# CVEs published 2020-11-05

60 CVEs were published on November 5, 2020: 2 critical, 9 high. Days are UTC.

- [CVE-2020-6877](https://cve.now/CVE-2020-6877.md): A ZTE product is impacted by an information leak vulnerability. (no CVSS, ZXA10 eODN)
- [CVE-2020-25837](https://cve.now/CVE-2020-25837.md): Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. (no CVSS, Micro Focus Self Service Password Reset)
- [CVE-2020-17510](https://cve.now/CVE-2020-17510.md): Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. (no CVSS, Apache Shiro · org.apache.shiro:shiro-spring)
- [CVE-2020-7207](https://cve.now/CVE-2020-7207.md): A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation… (no CVSS, HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360…)
- [CVE-2020-13537](https://cve.now/CVE-2020-13537.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. (CVSS 9.3, Moxa)
- [CVE-2020-13536](https://cve.now/CVE-2020-13536.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. (CVSS 9.3, Moxa)
- [CVE-2020-25661](https://cve.now/CVE-2020-25661.md): A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with… (CVSS 7.5, Red Hat kernel)
- [CVE-2020-6015](https://cve.now/CVE-2020-6015.md): Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent… (no CVSS, Check Point Endpoint Security for Windows)
- [CVE-2020-24436](https://cve.now/CVE-2020-24436.md): Acrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24439](https://cve.now/CVE-2020-24439.md): Acrobat Reader DC for macOS Signature Validation Bypass (CVSS 2.8, Adobe Acrobat Reader)
- [CVE-2020-24433](https://cve.now/CVE-2020-24433.md): Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24438](https://cve.now/CVE-2020-24438.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24434](https://cve.now/CVE-2020-24434.md): Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24435](https://cve.now/CVE-2020-24435.md): Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24432](https://cve.now/CVE-2020-24432.md): Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents (CVSS 6.7, Adobe Acrobat Reader)
- [CVE-2020-24430](https://cve.now/CVE-2020-24430.md): Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24429](https://cve.now/CVE-2020-24429.md): Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation (CVSS 7.7, Adobe Acrobat Reader)
- [CVE-2020-24431](https://cve.now/CVE-2020-24431.md): Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability (CVSS 4.4, Adobe Acrobat Reader)
- [CVE-2020-24428](https://cve.now/CVE-2020-24428.md): Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation (CVSS 7.7, Adobe Acrobat Reader)
- [CVE-2020-24437](https://cve.now/CVE-2020-24437.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24427](https://cve.now/CVE-2020-24427.md): Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24426](https://cve.now/CVE-2020-24426.md): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-5946](https://cve.now/CVE-2020-5946.md): In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format… (no CVSS, BIG-IP)
- [CVE-2020-5944](https://cve.now/CVE-2020-5944.md): In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to… (no CVSS, BIG-IQ)
- [CVE-2020-5943](https://cve.now/CVE-2020-5943.md): In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected… (no CVSS, BIG-IP)
- [CVE-2020-5945](https://cve.now/CVE-2020-5945.md): In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting… (no CVSS, BIG-IP)
- [CVE-2020-5940](https://cve.now/CVE-2020-5940.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an… (no CVSS, BIG-IP)
- [CVE-2020-5941](https://cve.now/CVE-2020-5941.md): On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management… (no CVSS, BIG-IP)
- [CVE-2020-5942](https://cve.now/CVE-2020-5942.md): In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when… (no CVSS, BIG-IP)
- [CVE-2020-5939](https://cve.now/CVE-2020-5939.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems… (no CVSS, BIG-IP Virtual Edition)
- [CVE-2020-5793](https://cve.now/CVE-2020-5793.md): A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an… (no CVSS, Tenable Nessus for Windows and Tenable Nessus Agent for Win…)
- [CVE-2020-12146](https://cve.now/CVE-2020-12146.md): Silver Peak Unity OrchestratorTM subject to path traversal. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-12147](https://cve.now/CVE-2020-12147.md): Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-12145](https://cve.now/CVE-2020-12145.md): Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-8267](https://cve.now/CVE-2020-8267.md): A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was… (no CVSS, UniFi Protect)
- [CVE-2020-13661](https://cve.now/CVE-2020-13661.md): Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character… (no CVSS)
- [CVE-2020-26507](https://cve.now/CVE-2020-26507.md): A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious… (no CVSS)
- [CVE-2020-26505](https://cve.now/CVE-2020-26505.md): A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject… (no CVSS)
- [CVE-2020-14222](https://cve.now/CVE-2020-14222.md): HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). (no CVSS, HCL Digital Experience)
- [CVE-2018-1725](https://cve.now/CVE-2018-1725.md): IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. (CVSS 3.2, IBM QRadar SIEM)
- [CVE-2020-4097](https://cve.now/CVE-2020-4097.md): In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11… (no CVSS, HCL Notes)
- [CVE-2020-14240](https://cve.now/CVE-2020-14240.md): HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS)… (no CVSS, HCL Notes)
- [CVE-2020-25398](https://cve.now/CVE-2020-25398.md): CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. (no CVSS)
- [CVE-2020-25399](https://cve.now/CVE-2020-25399.md): Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the… (no CVSS)
- [CVE-2020-26506](https://cve.now/CVE-2020-26506.md): An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain… (no CVSS)
- [CVE-2020-27688](https://cve.now/CVE-2020-27688.md): RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. (no CVSS)
- [CVE-2020-28115](https://cve.now/CVE-2020-28115.md): SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL… (no CVSS)
- [CVE-2020-27955](https://cve.now/CVE-2020-27955.md): Git LFS 2.12.0 allows Remote Code Execution. (no CVSS, github.com/git-lfs/git-lfs)
- [CVE-2020-28047](https://cve.now/CVE-2020-28047.md): AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). (no CVSS)
- [CVE-2020-15950](https://cve.now/CVE-2020-15950.md): Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. (no CVSS)
- [CVE-2020-15949](https://cve.now/CVE-2020-15949.md): Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. (no CVSS)
- [CVE-2020-15951](https://cve.now/CVE-2020-15951.md): Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML… (no CVSS)
- [CVE-2020-15952](https://cve.now/CVE-2020-15952.md): Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. (no CVSS)
- [CVE-2020-27402](https://cve.now/CVE-2020-27402.md): The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su… (no CVSS)
- [CVE-2020-24849](https://cve.now/CVE-2020-24849.md): A remote code execution vulnerability is identified in FruityWifi through 2.4. (no CVSS)
- [CVE-2020-7763](https://cve.now/CVE-2020-7763.md): Arbitrary File Read (CVSS 7.5, phantom-html-to-pdf)
- [CVE-2020-7762](https://cve.now/CVE-2020-7762.md): Arbitrary File Read (CVSS 6.5, jsreport-chrome-pdf)
- [CVE-2020-7761](https://cve.now/CVE-2020-7761.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, @absolunet/kafe)
- [CVE-2020-27387](https://cve.now/CVE-2020-27387.md): An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the… (no CVSS)
- [CVE-2020-25662](https://cve.now/CVE-2020-25662.md): A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the… (CVSS 5.3, Red Hat kernel)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.