# CVEs published 2020-11-02

47 CVEs were published on November 2, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-9861](https://cve.now/CVE-2020-9861.md): A stack overflow issue existed in Swift for Linux. (no CVSS, Swift 5.1.5 for Linux)
- [CVE-2020-26939](https://cve.now/CVE-2020-26939.md): In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent (no CVSS, org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +6)
- [CVE-2020-23868](https://cve.now/CVE-2020-23868.md): NeDi 1.9C allows inc/rt-popup.php d XSS. (no CVSS)
- [CVE-2020-23989](https://cve.now/CVE-2020-23989.md): NeDi 1.9C allows pwsec.php oid XSS. (no CVSS)
- [CVE-2020-7758](https://cve.now/CVE-2020-7758.md): Path Traversal (CVSS 7.5, browserless-chrome)
- [CVE-2020-7757](https://cve.now/CVE-2020-7757.md): Path Traversal (CVSS 6.5, droppy)
- [CVE-2020-23639](https://cve.now/CVE-2020-23639.md): A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to ex (no CVSS)
- [CVE-2020-9368](https://cve.now/CVE-2020-9368.md): The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via (no CVSS)
- [CVE-2020-14425](https://cve.now/CVE-2020-14425.md): Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. (no CVSS)
- [CVE-2020-10937](https://cve.now/CVE-2020-10937.md): An issue was discovered in IPFS (aka go-ipfs) 0.4.23. (no CVSS, github.com/ipfs/go-ipfs)
- [CVE-2018-17932](https://cve.now/CVE-2018-17932.md): JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, whic (no CVSS, JUUKO K-800)
- [CVE-2018-19025](https://cve.now/CVE-2018-19025.md): In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware (no CVSS, JUUKO K-808)
- [CVE-2018-19956](https://cve.now/CVE-2018-19956.md): The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. (no CVSS, QNAP Systems Photo Station)
- [CVE-2018-19955](https://cve.now/CVE-2018-19955.md): The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. (no CVSS, QNAP Systems Photo Station)
- [CVE-2018-19954](https://cve.now/CVE-2018-19954.md): The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. (no CVSS, QNAP Systems Photo Station)
- [CVE-2018-19952](https://cve.now/CVE-2018-19952.md): If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. (no CVSS, QNAP Systems Music Station)
- [CVE-2018-19951](https://cve.now/CVE-2018-19951.md): If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. (no CVSS, QNAP Systems Music Station)
- [CVE-2018-19950](https://cve.now/CVE-2018-19950.md): If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. (no CVSS, QNAP Systems Music Station)
- [CVE-2020-24881](https://cve.now/CVE-2020-24881.md): SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. (no CVSS)
- [CVE-2020-3704](https://cve.now/CVE-2020-3704.md): u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral sy (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3696](https://cve.now/CVE-2020-3696.md): u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking securit (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2020-3703](https://cve.now/CVE-2020-3703.md): u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3693](https://cve.now/CVE-2020-3693.md): u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3694](https://cve.now/CVE-2020-3694.md): u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Mo…)
- [CVE-2020-3684](https://cve.now/CVE-2020-3684.md): u'QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them wit (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3690](https://cve.now/CVE-2020-3690.md): u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3692](https://cve.now/CVE-2020-3692.md): u'Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3673](https://cve.now/CVE-2020-3673.md): u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the ind (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3678](https://cve.now/CVE-2020-3678.md): u'A buffer overflow could occur if the API is improperly used due to UIE init does not contain a buffer size a param' in Snapdragon Consumer (no CVSS, Qualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…)
- [CVE-2020-3657](https://cve.now/CVE-2020-3657.md): u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client th (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3670](https://cve.now/CVE-2020-3670.md): u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3638](https://cve.now/CVE-2020-3638.md): u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Sn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-3654](https://cve.now/CVE-2020-3654.md): u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11173](https://cve.now/CVE-2020-11173.md): u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11174](https://cve.now/CVE-2020-11174.md): u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11164](https://cve.now/CVE-2020-11164.md): u'Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control' in Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2020-11169](https://cve.now/CVE-2020-11169.md): u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Sna (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11172](https://cve.now/CVE-2020-11172.md): u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdra (no CVSS, Qualcomm Snapdragon Wired Infrastructure and Networking)
- [CVE-2020-11157](https://cve.now/CVE-2020-11157.md): u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in S (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2020-11162](https://cve.now/CVE-2020-11162.md): u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11155](https://cve.now/CVE-2020-11155.md): u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11156](https://cve.now/CVE-2020-11156.md): u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11153](https://cve.now/CVE-2020-11153.md): u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11154](https://cve.now/CVE-2020-11154.md): u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11114](https://cve.now/CVE-2020-11114.md): u'Bluetooth devices does not properly restrict the L2CAP payload length allowing users in radio range to cause a buffer overflow via a craft (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Consumer IOT, Snapd…)
- [CVE-2020-11125](https://cve.now/CVE-2020-11125.md): u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Snapdragon Au (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11141](https://cve.now/CVE-2020-11141.md): u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer devic (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.