# CVEs published 2020-11-17

59 CVEs were published on November 17, 2020: 1 critical, 6 high. Days are UTC.

- [CVE-2020-28183](https://cve.now/CVE-2020-28183.md): SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. (no CVSS)
- [CVE-2020-28092](https://cve.now/CVE-2020-28092.md): PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team& (no CVSS)
- [CVE-2020-28914](https://cve.now/CVE-2020-28914.md): An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. (no CVSS)
- [CVE-2020-26553](https://cve.now/CVE-2020-26553.md): An issue was discovered in Aviatrix Controller before R6.0.2483. (no CVSS)
- [CVE-2020-26552](https://cve.now/CVE-2020-26552.md): An issue was discovered in Aviatrix Controller before R6.0.2483. (no CVSS)
- [CVE-2020-26216](https://cve.now/CVE-2020-26216.md): Cross-Site Scripting in TYPO3 Fluid (CVSS 8.0, TYPO3 Fluid · typo3fluid/fluid)
- [CVE-2020-26551](https://cve.now/CVE-2020-26551.md): An issue was discovered in Aviatrix Controller before R5.3.1151. (no CVSS)
- [CVE-2020-26550](https://cve.now/CVE-2020-26550.md): An issue was discovered in Aviatrix Controller before R5.3.1151. (no CVSS)
- [CVE-2020-26549](https://cve.now/CVE-2020-26549.md): An issue was discovered in Aviatrix Controller before R5.4.1290. (no CVSS)
- [CVE-2020-26548](https://cve.now/CVE-2020-26548.md): An issue was discovered in Aviatrix Controller before R5.4.1290. (no CVSS)
- [CVE-2020-28130](https://cve.now/CVE-2020-28130.md): An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct rem (no CVSS)
- [CVE-2020-28129](https://cve.now/CVE-2020-28129.md): Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaS (no CVSS)
- [CVE-2020-25890](https://cve.now/CVE-2020-25890.md): The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact i (no CVSS)
- [CVE-2020-25988](https://cve.now/CVE-2020-25988.md): UPNP Service listening on port 5555 in Genexis Platinum 4410 Router V2.1 (P4410-V2–1.34H) has an action 'X\_GetAccess' which leaks the creden (no CVSS)
- [CVE-2020-28136](https://cve.now/CVE-2020-28136.md): An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via (no CVSS)
- [CVE-2020-28133](https://cve.now/CVE-2020-28133.md): An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. (no CVSS)
- [CVE-2020-28140](https://cve.now/CVE-2020-28140.md): SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. (no CVSS)
- [CVE-2020-28139](https://cve.now/CVE-2020-28139.md): SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. (no CVSS)
- [CVE-2020-28138](https://cve.now/CVE-2020-28138.md): SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. (no CVSS)
- [CVE-2020-26405](https://cve.now/CVE-2020-26405.md): Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbit (CVSS 7.1, GitLab CE/EE)
- [CVE-2020-13349](https://cve.now/CVE-2020-13349.md): An issue has been discovered in GitLab EE affecting all versions starting from 8.12. (CVSS 4.3, GitLab EE)
- [CVE-2020-13348](https://cve.now/CVE-2020-13348.md): An issue has been discovered in GitLab EE affecting all versions starting from 10.2. (CVSS 5.7, GitLab EE)
- [CVE-2020-25400](https://cve.now/CVE-2020-25400.md): Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data su (no CVSS)
- [CVE-2020-13350](https://cve.now/CVE-2020-13350.md): CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to (CVSS 3.1, GitLab CE/EE)
- [CVE-2020-26701](https://cve.now/CVE-2020-26701.md): Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web sc (no CVSS)
- [CVE-2020-13351](https://cve.now/CVE-2020-13351.md): Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for sche (CVSS 6.5, GitLab CE/EE)
- [CVE-2020-13958](https://cve.now/CVE-2020-13958.md): A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executa (no CVSS, Apache OpenOffice)
- [CVE-2020-21665](https://cve.now/CVE-2020-21665.md): In fastadmin V1.0.0.20191212\_beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injectio (no CVSS)
- [CVE-2020-27553](https://cve.now/CVE-2020-27553.md): In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“. (no CVSS)
- [CVE-2020-27554](https://cve.now/CVE-2020-27554.md): Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensit (no CVSS)
- [CVE-2020-25798](https://cve.now/CVE-2020-25798.md): A stored cross-site scripting (XSS) vulnerability in LimeSurvey before and including 3.21.1 allows authenticated users with correct permissi (no CVSS)
- [CVE-2020-27555](https://cve.now/CVE-2020-27555.md): Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2020-27556](https://cve.now/CVE-2020-27556.md): A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device. (no CVSS)
- [CVE-2020-27557](https://cve.now/CVE-2020-27557.md): Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the vi (no CVSS)
- [CVE-2020-27558](https://cve.now/CVE-2020-27558.md): Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream. (no CVSS)
- [CVE-2020-25746](https://cve.now/CVE-2020-25746.md): QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive informa (no CVSS)
- [CVE-2020-28687](https://cve.now/CVE-2020-28687.md): The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. (no CVSS)
- [CVE-2020-28688](https://cve.now/CVE-2020-28688.md): The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. (no CVSS)
- [CVE-2020-28647](https://cve.now/CVE-2020-28647.md): In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. (no CVSS)
- [CVE-2020-7841](https://cve.now/CVE-2020-7841.md): TOBESOFT XPLATFORM arbitrary hta file execution vulnerability (CVSS 8.8, TOBESOFT XPLATFORM XPlatformLib922.dll)
- [CVE-2020-7774](https://cve.now/CVE-2020-7774.md): Prototype Pollution (CVSS 7.3, y18n)
- [CVE-2020-27130](https://cve.now/CVE-2020-27130.md): Cisco Security Manager Path Traversal Vulnerability (CVSS 9.1, Cisco Security Manager)
- [CVE-2020-27131](https://cve.now/CVE-2020-27131.md): Cisco Security Manager Java Deserialization Vulnerabilities (CVSS 8.1, Cisco Security Manager)
- [CVE-2020-27125](https://cve.now/CVE-2020-27125.md): Cisco Security Manager Static Credential Vulnerability (CVSS 7.4, Cisco Security Manager)
- [CVE-2020-27192](https://cve.now/CVE-2020-27192.md): BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker (no CVSS)
- [CVE-2020-15349](https://cve.now/CVE-2020-15349.md): BinaryNights ForkLift 3.x before 3.4 has a local privilege escalation vulnerability because the privileged helper tool implements an XPC int (no CVSS)
- [CVE-2020-10776](https://cve.now/CVE-2020-10776.md): A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect\_uri parameter. (no CVSS, keycloak · org.keycloak:keycloak-server-spi-private +1)
- [CVE-2020-25833](https://cve.now/CVE-2020-25833.md): Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. (no CVSS, Micro Focus IDOL)
- [CVE-2020-25705](https://cve.now/CVE-2020-25705.md): A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. (no CVSS, Siemens Lunux Based Products)
- [CVE-2020-25832](https://cve.now/CVE-2020-25832.md): Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. (no CVSS, Micro Focus Filr)
- [CVE-2020-11851](https://cve.now/CVE-2020-11851.md): Arbitrary code execution vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. (no CVSS, Micro Focus ArcSight Logger)
- [CVE-2020-11860](https://cve.now/CVE-2020-11860.md): Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. (no CVSS, Micro Focus ArcSight Logger)
- [CVE-2020-25834](https://cve.now/CVE-2020-25834.md): Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. (no CVSS, Micro Focus ArcSight Logger)
- [CVE-2020-13354](https://cve.now/CVE-2020-13354.md): A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. (CVSS 4.3, GitLab CE/EE)
- [CVE-2020-13352](https://cve.now/CVE-2020-13352.md): Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. (CVSS 3.7, GitLab CE/EE)
- [CVE-2020-13353](https://cve.now/CVE-2020-13353.md): When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. (CVSS 2.5, GitLab Gitaly · gitaly)
- [CVE-2020-13358](https://cve.now/CVE-2020-13358.md): A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. (CVSS 4.7, Gitlab CE/EE)
- [CVE-2020-26406](https://cve.now/CVE-2020-26406.md): Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. (CVSS 5.3, GitLab EE)
- [CVE-2020-14389](https://cve.now/CVE-2020-14389.md): It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account (no CVSS, keycloak · org.keycloak:keycloak-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.