CVEs published November 17, 2020
59 CVEs were published on November 17, 2020: 1 critical, 6 high.
- Published
- 59
- Critical
- 1
- High
- 6
- Medium
- 6
- Low
- 3
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- GitLab CE/EE
- 5
- Cisco Security Manager
- 3
- GitLab EE
- 3
- Micro Focus ArcSight Logger
- 3
- Apache OpenOffice
- 1
- Gitlab CE/EE
- 1
- GitLab Gitaly · gitaly
- 1
- keycloak · org.keycloak:keycloak-core
- 1
- keycloak · org.keycloak:keycloak-server-spi-private +1
- 1
- Micro Focus Filr
- 1
Critical 1
High 6
- CVE-2020-26216Cross-Site Scripting in TYPO3 FluidTYPO3 Fluid · typo3fluid/fluid
- CVE-2020-26405Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitGitLab CE/EE
- CVE-2020-7841TOBESOFT XPLATFORM arbitrary hta file execution vulnerabilityTOBESOFT XPLATFORM XPlatformLib922.dll
- CVE-2020-7774Prototype Pollutiony18n
- CVE-2020-27131Cisco Security Manager Java Deserialization VulnerabilitiesCisco Security Manager
- CVE-2020-27125Cisco Security Manager Static Credential VulnerabilityCisco Security Manager
Medium, low and unrated 52
- CVE-2020-28183SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
- CVE-2020-28092PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team&
- CVE-2020-28914An improper file permissions vulnerability affects Kata Containers prior to 1.11.5.
- CVE-2020-26553An issue was discovered in Aviatrix Controller before R6.0.2483.
- CVE-2020-26552An issue was discovered in Aviatrix Controller before R6.0.2483.
- CVE-2020-26551An issue was discovered in Aviatrix Controller before R5.3.1151.
- CVE-2020-26550An issue was discovered in Aviatrix Controller before R5.3.1151.
- CVE-2020-26549An issue was discovered in Aviatrix Controller before R5.4.1290.
- CVE-2020-26548An issue was discovered in Aviatrix Controller before R5.4.1290.
- CVE-2020-28130An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct rem
- CVE-2020-28129Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaS
- CVE-2020-25890The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact i
- CVE-2020-25988UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X_GetAccess' which leaks the creden
- CVE-2020-28136An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via
- CVE-2020-28133An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0.
- CVE-2020-28140SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php.
- CVE-2020-28139SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php.
- CVE-2020-28138SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php.
- CVE-2020-13349An issue has been discovered in GitLab EE affecting all versions starting from 8.12.GitLab EE
- CVE-2020-13348An issue has been discovered in GitLab EE affecting all versions starting from 10.2.GitLab EE
- CVE-2020-25400Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data su
- CVE-2020-13350CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators toGitLab CE/EE
- CVE-2020-26701Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web sc
- CVE-2020-13351Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheGitLab CE/EE
- CVE-2020-13958A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executaApache OpenOffice
- CVE-2020-21665In fastadmin V1.0.0.20191212_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injectio
- CVE-2020-27553In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“.
- CVE-2020-27554Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensit
- CVE-2020-25798A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissi
- CVE-2020-27555Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrar
- CVE-2020-27556A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device.
- CVE-2020-27557Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the vi
- CVE-2020-27558Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream.
- CVE-2020-25746QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive informa
- CVE-2020-28687The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.
- CVE-2020-28688The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.
- CVE-2020-28647In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application.
- CVE-2020-27192BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker
- CVE-2020-15349BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC int
- CVE-2020-10776A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter.keycloak · org.keycloak:keycloak-server-spi-private +1
- CVE-2020-25833Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7.Micro Focus IDOL
- CVE-2020-25705A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports.Siemens Lunux Based Products
- CVE-2020-25832Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1.Micro Focus Filr
- CVE-2020-11851Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.Micro Focus ArcSight Logger
- CVE-2020-11860Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1.Micro Focus ArcSight Logger
- CVE-2020-25834Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1.Micro Focus ArcSight Logger
- CVE-2020-13354A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6.GitLab CE/EE
- CVE-2020-13352Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group.GitLab CE/EE
- CVE-2020-13353When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.GitLab Gitaly · gitaly
- CVE-2020-13358A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects.Gitlab CE/EE
- CVE-2020-26406Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3.GitLab EE
- CVE-2020-14389It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account keycloak · org.keycloak:keycloak-core