CVEs published November 9, 2020
42 CVEs were published on November 9, 2020: 1 critical, 3 high.
- Published
- 42
- Critical
- 1
- High
- 3
- Medium
- 7
- Low
- 3
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Trend Micro InterScan Messaging Security Virtual Appliance
- 6
- Adobe Magento Commerce · magento/community-edition
- 4
- Adobe Magento Commerce · magento/community-edition +1
- 4
- IBM Maximo Spatial Asset Management
- 2
- Netflix Dispatch
- 2
- Nextcloud Server
- 2
- Atlassian gajira-comment
- 1
- Atlassian gajira-create
- 1
- Bitdefender Update Server
- 1
- https://github.com/brave/brave-core
- 1
Critical 1
High 3
- CVE-2020-4759IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection.IBM FileNet Content Manager
- CVE-2020-15297Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to Bitdefender Update Server
- CVE-2020-24400SQL injection allows arbitrary read from databaseAdobe Magento Commerce · magento/community-edition
Medium, low and unrated 38
- CVE-2020-27019Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could Trend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-27693Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdaTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-27694Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attackTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-27017Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerabilitTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-27018Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which coTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-27016Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability whTrend Micro InterScan Messaging Security Virtual Appliance
- CVE-2020-14189The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary codeAtlassian gajira-comment
- CVE-2020-14188The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary cAtlassian gajira-create
- CVE-2020-28373upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow.
- CVE-2020-26168The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't
- CVE-2020-28371An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27.
- CVE-2020-4651IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an IBM Maximo Spatial Asset Management
- CVE-2020-4650IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by anotheIBM Maximo Spatial Asset Management
- CVE-2020-27977CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry va
- CVE-2020-28364A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectatlocust
- CVE-2020-27982IceWarp 11.4.5.0 allows XSS via the language parameter.
- CVE-2020-26542An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in
- CVE-2020-23140Microweber 1.1.18 is affected by insufficient session expiration.
- CVE-2020-23139Microweber 1.1.18 is affected by broken authentication and session management.
- CVE-2020-23138An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page.
- CVE-2020-23136Microweber v1.1.18 is affected by no session expiry after log-out.microweber/microweber
- CVE-2020-14366A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resourcesRed Hat keycloak · org.keycloak:keycloak-parent
- CVE-2020-9299There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident PrNetflix Dispatch
- CVE-2020-9300The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselNetflix Dispatch
- CVE-2020-25655An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions.Red Hat open-cluster-management
- CVE-2020-8133A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file.Nextcloud Server
- CVE-2020-8150A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encryptedNextcloud Server
- CVE-2020-8268Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties ofjson8-merge-patch
- CVE-2020-8276The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the usehttps://github.com/brave/brave-core
- CVE-2020-24353Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.
- CVE-2020-28351The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site
- CVE-2020-28349An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service
- CVE-2020-24404Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST APIAdobe Magento Commerce · magento/community-edition
- CVE-2020-24406Document root path disclosure on Maintenance pageAdobe Magento Commerce · magento/community-edition
- CVE-2020-24405Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock dataAdobe Magento Commerce · magento/community-edition
- CVE-2020-24403Incorrect permissions could lead to unauthorized modification of inventory source data via REST APIAdobe Magento Commerce · magento/community-edition +1
- CVE-2020-24401Incorrect permissions following the deletion of a user role or deactivation of a userAdobe Magento Commerce · magento/community-edition +1
- CVE-2020-24402Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST APIAdobe Magento Commerce · magento/community-edition +1