# CVEs published 2020-08-28

17 CVEs were published on August 28, 2020: 2 critical, 3 high. Days are UTC.

- [CVE-2020-15159](https://cve.now/CVE-2020-15159.md): Cross Site Scripting leading to RCE in baserCMS (CVSS 7.6, baserproject basercms · baserproject/basercms)
- [CVE-2020-15155](https://cve.now/CVE-2020-15155.md): Cross-Site Scripting in baserCMS (CVSS 7.3, baserproject basercms · baserproject/basercms)
- [CVE-2020-15154](https://cve.now/CVE-2020-15154.md): Cross Site Scripting in baserCMS (CVSS 7.3, baserproject basercms · baserproject/basercms)
- [CVE-2012-4818](https://cve.now/CVE-2012-4818.md): IBM InfoSphere Information Server 8.1, 8.5, and 8,7 could allow a remote authenticated attacker to obtain sensitive information, caused by i (no CVSS)
- [CVE-2020-15165](https://cve.now/CVE-2020-15165.md): Potentially tampered sources on Play Store for Chameleon Mini Live Debugger (CVSS 9.3, maxieds ChameleonMiniLiveDebugger)
- [CVE-2020-15164](https://cve.now/CVE-2020-15164.md): Authentication Bypass in Scratch Login (mediawiki-scratch-login) (CVSS 10.0, InternationalScratchWiki mediawiki-scratch-login)
- [CVE-2020-16610](https://cve.now/CVE-2020-16610.md): Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF). (no CVSS)
- [CVE-2019-19499](https://cve.now/CVE-2019-19499.md): Grafana \<= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modi (no CVSS, github.com/grafana/grafana)
- [CVE-2020-9298](https://cve.now/CVE-2020-9298.md): The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send reques (no CVSS, Netflix Orca Spinnaker · com.netflix.spinnaker.orca:orca-co…)
- [CVE-2020-4591](https://cve.now/CVE-2020-4591.md): IBM Spectrum Protect Server 8.1.0.000 through 8.1.10.000 could disclose sensitive information in nondefault settings due to occasionally not (CVSS 2.9, IBM Spectrum Protect Server)
- [CVE-2020-4559](https://cve.now/CVE-2020-4559.md): IBM Spectrum Protect 7.1 and 8.1 could allow an attacker to cause a denial of service due ti improper validation of user-supplied input. (CVSS 5.9, IBM Spectrum Protect)
- [CVE-2019-4579](https://cve.now/CVE-2019-4579.md): IBM Resilient SOAR 38 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in d (CVSS 4.3, IBM Resilient SOAR)
- [CVE-2019-4533](https://cve.now/CVE-2019-4533.md): IBM Resilient SOAR V38.0 users may experience a denial of service of the SOAR Platform due to a insufficient input validation. (CVSS 4.3, IBM Resilient SOAR)
- [CVE-2020-5625](https://cve.now/CVE-2020-5625.md): Cross-site scripting vulnerability in XooNIps 3.48 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors (no CVSS, Neuroinformatics Unit, Integrative Computational Brain Scie…)
- [CVE-2020-5623](https://cve.now/CVE-2020-5623.md): NITORI App for Android versions 6.0.4 and earlier and NITORI App for iOS versions 6.0.2 and earlier allow remote attackers to lead a user to (no CVSS, Nitori Holdings Co. NITORI App for Android and NITORI App f…)
- [CVE-2020-5624](https://cve.now/CVE-2020-5624.md): SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vector (no CVSS, Neuroinformatics Unit, Integrative Computational Brain Scie…)
- [CVE-2020-5621](https://cve.now/CVE-2020-5621.md): Cross-site request forgery (CSRF) vulnerability in NETGEAR switching hubs (GS716Tv2 Firmware version 5.4.2.30 and earlier, and GS724Tv3 Firm (no CVSS, Neuroinformatics Unit, Integrative Computational Brain Scie…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-08-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.