# CVEs published 2020-08-05 26 CVEs were published on August 5, 2020: 0 critical, 3 high. Days are UTC. - [CVE-2020-9036](https://cve.now/CVE-2020-9036.md): Jeedom through 4.0.38 allows XSS. (no CVSS) - [CVE-2020-17366](https://cve.now/CVE-2020-17366.md): An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. (no CVSS) - [CVE-2020-13404](https://cve.now/CVE-2020-13404.md): The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection. (no CVSS) - [CVE-2020-7298](https://cve.now/CVE-2020-7298.md): Total Protection (MTP) - Unexpected behavior violation (CVSS 7.5, McAfee Total Protection) - [CVE-2020-15132](https://cve.now/CVE-2020-15132.md): Reset Password / Login vulnerability in Sulu (CVSS 5.3, sulu · sulu/sulu) - [CVE-2020-15127](https://cve.now/CVE-2020-15127.md): Denial of service in Contour (CVSS 7.5, projectcontour contour) - [CVE-2020-15112](https://cve.now/CVE-2020-15112.md): Improper Input Validation in etcd (CVSS 6.5, etcd-io etcd · go.etcd.io/etcd +1) - [CVE-2020-16254](https://cve.now/CVE-2020-16254.md): The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute). (no CVSS, chartkick) - [CVE-2020-15113](https://cve.now/CVE-2020-15113.md): Improper Preservation of Permissions in etcd (CVSS 5.7, etcd-io etcd · github.com/etcd-io/etcd) - [CVE-2020-15106](https://cve.now/CVE-2020-15106.md): Improper Input Validation in etcd (CVSS 6.5, etcd-io etcd · go.etcd.io/etcd +1) - [CVE-2020-16192](https://cve.now/CVE-2020-16192.md): LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parameters. (no CVSS) - [CVE-2020-17364](https://cve.now/CVE-2020-17364.md): USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs. (no CVSS) - [CVE-2020-8607](https://cve.now/CVE-2020-8607.md): An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific rootkit protection dri (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan +9) - [CVE-2020-16253](https://cve.now/CVE-2020-16253.md): The PgHero gem through 2.6.0 for Ruby allows CSRF. (no CVSS, pghero) - [CVE-2020-16252](https://cve.now/CVE-2020-16252.md): The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF. (no CVSS, field\_test) - [CVE-2020-13819](https://cve.now/CVE-2020-13819.md): Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request. (no CVSS) - [CVE-2020-13921](https://cve.now/CVE-2020-13921.md): \*\*Resolved\*\* Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases. (no CVSS, Apache SkyWalking · apache-skywalking +1) - [CVE-2020-4481](https://cve.now/CVE-2020-4481.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when proces (CVSS 8.2, IBM UrbanCode Deploy) - [CVE-2020-4243](https://cve.now/CVE-2020-4243.md): IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information usin (CVSS 3.7, IBM Security Identity Governance and Intelligence) - [CVE-2020-5608](https://cve.now/CVE-2020-5608.md): CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6 (no CVSS, Yokogawa Electric CAMS for HIS) - [CVE-2020-5609](https://cve.now/CVE-2020-5609.md): Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes C (no CVSS, Yokogawa Electric CAMS for HIS) - [CVE-2020-14347](https://cve.now/CVE-2020-14347.md): A flaw was found in the way xserver memory was not properly initialized. (CVSS 5.5, The Xorg Project xorg-x11-server) - [CVE-2020-14344](https://cve.now/CVE-2020-14344.md): An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version (CVSS 6.7, The X11 Project libX11) - [CVE-2020-17353](https://cve.now/CVE-2020-17353.md): scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-p (no CVSS) - [CVE-2020-13151](https://cve.now/CVE-2020-13151.md): Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as (no CVSS) - [CVE-2017-18112](https://cve.now/CVE-2017-18112.md): Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulner (no CVSS, Atlassian Fisheye) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-08-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.