CVEs published November 6, 2020
74 CVEs were published on November 6, 2020: 3 critical, 16 high. 1 is now in CISA KEV.
- Published
- 74
- Critical
- 3
- High
- 16
- Medium
- 20
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- Cisco SD-WAN vManage
- 7
- Mitsubishi Electric GT14 Model of GOT 1000 series
- 6
- Cisco SD-WAN Solution
- 5
- B. Braun Melsungen AG OnlineSuite
- 3
- Cisco Identity Services Engine Software
- 3
- Cisco Webex Network Recording Player
- 3
- IBM UrbanCode Deploy
- 3
- salt
- 3
- Cisco AnyConnect Secure Mobility Client
- 2
- com.typesafe.play:play · com.typesafe.play:play-java
- 2
Critical 3
High 16
- CVE-2020-15259CSRF in Auth0 ad-ldap-connectorauth0 ad-ldap-connector
- CVE-2020-3604Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco Webex Network Recording Player
- CVE-2020-3603Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco Webex Network Recording Player
- CVE-2020-3600Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2020-3595Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2020-3594Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2020-3593Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2020-3588Cisco Webex Meetings Desktop App Arbitrary Code Execution VulnerabilityCisco Webex Meetings Desktop App
- CVE-2020-3574Cisco IP Phone TCP Packet Flood Denial of Service VulnerabilityCisco IP Phones with Multiplatform Firmware
- CVE-2020-3573Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution VulnerabilitiesCisco Webex Network Recording Player
- CVE-2020-3556Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2020-3284Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution VulnerabilityCisco IOS XR Software
- CVE-2020-10291RVD#3336: System information disclosure without authentication on KUKA simulatorsKUKA Roboter Visual Components Network License Server
- CVE-2020-10292Service DoS through arbitrary pointer dereferencing on KUKA simulatorKUKA Roboter Visual Components Network License Server
- CVE-2020-28196MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because th
- CVE-2020-27347tmux stack buffer overflow in function input_csi_dispatch_sgr_colontmux · Ubuntu tmux
Medium, low and unrated 55
- CVE-2020-28168Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providinaxios
- CVE-2020-28328SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting.
- CVE-2020-3592Cisco SD-WAN vManage Software Authorization Bypass VulnerabilityCisco SD-WAN vManage
- CVE-2020-3591Cisco SD-WAN vManage Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2020-3590Cisco SD-WAN vManage Software Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2020-3587Cisco SD-WAN vManage Software Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2020-3579Cisco SD-WAN vManage Software Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2020-3551Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2020-3444Cisco SD-WAN Software Packet Filtering Bypass VulnerabilityCisco SD-WAN Solution
- CVE-2020-3371Cisco Integrated Management Controller Command Injection VulnerabilityCisco Unified Computing System
- CVE-2020-27129Cisco SD-WAN vManage Software Command Injection VulnerabilityCisco SD-WAN vManage
- CVE-2020-27128Cisco SD-WAN vManage Software Arbitrary File Creation VulnerabilityCisco SD-WAN vManage
- CVE-2020-27123Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2020-27122Cisco Identity Services Engine Privilege Escalation VulnerabilityCisco Identity Services Engine Software
- CVE-2020-27121Cisco Unified Communications Manager IM and Presence Service Denial of Service VulnerabilityCisco Unified Communications Manager IM and Presence Service
- CVE-2020-26086Cisco TelePresence Collaboration Endpoint Software Information Disclosure VulnerabilityCisco TelePresence Endpoint Software
- CVE-2020-26084Cisco Edge Fog Fabric Resource Exposure VulnerabilityCisco Edge Fog Fabric
- CVE-2020-26083Cisco Identity Services Engine Cross-Site Scripting VulnerabilityCisco Identity Services Engine Software
- CVE-2020-28327A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x befo
- CVE-2017-18926raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarati
- CVE-2020-26213Denial of Service in telerkitabisa teler · ktbs.dev/teler
- CVE-2020-5794A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to exeNessus Network Monitor
- CVE-2020-25172B. Braun OnlineSuiteB. Braun Melsungen AG OnlineSuite
- CVE-2020-25174B. Braun OnlineSuiteB. Braun Melsungen AG OnlineSuite
- CVE-2020-25170B. Braun OnlineSuiteB. Braun Melsungen AG OnlineSuite
- CVE-2020-8577SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sE-Series SANtricity OS Controller Software
- CVE-2020-8580SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker withE-Series SANtricity OS Controller Software
- CVE-2020-7198There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer.HP OneView; HPE Synergy Composer; HPE Synergy Composer
- CVE-2020-5795UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and netwoTP-Link Archer A7
- CVE-2020-4484IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could bIBM UrbanCode Deploy
- CVE-2020-4483IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detaiIBM UrbanCode Deploy
- CVE-2020-4482IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security.IBM UrbanCode Deploy
- CVE-2020-26882In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.com.typesafe.play:play
- CVE-2020-27196An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2.com.typesafe.play:play · com.typesafe.play:play-java
- CVE-2020-26883In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.com.typesafe.play:play · com.typesafe.play:play-java
- CVE-2020-27589Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.blackduck
- CVE-2020-27617eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure.
- CVE-2020-27616ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation.
- CVE-2020-27152An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2.
- CVE-2020-26892The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.github.com/nats-io/jwt · github.com/nats-io/nats-server/v2
- CVE-2020-26521The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).github.com/nats-io/jwt · github.com/nats-io/nats-server/v2
- CVE-2020-25592In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.salt
- CVE-2020-17490The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.salt
- CVE-2020-28250Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication
- CVE-2020-28249Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.joplin
- CVE-2020-28242An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Cer
- CVE-2020-28241libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
- CVE-2020-5667Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service.Studyplus App
- CVE-2020-5649Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS veMitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5648Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmwareMitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5647Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS versMitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5646NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS veMitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5644Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.Mitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5645Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05Mitsubishi Electric GT14 Model of GOT 1000 series
- CVE-2020-5643Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the buCybozu Garoon