020-16131.md): Tiki before 21.2 allows XSS because \[\\s\\/"\\'\] is not properly considered in lib/core/TikiFilter/PreventXss.php. (no CVSS)
- [CVE-2020-14319](https://cve.now/CVE-2020-14319.md): It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight (no CVSS, AMQ-Online and EnMasse)
- [CVE-2020-12739](https://cve.now/CVE-2020-12739.md): A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remote attacker to cause (no CVSS)
- [CVE-2020-13820](https://cve.now/CVE-2020-13820.md): Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. (no CVSS)
- [CVE-2020-16271](https://cve.now/CVE-2020-16271.md): The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to re (no CVSS)
- [CVE-2020-16272](https://cve.now/CVE-2020-16272.md): The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote a (no CVSS)
- [CVE-2020-16269](https://cve.now/CVE-2020-16269.md): radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse\_typedef in type\_dwarf.c via a malformed (no CVSS)
- [CVE-2015-9549](https://cve.now/CVE-2015-9549.md): A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF\_EMOTICON\_CELL.tpl FIELD\_NAME field to data/emotic (no CVSS)
- [CVE-2019-19455](https://cve.now/CVE-2019-19455.md): Wowza Streaming Engine before 4.8.5 has Insecure Permissions which may allow a local attacker to escalate privileges in / usr / local / Wowz (no CVSS)
- [CVE-2019-19453](https://cve.now/CVE-2019-19453.md): Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). (no CVSS)
- [CVE-2020-4560](https://cve.now/CVE-2020-4560.md): IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. (CVSS 4.7, IBM Financial Transaction Manager)
- [CVE-2020-4554](https://cve.now/CVE-2020-4554.md): IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4553](https://cve.now/CVE-2020-4553.md): IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4552](https://cve.now/CVE-2020-4552.md): IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4551](https://cve.now/CVE-2020-4551.md): IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4550](https://cve.now/CVE-2020-4550.md): IBM i2 Analyst Notebook 9.2.1 and 9.2.2 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4549](https://cve.now/CVE-2020-4549.md): IBM i2 Analyst Notebook 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. (CVSS 7.8, IBM i2 Analyst Notebook)
- [CVE-2020-4534](https://cve.now/CVE-2020-4534.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system (CVSS 7.8, IBM WebSphere Application Server)
- [CVE-2020-4377](https://cve.now/CVE-2020-4377.md): IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 8.2, IBM Cognos Analytics)
- [CVE-2020-4328](https://cve.now/CVE-2020-4328.md): IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. (CVSS 6.3, IBM Financial Transaction Manager)
- [CVE-2019-4589](https://cve.now/CVE-2019-4589.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page is visible and acces (CVSS 4.6, IBM Cognos Analytics)
- [CVE-2019-4366](https://cve.now/CVE-2019-4366.md): IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gain access to cached b (CVSS 2.9, IBM Cognos Analytics)
- [CVE-2020-8108](https://cve.now/CVE-2020-8108.md): Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759) (CVSS 8.2, Bitdefender Endpoint Security for Mac)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.