CVEs published November 4, 2020
40 CVEs were published on November 4, 2020: 0 critical, 1 high.
- Published
- 40
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Jenkins project Jenkins Active Directory Plugin · org.jenki…
- 5
- Jenkins project Jenkins Kubernetes Plugin · org.csanchez.je…
- 3
- Aruba Airwave Software
- 2
- Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…
- 2
- The TCPdump Group tcpdump
- 2
- github.com/hashicorp/consul
- 1
- Jenkins project Jenkins Ansible Plugin · org.jenkins-ci.plu…
- 1
- Jenkins project Jenkins AppSpider Plugin · com.rapid7:jenki…
- 1
- Jenkins project Jenkins AWS Global Configuration Plugin · i…
- 1
- Jenkins project Jenkins Azure Key Vault Plugin · org.jenkin…
- 1
High 1
Medium, low and unrated 39
- CVE-2020-25201HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of servicegithub.com/hashicorp/consul
- CVE-2020-27692The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management p
- CVE-2020-27691The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log
- CVE-2020-27690The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal.
- CVE-2020-27689The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web manage
- CVE-2019-7356Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.
- CVE-2020-7128A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-7129A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.Aruba Airwave Software
- CVE-2020-8036str2tokbuf used incorrectly by print-someip.cThe TCPdump Group tcpdump
- CVE-2020-8037ppp decapsulator can be convinced to allocate a large amount of memoryThe TCPdump Group tcpdump
- CVE-2020-22274JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.
- CVE-2020-22273Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Setting
- CVE-2020-22275Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands.
- CVE-2020-22277Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile.
- CVE-2020-22276WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.
- CVE-2020-22278phpMyAdmin through 5.0.2 allows CSV injection via Export Section.
- CVE-2020-26167In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an adm
- CVE-2020-2318Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins coJenkins project Jenkins Mail Commander Plugin for Jenkins-c…
- CVE-2020-2319Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins controJenkins project Jenkins VMware Lab Manager Slaves Plugin ·…
- CVE-2020-2316Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-siJenkins project Jenkins Static Analysis Utilities Plugin ·…
- CVE-2020-2317Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSJenkins project Jenkins FindBugs Plugin · org.jvnet.hudson.…
- CVE-2020-2314Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where iJenkins project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2020-2315Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Visualworks Store Plugin · org.jenk…
- CVE-2020-2312Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs.Jenkins project Jenkins SQLPlus Script Runner Plugin · org.…
- CVE-2020-2313A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credJenkins project Jenkins Azure Key Vault Plugin · org.jenkin…
- CVE-2020-2310Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDJenkins project Jenkins Ansible Plugin · org.jenkins-ci.plu…
- CVE-2020-2311A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replaJenkins project Jenkins AWS Global Configuration Plugin · i…
- CVE-2020-2307Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variableJenkins project Jenkins Kubernetes Plugin · org.csanchez.je…
- CVE-2020-2308A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod Jenkins project Jenkins Kubernetes Plugin · org.csanchez.je…
- CVE-2020-2309A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enuJenkins project Jenkins Kubernetes Plugin · org.csanchez.je…
- CVE-2020-2305Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…
- CVE-2020-2306A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of naJenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…
- CVE-2020-2303A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connectionJenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2020-2304Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…
- CVE-2020-2301Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication Jenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2020-2302A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the dJenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2020-2299Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password.Jenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2020-2300Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackersJenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2020-28049An issue was discovered in SDDM before 0.19.0.