CVEs published November 16, 2020
77 CVEs were published on November 16, 2020: 0 critical, 7 high.
- Published
- 77
- Critical
- 0
- High
- 7
- Medium
- 15
- Low
- 0
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- IBM Sterling B2B Integrator
- 7
- IBM Sterling File Gateway
- 4
- Neuroinformatics Unit, Integrative Computational Brain Scie…
- 4
- Citrix SD-WAN Center
- 3
- Citrix Virtual Apps and Desktops
- 2
- Nextcloud Server
- 2
- postgresql
- 2
- QNAP Systems QTS
- 2
- @firebase/util
- 1
- Amazon AWS SDK · com.amazonaws:aws-encryption-sdk-java +1
- 1
High 7
- CVE-2020-26225Reflected XSS in PrestaShop Product CommentsPrestaShop productcomments · prestashop/productcomments
- CVE-2020-26224Improper Access Control in PrestaShopPrestaShop
- CVE-2020-26217Remote Code Execution in XStreamx-stream xstream · activemq +1
- CVE-2020-4700IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user belongingIBM Sterling B2B Integrator
- CVE-2020-28649The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.
- CVE-2020-2490If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands.QNAP Systems QTS
- CVE-2020-2492If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands.QNAP Systems QTS
Medium, low and unrated 70
- CVE-2020-27483Garmin Forerunner 235 before 8.20 is affected by: Array index error.
- CVE-2020-27484Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow.
- CVE-2020-27485Garmin Forerunner 235 before 8.20 is affected by: Array index error.
- CVE-2020-27486Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow.
- CVE-2020-28693An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by
- CVE-2020-26510Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war
- CVE-2020-26509Airleader Master and Easy <= 6.21 devices have default credentials that can be used for a denial of service.
- CVE-2020-26508The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export featur
- CVE-2020-28692In Gila CMS 1.16.0, an attacker can upload a shell to tmp directy and abuse .htaccess through the logs function for executing PHP files.
- CVE-2020-23489The import.json.php file before 8.9 for Avideo is vulnerable to a File Deletion vulnerability.wwbn/avideo
- CVE-2020-23490There was a local file disclosure vulnerability in AVideo < 8.9 via the proxy streaming.
- CVE-2020-27991Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).
- CVE-2020-27990Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).
- CVE-2020-27989Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).
- CVE-2020-27988Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).
- CVE-2020-28723Memory leak in IPv6Param::setAddress in CloudAvid PParam 1.3.1.
- CVE-2020-4763IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or sIBM Sterling File Gateway
- CVE-2020-4705IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2020-4692IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 could allow an authenticated user to obtainIBM Sterling B2B Integrator
- CVE-2020-4672IBM Business Automation Workflow 20.0.0.1 is vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2020-4671IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information inIBM Sterling B2B Integrator
- CVE-2020-4665IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 does not set the secure attribute on authorization tokens or sIBM Sterling File Gateway
- CVE-2020-4655IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection.IBM Sterling B2B Integrator
- CVE-2020-4647IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 is vulnerable to SQL injection.IBM Sterling File Gateway
- CVE-2020-4566IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 stores potentially highly sensitive informaIBM Sterling B2B Integrator
- CVE-2020-4476IBM Sterling File Gateway 2.2.0.0 through 2.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain sensitive information IBM Sterling File Gateway
- CVE-2020-4475IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.2 could allow a remote attacker to obtain senIBM Sterling B2B Integrator
- CVE-2020-27422In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the s
- CVE-2020-27423Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on
- CVE-2020-25952SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers
- CVE-2020-13773Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDM
- CVE-2020-13769LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.
- CVE-2020-13772In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating
- CVE-2020-27191LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable,
- CVE-2020-27623JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.
- CVE-2020-27622In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.
- CVE-2020-26129In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
- CVE-2020-27627JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
- CVE-2020-27628In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
- CVE-2020-27629In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artif
- CVE-2020-25207JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.
- CVE-2020-25013JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler.
- CVE-2020-27624JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
- CVE-2020-27625In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
- CVE-2020-27626JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
- CVE-2020-25209In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.
- CVE-2020-24366Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.
- CVE-2020-27459Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post.
- CVE-2020-25210In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.
- CVE-2020-7773Cross-site Scripting (XSS)markdown-it-highlightjs
- CVE-2020-7765Prototype Pollution@firebase/util
- CVE-2020-8897Robustness weakness in AWS KMS and Encryption SDKsAmazon AWS SDK · com.amazonaws:aws-encryption-sdk-java +1
- CVE-2020-5663Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via uNeuroinformatics Unit, Integrative Computational Brain Scie…
- CVE-2020-5664Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecifieNeuroinformatics Unit, Integrative Computational Brain Scie…
- CVE-2020-5659SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspNeuroinformatics Unit, Integrative Computational Brain Scie…
- CVE-2020-5662Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script viNeuroinformatics Unit, Integrative Computational Brain Scie…
- CVE-2020-28656The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to
- CVE-2020-28650The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protect
- CVE-2020-28648Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
- CVE-2020-28642In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote atta
- CVE-2020-5666Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/Mitsubishi Electric MELSEC iQ-R Series CPU Modules
- CVE-2020-25695A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.postgresql
- CVE-2020-25694A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24.postgresql
- CVE-2020-8259Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.Nextcloud Server
- CVE-2020-8152Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decryNextcloud Server
- CVE-2020-8270An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 Citrix Virtual Apps and Desktops
- CVE-2020-8269An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixCitrix Virtual Apps and Desktops
- CVE-2020-8273Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.Citrix SD-WAN Center
- CVE-2020-8272Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8Citrix SD-WAN Center
- CVE-2020-8271Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8Citrix SD-WAN Center