# CVEs published 2020-11-03

53 CVEs were published on November 3, 2020: 2 critical, 3 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2020-26211](https://cve.now/CVE-2020-26211.md): Cross-Site Scripting in BookStack (CVSS 7.7, BookStackApp BookStack · ssddanbrown/bookstack)
- [CVE-2020-1909](https://cve.now/CVE-2020-1909.md): A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have res (no CVSS, Facebook WhatsApp Business for iOS · Facebook WhatsApp for…)
- [CVE-2020-1908](https://cve.now/CVE-2020-1908.md): Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of S (no CVSS, Facebook WhatsApp Business for iOS · Facebook WhatsApp for…)
- [CVE-2020-26210](https://cve.now/CVE-2020-26210.md): Cross-Site Scripting in BookStack (CVSS 7.7, BookStackApp BookStack)
- [CVE-2020-4785](https://cve.now/CVE-2020-4785.md): IBM App Connect Enterprise Certified Container 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 could allow a remote attacker to hijack the clicking ac (CVSS 5.4, IBM App Connect Enterprise Certified Container)
- [CVE-2020-4649](https://cve.now/CVE-2020-4649.md): IBM Planning Analytics Local 2.0.9.2 and IBM Planning Analytics Workspace 57 could expose data to non-privleged users by not invalidating TM (CVSS 4.3, IBM Planning Analytics Local · IBM Planning Analytics Works…)
- [CVE-2019-4349](https://cve.now/CVE-2019-4349.md): IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 applications can be installed on a deprecated operating system version that could (CVSS 3.5, IBM Maximo Anywhere)
- [CVE-2020-6557](https://cve.now/CVE-2020-6557.md): Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a (no CVSS, Google Chrome)
- [CVE-2020-16010](https://cve.now/CVE-2020-16010.md): Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, KEV, Google Chrome)
- [CVE-2020-16011](https://cve.now/CVE-2020-16011.md): Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer pro (no CVSS, Google Chrome)
- [CVE-2020-16009](https://cve.now/CVE-2020-16009.md): Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, KEV, Google Chrome · CefSharp.Common +3)
- [CVE-2020-16007](https://cve.now/CVE-2020-16007.md): Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege (no CVSS, Google Chrome)
- [CVE-2020-16008](https://cve.now/CVE-2020-16008.md): Stack buffer overflow in WebRTC in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit stack corruption vi (no CVSS, Google Chrome)
- [CVE-2020-16004](https://cve.now/CVE-2020-16004.md): Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2020-16005](https://cve.now/CVE-2020-16005.md): Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corru (no CVSS, Google Chrome)
- [CVE-2020-16006](https://cve.now/CVE-2020-16006.md): Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-16002](https://cve.now/CVE-2020-16002.md): Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-16003](https://cve.now/CVE-2020-16003.md): Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-16000](https://cve.now/CVE-2020-16000.md): Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2020-16001](https://cve.now/CVE-2020-16001.md): Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-15998](https://cve.now/CVE-2020-15998.md): Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potential (no CVSS, Google Chrome)
- [CVE-2020-15997](https://cve.now/CVE-2020-15997.md): Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentia (no CVSS, Google Chrome)
- [CVE-2020-15995](https://cve.now/CVE-2020-15995.md): Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-15996](https://cve.now/CVE-2020-15996.md): Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2020-15993](https://cve.now/CVE-2020-15993.md): Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2020-15994](https://cve.now/CVE-2020-15994.md): Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2020-15991](https://cve.now/CVE-2020-15991.md): Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2020-15992](https://cve.now/CVE-2020-15992.md): Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the rende (no CVSS, Google Chrome)
- [CVE-2020-15989](https://cve.now/CVE-2020-15989.md): Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fr (no CVSS, Google Chrome)
- [CVE-2020-15990](https://cve.now/CVE-2020-15990.md): Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2020-15987](https://cve.now/CVE-2020-15987.md): Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-15988](https://cve.now/CVE-2020-15988.md): Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the u (no CVSS, Google Chrome)
- [CVE-2020-15985](https://cve.now/CVE-2020-15985.md): Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HT (no CVSS, Google Chrome)
- [CVE-2020-15986](https://cve.now/CVE-2020-15986.md): Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2020-15983](https://cve.now/CVE-2020-15983.md): Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security (no CVSS, Google Chrome)
- [CVE-2020-15984](https://cve.now/CVE-2020-15984.md): Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of (no CVSS, Google Chrome)
- [CVE-2020-15981](https://cve.now/CVE-2020-15981.md): Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information fro (no CVSS, Google Chrome)
- [CVE-2020-15982](https://cve.now/CVE-2020-15982.md): Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive infor (no CVSS, Google Chrome)
- [CVE-2020-15978](https://cve.now/CVE-2020-15978.md): Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised t (no CVSS, Google Chrome)
- [CVE-2020-15979](https://cve.now/CVE-2020-15979.md): Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2020-15980](https://cve.now/CVE-2020-15980.md): Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation r (no CVSS, Google Chrome)
- [CVE-2020-15976](https://cve.now/CVE-2020-15976.md): Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2020-15977](https://cve.now/CVE-2020-15977.md): Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensi (no CVSS, Google Chrome)
- [CVE-2020-15974](https://cve.now/CVE-2020-15974.md): Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2020-15975](https://cve.now/CVE-2020-15975.md): Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2020-15973](https://cve.now/CVE-2020-15973.md): Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a m (no CVSS, Google Chrome)
- [CVE-2020-15970](https://cve.now/CVE-2020-15970.md): Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potential (no CVSS, Google Chrome)
- [CVE-2020-15971](https://cve.now/CVE-2020-15971.md): Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2020-15968](https://cve.now/CVE-2020-15968.md): Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2020-15969](https://cve.now/CVE-2020-15969.md): Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-15967](https://cve.now/CVE-2020-15967.md): Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a cr (no CVSS, Google Chrome)
- [CVE-2020-15972](https://cve.now/CVE-2020-15972.md): Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2020-15999](https://cve.now/CVE-2020-15999.md): Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 9.6, KEV, Google Chrome · CefSharp.Common +3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.