# CVEs published 2020-08-14 30 CVEs were published on August 14, 2020: 2 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-17474](https://cve.now/CVE-2020-17474.md): A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0\_20190723 allows an attacker to create arbitrary ne (no CVSS) - [CVE-2020-17475](https://cve.now/CVE-2020-17475.md): Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending p (no CVSS) - [CVE-2020-17473](https://cve.now/CVE-2020-17473.md): Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0\_20190723 allows an attacker to obtain a long-las (no CVSS) - [CVE-2015-8033](https://cve.now/CVE-2015-8033.md): In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account. (no CVSS) - [CVE-2015-8032](https://cve.now/CVE-2015-8032.md): In Textpattern 4.5.7, an unprivileged author can change an article's markup setting. (no CVSS) - [CVE-2020-15694](https://cve.now/CVE-2020-15694.md): In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. (no CVSS) - [CVE-2020-15693](https://cve.now/CVE-2020-15693.md): In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. (no CVSS) - [CVE-2020-15692](https://cve.now/CVE-2020-15692.md): In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. (no CVSS) - [CVE-2020-9767](https://cve.now/CVE-2020-9767.md): A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to (no CVSS) - [CVE-2020-9708](https://cve.now/CVE-2020-9708.md): GHSL-2020-133: Insufficient validation of user input in resolveRepositoryPath function (CVSS 5.9, Adobe Helix) - [CVE-2020-15145](https://cve.now/CVE-2020-15145.md): Local privilege elevation in Composer-Setup for Windows (CVSS 6.7, composer windows-setup) - [CVE-2020-15141](https://cve.now/CVE-2020-15141.md): Path Traversal in openapi-python-client (CVSS 3.0, triaxtec openapi-python-client · openapi-python-client) - [CVE-2020-15142](https://cve.now/CVE-2020-15142.md): Arbitrary Code Generation (CVSS 8.0, triaxtec openapi-python-client · openapi-python-client) - [CVE-2020-22722](https://cve.now/CVE-2020-22722.md): Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file. (no CVSS) - [CVE-2020-22721](https://cve.now/CVE-2020-22721.md): A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscella (no CVSS) - [CVE-2019-5591](https://cve.now/CVE-2019-5591.md): A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information (CVSS 6.5, KEV, Fortinet FortiOS) - [CVE-2020-10055](https://cve.now/CVE-2020-10055.md): A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (V3.x). (no CVSS, Siemens AG Desigo CC) - [CVE-2020-15781](https://cve.now/CVE-2020-15781.md): A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions \< V05.30). (no CVSS, Siemens AG SICAM WEB firmware for SICAM A8000 RTUs) - [CVE-2020-7583](https://cve.now/CVE-2020-7583.md): A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions \< V6.0.8). (no CVSS, Siemens AG Automation License Manager) - [CVE-2020-7701](https://cve.now/CVE-2020-7701.md): Prototype Pollution (CVSS 9.8, madlib-object-utils) - [CVE-2020-7700](https://cve.now/CVE-2020-7700.md): Prototype Pollution (CVSS 9.8, phpjs) - [CVE-2020-9229](https://cve.now/CVE-2020-9229.md): FusionCompute 8.0.0 has an information disclosure vulnerability. (no CVSS, FusionCompute) - [CVE-2020-9228](https://cve.now/CVE-2020-9228.md): FusionCompute 8.0.0 has an information disclosure vulnerability. (no CVSS, FusionCompute) - [CVE-2020-17462](https://cve.now/CVE-2020-17462.md): CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a related issue to CV (no CVSS) - [CVE-2019-19643](https://cve.now/CVE-2019-19643.md): ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service. (no CVSS) - [CVE-2020-16205](https://cve.now/CVE-2020-16205.md): Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1 (no CVSS, G-Cam and G-Code) - [CVE-2020-12648](https://cve.now/CVE-2020-12648.md): A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web script when configur (no CVSS, tinymce) - [CVE-2019-6112](https://cve.now/CVE-2019-6112.md): A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to (no CVSS) - [CVE-2019-7410](https://cve.now/CVE-2019-7410.md): There is stored cross site scripting (XSS) in Galileo CMS v0.042. (no CVSS) - [CVE-2020-4662](https://cve.now/CVE-2020-4662.md): IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication validation. (CVSS 6.5, IBM Event Streams) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-08-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.