CVEs published November 18, 2020
62 CVEs were published on November 18, 2020: 3 critical, 7 high.
- Published
- 62
- Critical
- 3
- High
- 7
- Medium
- 19
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Cisco IoT Field Network Director
- 10
- Trend Micro InterScan Web Security Virtual Appliance
- 4
- Cisco WebEx Meetings Server
- 3
- GitLab CE/EE
- 3
- Trend Micro Security
- 3
- Web Server on Modicon M340, Modicon Quantum and Modicon Pre…
- 3
- Cisco DNA Spaces Connector
- 1
- Cisco TelePresence Endpoint Software
- 1
- Cisco TelePresence Video Communication Server (VCS) Express…
- 1
- Cisco Unified Computing System
- 1
Critical 3
- CVE-2020-3586Cisco DNA Spaces Connector Command Injection VulnerabilityCisco DNA Spaces Connector
- CVE-2020-3531Cisco IoT Field Network Director Unauthenticated REST API VulnerabilityCisco IoT Field Network Director
- CVE-2020-3470Cisco Integrated Management Controller Multiple Remote Code Execution VulnerabilitiesCisco Unified Computing System
High 7
- CVE-2020-13359The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainGitLab CE/EE
- CVE-2020-13356An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9.GitLab CE/EE
- CVE-2020-13355An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14.GitLab CE/EE
- CVE-2020-26226Secret disclosure in semantic-releasesemantic-release
- CVE-2020-3392Cisco IoT Field Network Director Missing API Authentication VulnerabilityCisco IoT Field Network Director
- CVE-2020-26072Cisco IoT Field Network Director SOAP API Authorization Bypass VulnerabilityCisco IoT Field Network Director
- CVE-2020-26933Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Acc
Medium, low and unrated 52
- CVE-2019-12412A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash.libapreq2
- CVE-2020-12593Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerabilitSymantec Endpoint Detection & Response
- CVE-2020-22723A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers
- CVE-2020-26215Open redirect in Jupyter Notebookjupyter notebook · notebook
- CVE-2020-13799Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standa
- CVE-2020-14208SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality.
- CVE-2020-15300SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
- CVE-2020-15301SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules.
- CVE-2020-25454Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe.
- CVE-2020-28581A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-28579A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-28580A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticateTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-28574A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allowTrend Micro Worry-Free Business Security
- CVE-2020-28578A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a spTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-27697Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL inTrend Micro Security
- CVE-2020-28572A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additionTrend Micro Apex One
- CVE-2020-27695Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL inTrend Micro Security
- CVE-2020-27696Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific WindowsTrend Micro Security
- CVE-2020-26097The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet.
- CVE-2020-3482Cisco Expressway Software Unauthorized Access Information Disclosure VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2020-3471Cisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure VulnerabilityCisco WebEx Meetings Server
- CVE-2020-3441Cisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure VulnerabilityCisco WebEx Meetings Server
- CVE-2020-3419Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join VulnerabilityCisco WebEx Meetings Server
- CVE-2020-3367Cisco Secure Web Appliance Privilege Escalation VulnerabilityCisco Web Security Appliance
- CVE-2020-27126Cisco Webex Meetings API Cross-Site Scripting VulnerabilityCisco Webex Meetings
- CVE-2020-26081Cisco IoT Field Network Director Cross-Site Scripting VulnerabilitiesCisco IoT Field Network Director
- CVE-2020-26080Cisco IoT Field Network Director Improper Domain Access Control VulnerabilityCisco IoT Field Network Director
- CVE-2020-26079Cisco IoT Field Network Director Unprotected Storage of Credentials VulnerabilityCisco IoT Field Network Director
- CVE-2020-26078Cisco IoT Field Network Director File Overwrite VulnerabilityCisco IoT Field Network Director
- CVE-2020-26077Cisco IoT Field Network Director Improper Access Control VulnerabilityCisco IoT Field Network Director
- CVE-2020-26076Cisco IoT Field Network Director Information Disclosure VulnerabilityCisco IoT Field Network Director
- CVE-2020-26075Cisco IoT Field Network REST API Insufficient Input Validation VulnerabilityCisco IoT Field Network Director
- CVE-2020-26068Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation VulnerabilityCisco TelePresence Endpoint Software
- CVE-2020-4592IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to aIBM MQ Appliance
- CVE-2020-26554REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
- CVE-2020-28091cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
- CVE-2020-28362Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.stdlib
- CVE-2020-25406app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files.
- CVE-2020-24297httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending cra
- CVE-2020-28005httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing
- CVE-2020-26884RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability.
- CVE-2020-28724Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.werkzeug
- CVE-2020-6016Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveGame Networking Sockets
- CVE-2020-7562A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and Web Server on Modicon M340, Modicon Quantum and Modicon Pre…
- CVE-2020-7564A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, MoWeb Server on Modicon M340, Modicon Quantum and Modicon Pre…
- CVE-2020-7563A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers andWeb Server on Modicon M340, Modicon Quantum and Modicon Pre…
- CVE-2020-28361Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a head
- CVE-2020-24723Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Manage
- CVE-2020-28917An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3.
- CVE-2020-28915A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read k
- CVE-2020-28366Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoGo toolchain cmd/go · Go toolchain cmd/cgo +1
- CVE-2020-28367Arbitrary code execution via the go command with cgo in cmd/goGo toolchain cmd/go · toolchain