# CVEs published 2020-11-09

42 CVEs were published on November 9, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-27019](https://cve.now/CVE-2020-27019.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-27693](https://cve.now/CVE-2020-27693.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outda (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-27694](https://cve.now/CVE-2020-27694.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-27017](https://cve.now/CVE-2020-27017.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerabilit (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-27018](https://cve.now/CVE-2020-27018.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which co (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-27016](https://cve.now/CVE-2020-27016.md): Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability wh (no CVSS, Trend Micro InterScan Messaging Security Virtual Appliance)
- [CVE-2020-14189](https://cve.now/CVE-2020-14189.md): The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to execute arbitrary code (no CVSS, Atlassian gajira-comment)
- [CVE-2020-14188](https://cve.now/CVE-2020-14188.md): The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary c (no CVSS, Atlassian gajira-create)
- [CVE-2020-28373](https://cve.now/CVE-2020-28373.md): upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. (no CVSS)
- [CVE-2020-26168](https://cve.now/CVE-2020-26168.md): The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x through 4.2, doesn't (no CVSS)
- [CVE-2020-28371](https://cve.now/CVE-2020-28371.md): An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. (no CVSS)
- [CVE-2020-4759](https://cve.now/CVE-2020-4759.md): IBM FileNet Content Manager 5.5.4 and 5.5.5 is potentially vulnerable to CVS Injection. (CVSS 7.0, IBM FileNet Content Manager)
- [CVE-2020-4651](https://cve.now/CVE-2020-4651.md): IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery which could allow an (CVSS 4.8, IBM Maximo Spatial Asset Management)
- [CVE-2020-4650](https://cve.now/CVE-2020-4650.md): IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which can be read by anothe (CVSS 4.0, IBM Maximo Spatial Asset Management)
- [CVE-2020-27977](https://cve.now/CVE-2020-27977.md): CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry va (no CVSS)
- [CVE-2020-28364](https://cve.now/CVE-2020-28364.md): A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectat (no CVSS, locust)
- [CVE-2020-27982](https://cve.now/CVE-2020-27982.md): IceWarp 11.4.5.0 allows XSS via the language parameter. (no CVSS)
- [CVE-2020-26542](https://cve.now/CVE-2020-26542.md): An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in (no CVSS)
- [CVE-2020-23140](https://cve.now/CVE-2020-23140.md): Microweber 1.1.18 is affected by insufficient session expiration. (no CVSS)
- [CVE-2020-23139](https://cve.now/CVE-2020-23139.md): Microweber 1.1.18 is affected by broken authentication and session management. (no CVSS)
- [CVE-2020-23138](https://cve.now/CVE-2020-23138.md): An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. (no CVSS)
- [CVE-2020-23136](https://cve.now/CVE-2020-23136.md): Microweber v1.1.18 is affected by no session expiry after log-out. (no CVSS, microweber/microweber)
- [CVE-2020-14366](https://cve.now/CVE-2020-14366.md): A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources (CVSS 6.8, Red Hat keycloak · org.keycloak:keycloak-parent)
- [CVE-2020-9299](https://cve.now/CVE-2020-9299.md): There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Pr (no CVSS, Netflix Dispatch)
- [CVE-2020-9300](https://cve.now/CVE-2020-9300.md): The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themsel (no CVSS, Netflix Dispatch)
- [CVE-2020-25655](https://cve.now/CVE-2020-25655.md): An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. (CVSS 5.7, Red Hat open-cluster-management)
- [CVE-2020-8133](https://cve.now/CVE-2020-8133.md): A wrong generation of the passphrase for the encrypted block in Nextcloud Server 19.0.1 allowed an attacker to overwrite blocks in a file. (no CVSS, Nextcloud Server)
- [CVE-2020-8150](https://cve.now/CVE-2020-8150.md): A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted (no CVSS, Nextcloud Server)
- [CVE-2020-8268](https://cve.now/CVE-2020-8268.md): Prototype pollution vulnerability in json8-merge-patch npm package \< 1.0.3 may allow attackers to inject or modify methods and properties of (no CVSS, json8-merge-patch)
- [CVE-2020-8276](https://cve.now/CVE-2020-8276.md): The implementation of Brave Desktop's privacy-preserving analytics system (P3A) between 1.1 and 1.18.35 logged the timestamp of when the use (no CVSS, https://github.com/brave/brave-core)
- [CVE-2020-24353](https://cve.now/CVE-2020-24353.md): Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header. (no CVSS)
- [CVE-2020-15297](https://cve.now/CVE-2020-15297.md): Insufficient validation in the Bitdefender Update Server and BEST Relay components of Bitdefender Endpoint Security Tools versions prior to (CVSS 7.1, Bitdefender Update Server)
- [CVE-2020-28351](https://cve.now/CVE-2020-28351.md): The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site (no CVSS)
- [CVE-2020-28349](https://cve.now/CVE-2020-28349.md): An inaccurate frame deduplication process in ChirpStack Network Server 3.9.0 allows a malicious gateway to perform uplink Denial of Service (no CVSS)
- [CVE-2020-24404](https://cve.now/CVE-2020-24404.md): Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API (CVSS 2.7, Adobe Magento Commerce · magento/community-edition)
- [CVE-2020-24407](https://cve.now/CVE-2020-24407.md): Arbitrary code execution via file import functionality (CVSS 9.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2020-24406](https://cve.now/CVE-2020-24406.md): Document root path disclosure on Maintenance page (CVSS 3.7, Adobe Magento Commerce · magento/community-edition)
- [CVE-2020-24405](https://cve.now/CVE-2020-24405.md): Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data (CVSS 4.3, Adobe Magento Commerce · magento/community-edition)
- [CVE-2020-24403](https://cve.now/CVE-2020-24403.md): Incorrect permissions could lead to unauthorized modification of inventory source data via REST API (CVSS 2.7, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2020-24401](https://cve.now/CVE-2020-24401.md): Incorrect permissions following the deletion of a user role or deactivation of a user (CVSS 6.5, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2020-24402](https://cve.now/CVE-2020-24402.md): Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API (CVSS 4.9, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2020-24400](https://cve.now/CVE-2020-24400.md): SQL injection allows arbitrary read from database (CVSS 7.1, Adobe Magento Commerce · magento/community-edition)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.