CVEs published November 13, 2020
34 CVEs were published on November 13, 2020: 0 critical, 9 high.
- Published
- 34
- Critical
- 0
- High
- 9
- Medium
- 3
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Pixar
- 6
- NIO
- 2
- NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- 2
- Avaya WebLM · Avaya System Manager
- 1
- BD Alaris PC Unit and BD Alaris Systems Manager
- 1
- dependabot-core · dependabot-omnibus +1
- 1
- Game Networking Sockets
- 1
- HUAWEI Mate
- 1
- IBM InfoSphere Information Server
- 1
- Intel(R) Processors
- 1
High 9
- CVE-2020-26230Deanonymization of COVID-19 positive users of Radar COVIDRadarCOVID radar-covid-backend-dp3t-server
- CVE-2020-26223Authorization bypass in Spreespree · spree_api
- CVE-2020-26222Remote code execution in dependabot-coredependabot-core · dependabot-omnibus +1
- CVE-2020-6149A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6148A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6147A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6156A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-6155A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files.Pixar
- CVE-2020-6150A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow.Pixar
Medium, low and unrated 25
- CVE-2020-15481An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008.
- CVE-2020-28638ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files
- CVE-2020-12313Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user Intel(R) PROSet/Wireless WiFi
- CVE-2020-12338Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enableOpen WebRTC Toolkit
- CVE-2020-0599Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege viIntel(R) Processors
- CVE-2020-5796Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of fileNagios XI
- CVE-2020-13638lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.
- CVE-2020-27217In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices.The Eclipse Foundation Eclipse Hono · org.eclipse.hono:hono…
- CVE-2020-6157Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack.Opera Touch for iOS
- CVE-2020-7962An issue was discovered in One Identity Password Manager 5.8.
- CVE-2020-25151The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50 (all NIO
- CVE-2020-25155The affected product transmits unencrypted sensitive information, which may allow an attacker to access this information on the NIO 50 (all NIO
- CVE-2020-25557In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password.
- CVE-2020-25538An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in
- CVE-2020-8582Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticateNetApp SolidFire & HCI Storage Node
- CVE-2020-8583Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to NetApp SolidFire & HCI Storage Node (Element Software) )
- CVE-2020-4886IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has accessIBM InfoSphere Information Server
- CVE-2020-25165BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products arBD Alaris PC Unit and BD Alaris Systems Manager
- CVE-2020-21667In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can b
- CVE-2020-6019Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBaGame Networking Sockets
- CVE-2020-1847There is a denial of service vulnerability in some Huawei products.NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- CVE-2020-9129HUAWEI Mate 30 versions earlier than 10.1.0.159(C00E159R7P2) have a vulnerability of improper buffer operation.HUAWEI Mate
- CVE-2020-9127Some Huawei products have a command injection vulnerability.NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…
- CVE-2020-26825SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad SAP SE SAP Fiori Launchpad
- CVE-2020-7032Avaya WebLM Improper Restriction of XML External Entity ReferenceAvaya WebLM · Avaya System Manager