CVEs published November 10, 2020
58 CVEs were published on November 10, 2020: 7 critical, 4 high. 1 is now in CISA KEV.
- Published
- 58
- Critical
- 7
- High
- 4
- Medium
- 14
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- Android
- 19
- SAP SE SAP Solution Manager
- 4
- SAP SE SAP Commerce Cloud
- 3
- IBM Content Navigator
- 2
- SAP SE SAP NetWeaver AS ABAP
- 2
- @strikeentco/set
- 1
- Apache Airflow · apache-airflow
- 1
- Dell CPG BIOS
- 1
- Gnome GDM3
- 1
- IBM Security Key Lifecycle Manager
- 1
Critical 7
- CVE-2020-26823SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatSAP SE SAP Solution Manager
- CVE-2020-26821SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatSAP SE SAP Solution Manager
- CVE-2020-26824SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatSAP SE SAP Solution Manager
- CVE-2020-26822SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorizatSAP SE SAP Solution Manager
- CVE-2020-26820SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the adminSAP SE SAP NetWeaver AS JAVA
- CVE-2020-26808SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS)SAP SE SAP AS ABAP · SAP SE SAP S4 HANA
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riApache Airflow · apache-airflow
High 4
- CVE-2020-26810SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted reqSAP SE SAP Commerce Cloud
- CVE-2020-26815SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request tSAP SE SAP Fiori Launchpad
- CVE-2020-7766Prototype Pollutionjson-ptr
- CVE-2020-16125gdm3 would start gnome-initial-setup if it cannot contact accountserviceGnome GDM3
Medium, low and unrated 47
- CVE-2020-25268Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.
- CVE-2020-25267An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.
- CVE-2020-24367Incorrect file permissions in BlueStacks 4 through 4.230 on Windows allow a local attacker to escalate privileges by modifying a file that i
- CVE-2020-28408The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.
- CVE-2020-28409The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc.
- CVE-2020-24063The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
- CVE-2019-7357Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/.intelliants/subrion
- CVE-2020-23968Ilex International Sign&go Workstation Security Suite 7.1 allows elevation of privileges via a symlink attack on ProgramData\Ilex\S&G\Logs\0
- CVE-2020-28368Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-chann
- CVE-2020-28055A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group C
- CVE-2020-27146TIBCO iProcess Workspace Browser CSRFTIBCO Software TIBCO iProcess Workspace
- CVE-2020-27403A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group C
- CVE-2020-25074The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request.moin
- CVE-2020-26807SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder whSAP SE SAP ERP Client for E-Bilanz
- CVE-2020-26818SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web DynprSAP SE SAP NetWeaver AS ABAP
- CVE-2020-26817SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2020-26814SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditiSAP SE SAP Process Integration
- CVE-2020-26819SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web DynprSAP SE SAP NetWeaver AS ABAP
- CVE-2020-26811SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted reqSAP SE SAP Commerce Cloud
- CVE-2020-6316SAP ERP and SAP S/4 HANA allows an authenticated user to see cost records to objects to which he has no authorization in PS reporting, leadiSAP SE SAP ERP · SAP SE SAP S/4 HANA
- CVE-2020-26809SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/mediSAP SE SAP Commerce Cloud
- CVE-2020-28267Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote co@strikeentco/set
- CVE-2020-12485The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the bouvivo The frame touch module
- CVE-2020-4760IBM Content Navigator 3.0CD is vulnerable to cross-site scripting.IBM Content Navigator
- CVE-2020-4704IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting.IBM Content Navigator
- CVE-2020-4568IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user.IBM Security Key Lifecycle Manager
- CVE-2020-5388Dell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication buffer verification vulnerability.Dell CPG BIOS
- CVE-2020-24384A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability
- CVE-2020-0446There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264528Android
- CVE-2020-0445There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264527Android
- CVE-2020-0447There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168251617Android
- CVE-2020-0437In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check.Android
- CVE-2020-0449In btm_sec_disconnected of btm_sec.cc, there is a possible memory corruption due to a use after free.Android
- CVE-2020-0438In the AIBinder_Class constructor of ibinder.cpp, there is a possible arbitrary code execution due to uninitialized data.Android
- CVE-2020-0454In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-0424In send_vc of res_send.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2020-0453In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0452In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0451In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-0441In Message and toBundle of Notification.java, there is a possible resource exhaustion due to improper input validation.Android
- CVE-2020-0450In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data.Android
- CVE-2020-0409In create of FileMap.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0448In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permissioAndroid
- CVE-2020-0418In getPermissionInfosForGroup of Utils.java, there is a logic error.Android
- CVE-2020-0443In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception.Android
- CVE-2020-0442In Message and toBundle of Notification.java, there is a possible UI slowdown or crash due to improper input validation.Android
- CVE-2020-0439In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permission check.Android