# CVEs published 2020-11-05

60 CVEs were published on November 5, 2020: 2 critical, 9 high. Days are UTC.

- [CVE-2020-6877](https://cve.now/CVE-2020-6877.md): A ZTE product is impacted by an information leak vulnerability. (no CVSS, ZXA10 eODN)
- [CVE-2020-25837](https://cve.now/CVE-2020-25837.md): Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. (no CVSS, Micro Focus Self Service Password Reset)
- [CVE-2020-17510](https://cve.now/CVE-2020-17510.md): Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. (no CVSS, Apache Shiro · org.apache.shiro:shiro-spring)
- [CVE-2020-7207](https://cve.now/CVE-2020-7207.md): A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation E (no CVSS, HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360…)
- [CVE-2020-13537](https://cve.now/CVE-2020-13537.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. (CVSS 9.3, Moxa)
- [CVE-2020-13536](https://cve.now/CVE-2020-13536.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. (CVSS 9.3, Moxa)
- [CVE-2020-25661](https://cve.now/CVE-2020-25661.md): A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A (CVSS 7.5, Red Hat kernel)
- [CVE-2020-6015](https://cve.now/CVE-2020-6015.md): Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent th (no CVSS, Check Point Endpoint Security for Windows)
- [CVE-2020-24436](https://cve.now/CVE-2020-24436.md): Acrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24439](https://cve.now/CVE-2020-24439.md): Acrobat Reader DC for macOS Signature Validation Bypass (CVSS 2.8, Adobe Acrobat Reader)
- [CVE-2020-24433](https://cve.now/CVE-2020-24433.md): Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24438](https://cve.now/CVE-2020-24438.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24434](https://cve.now/CVE-2020-24434.md): Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24435](https://cve.now/CVE-2020-24435.md): Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24432](https://cve.now/CVE-2020-24432.md): Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents (CVSS 6.7, Adobe Acrobat Reader)
- [CVE-2020-24430](https://cve.now/CVE-2020-24430.md): Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24429](https://cve.now/CVE-2020-24429.md): Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation (CVSS 7.7, Adobe Acrobat Reader)
- [CVE-2020-24431](https://cve.now/CVE-2020-24431.md): Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability (CVSS 4.4, Adobe Acrobat Reader)
- [CVE-2020-24428](https://cve.now/CVE-2020-24428.md): Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation (CVSS 7.7, Adobe Acrobat Reader)
- [CVE-2020-24437](https://cve.now/CVE-2020-24437.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2020-24427](https://cve.now/CVE-2020-24427.md): Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-24426](https://cve.now/CVE-2020-24426.md): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2020-5946](https://cve.now/CVE-2020-5946.md): In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format clie (no CVSS, BIG-IP)
- [CVE-2020-5944](https://cve.now/CVE-2020-5944.md): In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disa (no CVSS, BIG-IQ)
- [CVE-2020-5943](https://cve.now/CVE-2020-5943.md): In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected field (no CVSS, BIG-IP)
- [CVE-2020-5945](https://cve.now/CVE-2020-5945.md): In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulne (no CVSS, BIG-IP)
- [CVE-2020-5940](https://cve.now/CVE-2020-5940.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclose (no CVSS, BIG-IP)
- [CVE-2020-5941](https://cve.now/CVE-2020-5941.md): On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Mi (no CVSS, BIG-IP)
- [CVE-2020-5942](https://cve.now/CVE-2020-5942.md): In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when proces (no CVSS, BIG-IP)
- [CVE-2020-5939](https://cve.now/CVE-2020-5939.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on (no CVSS, BIG-IP Virtual Edition)
- [CVE-2020-5793](https://cve.now/CVE-2020-5793.md): A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated (no CVSS, Tenable Nessus for Windows and Tenable Nessus Agent for Win…)
- [CVE-2020-12146](https://cve.now/CVE-2020-12146.md): Silver Peak Unity OrchestratorTM subject to path traversal. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-12147](https://cve.now/CVE-2020-12147.md): Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-12145](https://cve.now/CVE-2020-12145.md): Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers. (CVSS 6.6, Silver Peak Systems Unity Orchestrator)
- [CVE-2020-8267](https://cve.now/CVE-2020-8267.md): A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using (no CVSS, UniFi Protect)
- [CVE-2020-13661](https://cve.now/CVE-2020-13661.md): Telerik Fiddler through 5.0.20202.18177 allows attackers to execute arbitrary programs via a hostname with a trailing space character, follo (no CVSS)
- [CVE-2020-26507](https://cve.now/CVE-2020-26507.md): A CSV Injection (also known as Formula Injection) vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users (no CVSS)
- [CVE-2020-26505](https://cve.now/CVE-2020-26505.md): A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code (no CVSS)
- [CVE-2020-14222](https://cve.now/CVE-2020-14222.md): HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). (no CVSS, HCL Digital Experience)
- [CVE-2018-1725](https://cve.now/CVE-2018-1725.md): IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. (CVSS 3.2, IBM QRadar SIEM)
- [CVE-2020-4097](https://cve.now/CVE-2020-4097.md): In HCL Notes version 9 previous to release 9.0.1 FixPack 10 Interim Fix 8, version 10 previous to release 10.0.1 FixPack 6 and version 11 pr (no CVSS, HCL Notes)
- [CVE-2020-14240](https://cve.now/CVE-2020-14240.md): HCL Notes versions previous to releases 9.0.1 FP10 IF8, 10.0.1 FP6 and 11.0.1 FP1 is susceptible to a Stored Cross-site Scripting (XSS) vuln (no CVSS, HCL Notes)
- [CVE-2020-25398](https://cve.now/CVE-2020-25398.md): CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality. (no CVSS)
- [CVE-2020-25399](https://cve.now/CVE-2020-25399.md): Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the cha (no CVSS)
- [CVE-2020-26506](https://cve.now/CVE-2020-26506.md): An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain contr (no CVSS)
- [CVE-2020-27688](https://cve.now/CVE-2020-27688.md): RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. (no CVSS)
- [CVE-2020-28115](https://cve.now/CVE-2020-28115.md): SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands (no CVSS)
- [CVE-2020-27955](https://cve.now/CVE-2020-27955.md): Git LFS 2.12.0 allows Remote Code Execution. (no CVSS, github.com/git-lfs/git-lfs)
- [CVE-2020-28047](https://cve.now/CVE-2020-28047.md): AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). (no CVSS)
- [CVE-2020-15950](https://cve.now/CVE-2020-15950.md): Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout. (no CVSS)
- [CVE-2020-15949](https://cve.now/CVE-2020-15949.md): Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover. (no CVSS)
- [CVE-2020-15951](https://cve.now/CVE-2020-15951.md): Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content (no CVSS)
- [CVE-2020-15952](https://cve.now/CVE-2020-15952.md): Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. (no CVSS)
- [CVE-2020-27402](https://cve.now/CVE-2020-27402.md): The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binar (no CVSS)
- [CVE-2020-24849](https://cve.now/CVE-2020-24849.md): A remote code execution vulnerability is identified in FruityWifi through 2.4. (no CVSS)
- [CVE-2020-7763](https://cve.now/CVE-2020-7763.md): Arbitrary File Read (CVSS 7.5, phantom-html-to-pdf)
- [CVE-2020-7762](https://cve.now/CVE-2020-7762.md): Arbitrary File Read (CVSS 6.5, jsreport-chrome-pdf)
- [CVE-2020-7761](https://cve.now/CVE-2020-7761.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, @absolunet/kafe)
- [CVE-2020-27387](https://cve.now/CVE-2020-27387.md): An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) (no CVSS)
- [CVE-2020-25662](https://cve.now/CVE-2020-25662.md): A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initializa (CVSS 5.3, Red Hat kernel)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.