# CVEs published 2020-11-06

74 CVEs were published on November 6, 2020: 3 critical, 16 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-15259](https://cve.now/CVE-2020-15259.md): CSRF in Auth0 ad-ldap-connector (CVSS 8.1, auth0 ad-ldap-connector)
- [CVE-2020-28168](https://cve.now/CVE-2020-28168.md): Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providin (no CVSS, axios)
- [CVE-2020-28328](https://cve.now/CVE-2020-28328.md): SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. (no CVSS)
- [CVE-2020-3604](https://cve.now/CVE-2020-3604.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco Webex Network Recording Player)
- [CVE-2020-3603](https://cve.now/CVE-2020-3603.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco Webex Network Recording Player)
- [CVE-2020-3600](https://cve.now/CVE-2020-3600.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2020-3595](https://cve.now/CVE-2020-3595.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2020-3594](https://cve.now/CVE-2020-3594.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2020-3593](https://cve.now/CVE-2020-3593.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2020-3592](https://cve.now/CVE-2020-3592.md): Cisco SD-WAN vManage Software Authorization Bypass Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2020-3591](https://cve.now/CVE-2020-3591.md): Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (CVSS 4.3, Cisco SD-WAN vManage)
- [CVE-2020-3590](https://cve.now/CVE-2020-3590.md): Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco SD-WAN vManage)
- [CVE-2020-3588](https://cve.now/CVE-2020-3588.md): Cisco Webex Meetings Desktop App Arbitrary Code Execution Vulnerability (CVSS 7.3, Cisco Webex Meetings Desktop App)
- [CVE-2020-3587](https://cve.now/CVE-2020-3587.md): Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco SD-WAN vManage)
- [CVE-2020-3579](https://cve.now/CVE-2020-3579.md): Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco SD-WAN vManage)
- [CVE-2020-3574](https://cve.now/CVE-2020-3574.md): Cisco IP Phone TCP Packet Flood Denial of Service Vulnerability (CVSS 7.5, Cisco IP Phones with Multiplatform Firmware)
- [CVE-2020-3573](https://cve.now/CVE-2020-3573.md): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (CVSS 7.8, Cisco Webex Network Recording Player)
- [CVE-2020-3556](https://cve.now/CVE-2020-3556.md): Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability (CVSS 7.3, Cisco AnyConnect Secure Mobility Client)
- [CVE-2020-3551](https://cve.now/CVE-2020-3551.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2020-3444](https://cve.now/CVE-2020-3444.md): Cisco SD-WAN Software Packet Filtering Bypass Vulnerability (CVSS 5.8, Cisco SD-WAN Solution)
- [CVE-2020-3371](https://cve.now/CVE-2020-3371.md): Cisco Integrated Management Controller Command Injection Vulnerability (CVSS 6.3, Cisco Unified Computing System)
- [CVE-2020-3284](https://cve.now/CVE-2020-3284.md): Cisco IOS XR Software Enhanced Preboot eXecution Environment Unsigned Code Execution Vulnerability (CVSS 8.1, Cisco IOS XR Software)
- [CVE-2020-27129](https://cve.now/CVE-2020-27129.md): Cisco SD-WAN vManage Software Command Injection Vulnerability (CVSS 6.7, Cisco SD-WAN vManage)
- [CVE-2020-27128](https://cve.now/CVE-2020-27128.md): Cisco SD-WAN vManage Software Arbitrary File Creation Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2020-27123](https://cve.now/CVE-2020-27123.md): Cisco AnyConnect Secure Mobility Client for Windows Arbitrary File Read Vulnerability (CVSS 5.5, Cisco AnyConnect Secure Mobility Client)
- [CVE-2020-27122](https://cve.now/CVE-2020-27122.md): Cisco Identity Services Engine Privilege Escalation Vulnerability (CVSS 4.4, Cisco Identity Services Engine Software)
- [CVE-2020-27121](https://cve.now/CVE-2020-27121.md): Cisco Unified Communications Manager IM and Presence Service Denial of Service Vulnerability (CVSS 4.3, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2020-26086](https://cve.now/CVE-2020-26086.md): Cisco TelePresence Collaboration Endpoint Software Information Disclosure Vulnerability (CVSS 4.3, Cisco TelePresence Endpoint Software)
- [CVE-2020-26084](https://cve.now/CVE-2020-26084.md): Cisco Edge Fog Fabric Resource Exposure Vulnerability (CVSS 6.5, Cisco Edge Fog Fabric)
- [CVE-2020-26083](https://cve.now/CVE-2020-26083.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2020-28327](https://cve.now/CVE-2020-28327.md): A res\_pjsip\_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x befo (no CVSS)
- [CVE-2020-26214](https://cve.now/CVE-2020-26214.md): LDAP authentication bypass in Alerta (CVSS 9.1, alerta · alerta-server)
- [CVE-2017-18926](https://cve.now/CVE-2017-18926.md): raptor\_xml\_writer\_start\_element\_common in raptor\_xml\_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarati (no CVSS)
- [CVE-2020-26213](https://cve.now/CVE-2020-26213.md): Denial of Service in teler (CVSS 5.9, kitabisa teler · ktbs.dev/teler)
- [CVE-2020-5794](https://cve.now/CVE-2020-5794.md): A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to exe (no CVSS, Nessus Network Monitor)
- [CVE-2020-25172](https://cve.now/CVE-2020-25172.md): B. Braun OnlineSuite (no CVSS, B. Braun Melsungen AG OnlineSuite)
- [CVE-2020-25174](https://cve.now/CVE-2020-25174.md): B. Braun OnlineSuite (no CVSS, B. Braun Melsungen AG OnlineSuite)
- [CVE-2020-25170](https://cve.now/CVE-2020-25170.md): B. Braun OnlineSuite (no CVSS, B. Braun Melsungen AG OnlineSuite)
- [CVE-2020-8577](https://cve.now/CVE-2020-8577.md): SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover s (no CVSS, E-Series SANtricity OS Controller Software)
- [CVE-2020-8580](https://cve.now/CVE-2020-8580.md): SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with (no CVSS, E-Series SANtricity OS Controller Software)
- [CVE-2020-7198](https://cve.now/CVE-2020-7198.md): There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. (no CVSS, HP OneView; HPE Synergy Composer; HPE Synergy Composer)
- [CVE-2020-5795](https://cve.now/CVE-2020-5795.md): UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)\_V5\_200721 allows an authenticated admin user, with physical access and netwo (no CVSS, TP-Link Archer A7)
- [CVE-2020-4484](https://cve.now/CVE-2020-4484.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could b (CVSS 4.3, IBM UrbanCode Deploy)
- [CVE-2020-4483](https://cve.now/CVE-2020-4483.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detai (CVSS 4.3, IBM UrbanCode Deploy)
- [CVE-2020-4482](https://cve.now/CVE-2020-4482.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. (CVSS 5.3, IBM UrbanCode Deploy)
- [CVE-2020-26882](https://cve.now/CVE-2020-26882.md): In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input. (no CVSS, com.typesafe.play:play)
- [CVE-2020-27196](https://cve.now/CVE-2020-27196.md): An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. (no CVSS, com.typesafe.play:play · com.typesafe.play:play-java)
- [CVE-2020-26883](https://cve.now/CVE-2020-26883.md): In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents. (no CVSS, com.typesafe.play:play · com.typesafe.play:play-java)
- [CVE-2020-27589](https://cve.now/CVE-2020-27589.md): Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases. (no CVSS, blackduck)
- [CVE-2020-10291](https://cve.now/CVE-2020-10291.md): RVD#3336: System information disclosure without authentication on KUKA simulators (CVSS 7.5, KUKA Roboter Visual Components Network License Server)
- [CVE-2020-10292](https://cve.now/CVE-2020-10292.md): Service DoS through arbitrary pointer dereferencing on KUKA simulator (CVSS 8.2, KUKA Roboter Visual Components Network License Server)
- [CVE-2020-27617](https://cve.now/CVE-2020-27617.md): eth\_get\_gso\_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. (no CVSS)
- [CVE-2020-27616](https://cve.now/CVE-2020-27616.md): ati\_2d\_blt in hw/display/ati\_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. (no CVSS)
- [CVE-2020-27152](https://cve.now/CVE-2020-27152.md): An issue was discovered in ioapic\_lazy\_update\_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. (no CVSS)
- [CVE-2020-26892](https://cve.now/CVE-2020-26892.md): The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled. (no CVSS, github.com/nats-io/jwt · github.com/nats-io/nats-server/v2)
- [CVE-2020-26521](https://cve.now/CVE-2020-26521.md): The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code). (no CVSS, github.com/nats-io/jwt · github.com/nats-io/nats-server/v2)
- [CVE-2020-25592](https://cve.now/CVE-2020-25592.md): In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. (no CVSS, salt)
- [CVE-2020-17490](https://cve.now/CVE-2020-17490.md): The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. (no CVSS, salt)
- [CVE-2020-16846](https://cve.now/CVE-2020-16846.md): An issue was discovered in SaltStack Salt through 3002. (CVSS 9.8, KEV, salt)
- [CVE-2020-28196](https://cve.now/CVE-2020-28196.md): MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because th (CVSS 7.5)
- [CVE-2020-28250](https://cve.now/CVE-2020-28250.md): Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication (no CVSS)
- [CVE-2020-28249](https://cve.now/CVE-2020-28249.md): Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. (no CVSS, joplin)
- [CVE-2020-28242](https://cve.now/CVE-2020-28242.md): An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Cer (no CVSS)
- [CVE-2020-28241](https://cve.now/CVE-2020-28241.md): libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump\_entry\_data\_list in maxminddb.c. (no CVSS)
- [CVE-2020-27347](https://cve.now/CVE-2020-27347.md): tmux stack buffer overflow in function input\_csi\_dispatch\_sgr\_colon (CVSS 8.8, tmux · Ubuntu tmux)
- [CVE-2020-5667](https://cve.now/CVE-2020-5667.md): Studyplus App for Android v6.3.7 and earlier and Studyplus App for iOS v8.29.0 and earlier use a hard-coded API key for an external service. (no CVSS, Studyplus App)
- [CVE-2020-5649](https://cve.now/CVE-2020-5649.md): Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS ve (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5648](https://cve.now/CVE-2020-5648.md): Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5647](https://cve.now/CVE-2020-5647.md): Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS vers (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5646](https://cve.now/CVE-2020-5646.md): NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS ve (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5644](https://cve.now/CVE-2020-5644.md): Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05. (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5645](https://cve.now/CVE-2020-5645.md): Session fixation vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05 (no CVSS, Mitsubishi Electric GT14 Model of GOT 1000 series)
- [CVE-2020-5643](https://cve.now/CVE-2020-5643.md): Improper input validation vulnerability in Cybozu Garoon 5.0.0 to 5.0.2 allows a remote authenticated attacker to delete some data of the bu (no CVSS, Cybozu Garoon)
- [CVE-2020-15708](https://cve.now/CVE-2020-15708.md): Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability (CVSS 9.3, Ubuntu libvirt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.