CVEs published November 5, 2020
60 CVEs were published on November 5, 2020: 2 critical, 9 high.
- Published
- 60
- Critical
- 2
- High
- 9
- Medium
- 8
- Low
- 6
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Adobe Acrobat Reader
- 14
- BIG-IP
- 6
- Silver Peak Systems Unity Orchestrator
- 3
- HCL Notes
- 2
- Moxa
- 2
- Red Hat kernel
- 2
- @absolunet/kafe
- 1
- Apache Shiro · org.apache.shiro:shiro-spring
- 1
- BIG-IP Virtual Edition
- 1
- BIG-IQ
- 1
Critical 2
- CVE-2020-13537An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.Moxa
- CVE-2020-13536An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation.Moxa
High 9
- CVE-2020-25661A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with ARed Hat kernel
- CVE-2020-24436Acrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2020-24433Adobe Acrobat Reader DC Local Privilege Escalation via Installer ComponentAdobe Acrobat Reader
- CVE-2020-24435Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2020-24430Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2020-24429Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege EscalationAdobe Acrobat Reader
- CVE-2020-24428Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege EscalationAdobe Acrobat Reader
- CVE-2020-24437Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Acrobat Reader
- CVE-2020-7763Arbitrary File Readphantom-html-to-pdf
Medium, low and unrated 49
- CVE-2020-6877A ZTE product is impacted by an information leak vulnerability.ZXA10 eODN
- CVE-2020-25837Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product.Micro Focus Self Service Password Reset
- CVE-2020-17510Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.Apache Shiro · org.apache.shiro:shiro-spring
- CVE-2020-7207A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation EHPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360…
- CVE-2020-6015Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent thCheck Point Endpoint Security for Windows
- CVE-2020-24439Acrobat Reader DC for macOS Signature Validation BypassAdobe Acrobat Reader
- CVE-2020-24438Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information DisclosureAdobe Acrobat Reader
- CVE-2020-24434Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information DisclosureAdobe Acrobat Reader
- CVE-2020-24432Acrobat Reader DC Arbitrary JavaScript Execution in PDF DocumentsAdobe Acrobat Reader
- CVE-2020-24431Acrobat Reader DC for macOS Dynamic Library Injection VulnerabilityAdobe Acrobat Reader
- CVE-2020-24427Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information DisclosureAdobe Acrobat Reader
- CVE-2020-24426Acrobat Reader DC Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2020-5946In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format clieBIG-IP
- CVE-2020-5944In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disaBIG-IQ
- CVE-2020-5943In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fieldBIG-IP
- CVE-2020-5945In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulneBIG-IP
- CVE-2020-5940In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undiscloseBIG-IP
- CVE-2020-5941On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management MiBIG-IP
- CVE-2020-5942In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when procesBIG-IP
- CVE-2020-5939In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on BIG-IP Virtual Edition
- CVE-2020-5793A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated Tenable Nessus for Windows and Tenable Nessus Agent for Win…
- CVE-2020-12146Silver Peak Unity OrchestratorTM subject to path traversal.Silver Peak Systems Unity Orchestrator
- CVE-2020-12147Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.Silver Peak Systems Unity Orchestrator
- CVE-2020-12145Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.Silver Peak Systems Unity Orchestrator
- CVE-2020-8267A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was usingUniFi Protect
- CVE-2020-13661Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, follo
- CVE-2020-26507A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users
- CVE-2020-26505A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code
- CVE-2020-14222HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS).HCL Digital Experience
- CVE-2018-1725IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure.IBM QRadar SIEM
- CVE-2020-4097In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 prHCL Notes
- CVE-2020-14240HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vulnHCL Notes
- CVE-2020-25398CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.
- CVE-2020-25399Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the cha
- CVE-2020-26506An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain contr
- CVE-2020-27688RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files.
- CVE-2020-28115SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands
- CVE-2020-27955Git LFS 2.12.0 allows Remote Code Execution.github.com/git-lfs/git-lfs
- CVE-2020-28047AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting).
- CVE-2020-15950Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.
- CVE-2020-15949Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.
- CVE-2020-15951Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content
- CVE-2020-15952Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions.
- CVE-2020-27402The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binar
- CVE-2020-24849A remote code execution vulnerability is identified in FruityWifi through 2.4.
- CVE-2020-7762Arbitrary File Readjsreport-chrome-pdf
- CVE-2020-7761Regular Expression Denial of Service (ReDoS)@absolunet/kafe
- CVE-2020-27387An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager)
- CVE-2020-25662A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initializaRed Hat kernel