# CVEs published 2020-11-04

40 CVEs were published on November 4, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-25201](https://cve.now/CVE-2020-25201.md): HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service (no CVSS, github.com/hashicorp/consul)
- [CVE-2020-26207](https://cve.now/CVE-2020-26207.md): Unsafe deserialization in DatabaseSchemaViewer (CVSS 8.0, martinjw dbschemareader)
- [CVE-2020-27692](https://cve.now/CVE-2020-27692.md): The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management p (no CVSS)
- [CVE-2020-27691](https://cve.now/CVE-2020-27691.md): The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log (no CVSS)
- [CVE-2020-27690](https://cve.now/CVE-2020-27690.md): The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. (no CVSS)
- [CVE-2020-27689](https://cve.now/CVE-2020-27689.md): The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web manage (no CVSS)
- [CVE-2019-7356](https://cve.now/CVE-2019-7356.md): Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter. (no CVSS)
- [CVE-2020-7128](https://cve.now/CVE-2020-7128.md): A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software)
- [CVE-2020-7129](https://cve.now/CVE-2020-7129.md): A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. (no CVSS, Aruba Airwave Software)
- [CVE-2020-8036](https://cve.now/CVE-2020-8036.md): str2tokbuf used incorrectly by print-someip.c (no CVSS, The TCPdump Group tcpdump)
- [CVE-2020-8037](https://cve.now/CVE-2020-8037.md): ppp decapsulator can be convinced to allocate a large amount of memory (no CVSS, The TCPdump Group tcpdump)
- [CVE-2020-22274](https://cve.now/CVE-2020-22274.md): JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile. (no CVSS)
- [CVE-2020-22273](https://cve.now/CVE-2020-22273.md): Neoflex Video Subscription System Version 2.0 is affected by CSRF which allows the Website's Settings to be changed (such as Payment Setting (no CVSS)
- [CVE-2020-22275](https://cve.now/CVE-2020-22275.md): Easy Registration Forms (ER Forms) Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. (no CVSS)
- [CVE-2020-22277](https://cve.now/CVE-2020-22277.md): Import and export users and customers WordPress Plugin through 1.15.5.11 allows CSV injection via a customer's profile. (no CVSS)
- [CVE-2020-22276](https://cve.now/CVE-2020-22276.md): WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry. (no CVSS)
- [CVE-2020-22278](https://cve.now/CVE-2020-22278.md): phpMyAdmin through 5.0.2 allows CSV injection via Export Section. (no CVSS)
- [CVE-2020-26167](https://cve.now/CVE-2020-26167.md): In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an adm (no CVSS)
- [CVE-2020-2318](https://cve.now/CVE-2020-2318.md): Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins co (no CVSS, Jenkins project Jenkins Mail Commander Plugin for Jenkins-c…)
- [CVE-2020-2319](https://cve.now/CVE-2020-2319.md): Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global config.xml file on the Jenkins contro (no CVSS, Jenkins project Jenkins VMware Lab Manager Slaves Plugin ·…)
- [CVE-2020-2316](https://cve.now/CVE-2020-2316.md): Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-si (no CVSS, Jenkins project Jenkins Static Analysis Utilities Plugin ·…)
- [CVE-2020-2317](https://cve.now/CVE-2020-2317.md): Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XS (no CVSS, Jenkins project Jenkins FindBugs Plugin · org.jvnet.hudson.…)
- [CVE-2020-2314](https://cve.now/CVE-2020-2314.md): Jenkins AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file on the Jenkins controller where i (no CVSS, Jenkins project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2020-2315](https://cve.now/CVE-2020-2315.md): Jenkins Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Visualworks Store Plugin · org.jenk…)
- [CVE-2020-2312](https://cve.now/CVE-2020-2312.md): Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier does not mask a password provided as command line argument in build logs. (no CVSS, Jenkins project Jenkins SQLPlus Script Runner Plugin · org.…)
- [CVE-2020-2313](https://cve.now/CVE-2020-2313.md): A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate cred (no CVSS, Jenkins project Jenkins Azure Key Vault Plugin · org.jenkin…)
- [CVE-2020-2310](https://cve.now/CVE-2020-2310.md): Missing permission checks in Jenkins Ansible Plugin 1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials ID (no CVSS, Jenkins project Jenkins Ansible Plugin · org.jenkins-ci.plu…)
- [CVE-2020-2311](https://cve.now/CVE-2020-2311.md): A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to repla (no CVSS, Jenkins project Jenkins AWS Global Configuration Plugin · i…)
- [CVE-2020-2307](https://cve.now/CVE-2020-2307.md): Jenkins Kubernetes Plugin 1.27.3 and earlier allows low-privilege users to access possibly sensitive Jenkins controller environment variable (no CVSS, Jenkins project Jenkins Kubernetes Plugin · org.csanchez.je…)
- [CVE-2020-2308](https://cve.now/CVE-2020-2308.md): A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod (no CVSS, Jenkins project Jenkins Kubernetes Plugin · org.csanchez.je…)
- [CVE-2020-2309](https://cve.now/CVE-2020-2309.md): A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enu (no CVSS, Jenkins project Jenkins Kubernetes Plugin · org.csanchez.je…)
- [CVE-2020-2305](https://cve.now/CVE-2020-2305.md): Jenkins Mercurial Plugin 2.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…)
- [CVE-2020-2306](https://cve.now/CVE-2020-2306.md): A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of na (no CVSS, Jenkins project Jenkins Mercurial Plugin · org.jenkins-ci.p…)
- [CVE-2020-2303](https://cve.now/CVE-2020-2303.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2020-2304](https://cve.now/CVE-2020-2304.md): Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Subversion Plugin · org.jenkins-ci.…)
- [CVE-2020-2301](https://cve.now/CVE-2020-2301.md): Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a successful authentication (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2020-2302](https://cve.now/CVE-2020-2302.md): A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the d (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2020-2299](https://cve.now/CVE-2020-2299.md): Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as the password. (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2020-2300](https://cve.now/CVE-2020-2300.md): Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, which allows attackers (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2020-28049](https://cve.now/CVE-2020-28049.md): An issue was discovered in SDDM before 0.19.0. (CVSS 6.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.