CVEs published November 13, 2020
34 CVEs were published on November 13, 2020: 0 critical, 9 high. Browse them by severity, product and exploitation status.
- Published
- 34
- Critical
- 0
- High
- 9
- Medium
- 3
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Pixar
- 6
- NIO
- 2
- NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- 2
- Avaya WebLM · Avaya System Manager
- 1
- BD Alaris PC Unit and BD Alaris Systems Manager
- 1
- dependabot-core · dependabot-omnibus +1
- 1
- Game Networking Sockets
- 1
- HUAWEI Mate
- 1
- IBM InfoSphere Information Server
- 1
- Intel(R) Processors
- 1
High 9
- CVE-2020-26230Deanonymization of COVID-19 positive users of Radar COVIDRadarCOVID radar-covid-backend-dp3t-server
- CVE-2020-26223Authorization bypass in Spreespree · spree_api
- CVE-2020-26222Remote code execution in dependabot-coredependabot-core · dependabot-omnibus +1
- CVE-2020-6149A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6148A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6147A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6156A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6155A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files.Pixar
- CVE-2020-6150A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow.Pixar
Medium, low and unrated 25
- CVE-2020-15481An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008.
- CVE-2020-28638ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users'…
- CVE-2020-12313Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated…Intel(R) PROSet/Wireless WiFi
- CVE-2020-12338Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially…Open WebRTC Toolkit
- CVE-2020-0599Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege…Intel(R) Processors
- CVE-2020-5796Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of…Nagios XI
- CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.
- CVE-2020-27217In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices.The Eclipse Foundation Eclipse Hono · org.eclipse.hono:hono…
- CVE-2020-6157Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack.Opera Touch for iOS
- CVE-2020-7962An issue was discovered in One Identity Password Manager 5.8.
- CVE-2020-25151The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50…NIO
- CVE-2020-25155The affected product transmits unencrypted sensitive information, which may allow an attacker to access this information on the NIO 50…NIO
- CVE-2020-25557In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password.
- CVE-2020-25538An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code…
- CVE-2020-8582Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an…NetApp SolidFire & HCI Storage Node
- CVE-2020-8583Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker…NetApp SolidFire & HCI Storage Node (Element Software) )
- CVE-2020-4886IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has…IBM InfoSphere Information Server
- CVE-2020-25165BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products…BD Alaris PC Unit and BD Alaris Systems Manager
- CVE-2020-21667In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can…
- CVE-2020-6019Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function…Game Networking Sockets
- CVE-2020-1847There is a denial of service vulnerability in some Huawei products.NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- CVE-2020-9129HUAWEI Mate 30 versions earlier than 10.1.0.159(C00E159R7P2) have a vulnerability of improper buffer operation.HUAWEI Mate
- CVE-2020-9127Some Huawei products have a command injection vulnerability.NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- CVE-2020-26825SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori…SAP SE SAP Fiori Launchpad
- CVE-2020-7032Avaya WebLM Improper Restriction of XML External Entity ReferenceAvaya WebLM · Avaya System Manager