# CVEs published 2020-08-04 27 CVEs were published on August 4, 2020: 0 critical, 3 high. Days are UTC. - [CVE-2020-15109](https://cve.now/CVE-2020-15109.md): Ability to change order address without triggering address validations in solidus (CVSS 5.3, solidusio solidus · solidus\_frontend +1) - [CVE-2020-15135](https://cve.now/CVE-2020-15135.md): CSRF vulnerability in save-server (CVSS 6.7, Neztore save-server · save-server) - [CVE-2020-16847](https://cve.now/CVE-2020-16847.md): Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka C (no CVSS) - [CVE-2020-16843](https://cve.now/CVE-2020-16843.md): In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. (no CVSS) - [CVE-2020-15943](https://cve.now/CVE-2020-15943.md): An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. (no CVSS) - [CVE-2020-13522](https://cve.now/CVE-2020-13522.md): An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. (CVSS 8.8, SoftPerfect) - [CVE-2020-15956](https://cve.now/CVE-2020-15956.md): ActiveMediaServer.exe in ACTi NVR3 Standard Server 3.0.12.42 allows remote unauthenticated attackers to trigger a buffer overflow and applic (no CVSS) - [CVE-2020-15944](https://cve.now/CVE-2020-15944.md): An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. (no CVSS) - [CVE-2020-13523](https://cve.now/CVE-2020-13523.md): An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. (CVSS 3.8, SoftPerfect) - [CVE-2020-16199](https://cve.now/CVE-2020-16199.md): Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. (no CVSS, Delta Industrial Automation CNCSoft ScreenEditor) - [CVE-2020-16201](https://cve.now/CVE-2020-16201.md): Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. (no CVSS, Delta Industrial Automation CNCSoft ScreenEditor) - [CVE-2020-16203](https://cve.now/CVE-2020-16203.md): Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. (no CVSS, Delta Industrial Automation CNCSoft ScreenEditor) - [CVE-2020-16134](https://cve.now/CVE-2020-16134.md): An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.0 (no CVSS) - [CVE-2020-4631](https://cve.now/CVE-2020-4631.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned access to everyone with (CVSS 5.1, IBM Spectrum Protect Plus) - [CVE-2020-4542](https://cve.now/CVE-2020-4542.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Design Manager) - [CVE-2020-4525](https://cve.now/CVE-2020-4525.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Design Manager) - [CVE-2020-4459](https://cve.now/CVE-2020-4459.md): IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound (CVSS 5.9, IBM Security Secret Server) - [CVE-2020-4410](https://cve.now/CVE-2020-4410.md): IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read atta (CVSS 4.3, IBM Rational Rhapsody Design Manager) - [CVE-2020-4396](https://cve.now/CVE-2020-4396.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Design Manager) - [CVE-2020-7823](https://cve.now/CVE-2020-7823.md): DaviewIndy Multiple Vulnerabilities (CVSS 7.8, HumanTalk Co DaviewIndy) - [CVE-2020-7822](https://cve.now/CVE-2020-7822.md): DaviewIndy Multiple Vulnerabilities (CVSS 7.8, HumanTalk Co DaviewIndy) - [CVE-2020-6012](https://cve.now/CVE-2020-6012.md): ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. (no CVSS, ZoneAlarm Anti-Ransomware) - [CVE-2020-15467](https://cve.now/CVE-2020-15467.md): The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execu (no CVSS) - [CVE-2019-20001](https://cve.now/CVE-2019-20001.md): An issue was discovered in RICOH Streamline NX Client Tool and RICOH Streamline NX PC Client that allows attackers to escalate local privile (no CVSS) - [CVE-2020-5616](https://cve.now/CVE-2020-5616.md): \[Calendar01\], \[Calendar02\], \[PKOBO-News01\], \[PKOBO-vote01\], \[Telop01\], \[Gallery01\], \[CalendarForm01\], and \[Link01\] \[Calendar01\] free edition (no CVSS, PHP Factory \[Calendar01\], \[Calendar02\], \[PKOBO-News01\], \[PK…) - [CVE-2020-5617](https://cve.now/CVE-2020-5617.md): Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges a (no CVSS, Sky Co. SKYSEA Client View) - [CVE-2020-5615](https://cve.now/CVE-2020-5615.md): Cross-site request forgery (CSRF) vulnerability in \[Calendar01\] free edition ver1.0.0 and \[Calendar02\] free edition ver1.0.0 allows remote a (no CVSS, PHP Factory \[Calendar01\] and \[Calendar02\]) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-08-04 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.