# CVEs published 2020-11-13

34 CVEs were published on November 13, 2020: 0 critical, 9 high. Days are UTC.

- [CVE-2020-15481](https://cve.now/CVE-2020-15481.md): An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 Build 1008. (no CVSS)
- [CVE-2020-28638](https://cve.now/CVE-2020-28638.md): ask\_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing affected users' files (no CVSS)
- [CVE-2020-12313](https://cve.now/CVE-2020-12313.md): Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user (no CVSS, Intel(R) PROSet/Wireless WiFi)
- [CVE-2020-12338](https://cve.now/CVE-2020-12338.md): Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable (no CVSS, Open WebRTC Toolkit)
- [CVE-2020-0599](https://cve.now/CVE-2020-0599.md): Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege vi (no CVSS, Intel(R) Processors)
- [CVE-2020-5796](https://cve.now/CVE-2020-5796.md): Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the permissions of file (no CVSS, Nagios XI)
- [CVE-2020-13638](https://cve.now/CVE-2020-13638.md): lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. (no CVSS)
- [CVE-2020-27217](https://cve.now/CVE-2020-27217.md): In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. (no CVSS, The Eclipse Foundation Eclipse Hono · org.eclipse.hono:hono…)
- [CVE-2020-6157](https://cve.now/CVE-2020-6157.md): Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. (no CVSS, Opera Touch for iOS)
- [CVE-2020-7962](https://cve.now/CVE-2020-7962.md): An issue was discovered in One Identity Password Manager 5.8. (no CVSS)
- [CVE-2020-26230](https://cve.now/CVE-2020-26230.md): Deanonymization of COVID-19 positive users of Radar COVID (CVSS 7.4, RadarCOVID radar-covid-backend-dp3t-server)
- [CVE-2020-26223](https://cve.now/CVE-2020-26223.md): Authorization bypass in Spree (CVSS 7.7, spree · spree\_api)
- [CVE-2020-26222](https://cve.now/CVE-2020-26222.md): Remote code execution in dependabot-core (CVSS 8.7, dependabot-core · dependabot-omnibus +1)
- [CVE-2020-25151](https://cve.now/CVE-2020-25151.md): The affected product does not properly validate input, which may allow an attacker to execute a denial-of-service attack on the NIO 50 (all (no CVSS, NIO)
- [CVE-2020-25155](https://cve.now/CVE-2020-25155.md): The affected product transmits unencrypted sensitive information, which may allow an attacker to access this information on the NIO 50 (all (no CVSS, NIO)
- [CVE-2020-25557](https://cve.now/CVE-2020-25557.md): In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. (no CVSS)
- [CVE-2020-25538](https://cve.now/CVE-2020-25538.md): An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in (no CVSS)
- [CVE-2020-8582](https://cve.now/CVE-2020-8582.md): Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticate (no CVSS, NetApp SolidFire & HCI Storage Node)
- [CVE-2020-8583](https://cve.now/CVE-2020-8583.md): Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to (no CVSS, NetApp SolidFire & HCI Storage Node (Element Software) ))
- [CVE-2020-4886](https://cve.now/CVE-2020-4886.md): IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access (CVSS 4.0, IBM InfoSphere Information Server)
- [CVE-2020-25165](https://cve.now/CVE-2020-25165.md): BD Alaris PC Unit, Model 8015, Versions 9.33.1 and earlier and BD Alaris Systems Manager, Versions 4.33 and earlier The affected products ar (no CVSS, BD Alaris PC Unit and BD Alaris Systems Manager)
- [CVE-2020-21667](https://cve.now/CVE-2020-21667.md): In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can b (no CVSS)
- [CVE-2020-6019](https://cve.now/CVE-2020-6019.md): Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConnectionTransportUDPBa (no CVSS, Game Networking Sockets)
- [CVE-2020-1847](https://cve.now/CVE-2020-1847.md): There is a denial of service vulnerability in some Huawei products. (no CVSS, NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…)
- [CVE-2020-9129](https://cve.now/CVE-2020-9129.md): HUAWEI Mate 30 versions earlier than 10.1.0.159(C00E159R7P2) have a vulnerability of improper buffer operation. (no CVSS, HUAWEI Mate)
- [CVE-2020-9127](https://cve.now/CVE-2020-9127.md): Some Huawei products have a command injection vulnerability. (no CVSS, NIP6300;NIP6600;Secospace USG6300;Secospace USG6500;Secospa…)
- [CVE-2020-6149](https://cve.now/CVE-2020-6149.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-6148](https://cve.now/CVE-2020-6148.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-6147](https://cve.now/CVE-2020-6147.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-6156](https://cve.now/CVE-2020-6156.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-6155](https://cve.now/CVE-2020-6155.md): A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-26825](https://cve.now/CVE-2020-26825.md): SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad (CVSS 6.1, SAP SE SAP Fiori Launchpad)
- [CVE-2020-6150](https://cve.now/CVE-2020-6150.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. (CVSS 8.8, Pixar)
- [CVE-2020-7032](https://cve.now/CVE-2020-7032.md): Avaya WebLM Improper Restriction of XML External Entity Reference (CVSS 6.5, Avaya WebLM · Avaya System Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.