# CVEs published 2020-11-18

62 CVEs were published on November 18, 2020: 3 critical, 7 high. Days are UTC.

- [CVE-2020-13359](https://cve.now/CVE-2020-13359.md): The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintain (CVSS 7.6, GitLab CE/EE)
- [CVE-2020-13356](https://cve.now/CVE-2020-13356.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. (CVSS 8.2, GitLab CE/EE)
- [CVE-2020-13355](https://cve.now/CVE-2020-13355.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. (CVSS 7.5, GitLab CE/EE)
- [CVE-2019-12412](https://cve.now/CVE-2019-12412.md): A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. (no CVSS, libapreq2)
- [CVE-2020-12593](https://cve.now/CVE-2020-12593.md): Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerabilit (no CVSS, Symantec Endpoint Detection & Response)
- [CVE-2020-26226](https://cve.now/CVE-2020-26226.md): Secret disclosure in semantic-release (CVSS 8.1, semantic-release)
- [CVE-2020-22723](https://cve.now/CVE-2020-22723.md): A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers (no CVSS)
- [CVE-2020-26215](https://cve.now/CVE-2020-26215.md): Open redirect in Jupyter Notebook (CVSS 4.4, jupyter notebook · notebook)
- [CVE-2020-13799](https://cve.now/CVE-2020-13799.md): Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specified in multiple standa (no CVSS)
- [CVE-2020-14208](https://cve.now/CVE-2020-14208.md): SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. (no CVSS)
- [CVE-2020-15300](https://cve.now/CVE-2020-15300.md): SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. (no CVSS)
- [CVE-2020-15301](https://cve.now/CVE-2020-15301.md): SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. (no CVSS)
- [CVE-2020-25454](https://cve.now/CVE-2020-25454.md): Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the recipe. (no CVSS)
- [CVE-2020-28581](https://cve.now/CVE-2020-28581.md): A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authentic (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-28579](https://cve.now/CVE-2020-28579.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a spec (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-28580](https://cve.now/CVE-2020-28580.md): A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticate (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-28574](https://cve.now/CVE-2020-28574.md): A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow (no CVSS, Trend Micro Worry-Free Business Security)
- [CVE-2020-28578](https://cve.now/CVE-2020-28578.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a sp (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-27697](https://cve.now/CVE-2020-27697.md): Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in (no CVSS, Trend Micro Security)
- [CVE-2020-28572](https://cve.now/CVE-2020-28572.md): A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with addition (no CVSS, Trend Micro Apex One)
- [CVE-2020-27695](https://cve.now/CVE-2020-27695.md): Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in (no CVSS, Trend Micro Security)
- [CVE-2020-27696](https://cve.now/CVE-2020-27696.md): Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows (no CVSS, Trend Micro Security)
- [CVE-2020-26097](https://cve.now/CVE-2020-26097.md): The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. (no CVSS)
- [CVE-2020-3586](https://cve.now/CVE-2020-3586.md): Cisco DNA Spaces Connector Command Injection Vulnerability (CVSS 9.4, Cisco DNA Spaces Connector)
- [CVE-2020-3531](https://cve.now/CVE-2020-3531.md): Cisco IoT Field Network Director Unauthenticated REST API Vulnerability (CVSS 9.8, Cisco IoT Field Network Director)
- [CVE-2020-3482](https://cve.now/CVE-2020-3482.md): Cisco Expressway Software Unauthorized Access Information Disclosure Vulnerability (CVSS 6.5, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2020-3471](https://cve.now/CVE-2020-3471.md): Cisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure Vulnerability (CVSS 6.5, Cisco WebEx Meetings Server)
- [CVE-2020-3470](https://cve.now/CVE-2020-3470.md): Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities (CVSS 9.8, Cisco Unified Computing System)
- [CVE-2020-3441](https://cve.now/CVE-2020-3441.md): Cisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure Vulnerability (CVSS 5.3, Cisco WebEx Meetings Server)
- [CVE-2020-3419](https://cve.now/CVE-2020-3419.md): Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join Vulnerability (CVSS 6.5, Cisco WebEx Meetings Server)
- [CVE-2020-3392](https://cve.now/CVE-2020-3392.md): Cisco IoT Field Network Director Missing API Authentication Vulnerability (CVSS 7.5, Cisco IoT Field Network Director)
- [CVE-2020-3367](https://cve.now/CVE-2020-3367.md): Cisco Secure Web Appliance Privilege Escalation Vulnerability (CVSS 5.3, Cisco Web Security Appliance)
- [CVE-2020-27126](https://cve.now/CVE-2020-27126.md): Cisco Webex Meetings API Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Webex Meetings)
- [CVE-2020-26081](https://cve.now/CVE-2020-26081.md): Cisco IoT Field Network Director Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco IoT Field Network Director)
- [CVE-2020-26080](https://cve.now/CVE-2020-26080.md): Cisco IoT Field Network Director Improper Domain Access Control Vulnerability (CVSS 4.1, Cisco IoT Field Network Director)
- [CVE-2020-26079](https://cve.now/CVE-2020-26079.md): Cisco IoT Field Network Director Unprotected Storage of Credentials Vulnerability (CVSS 4.1, Cisco IoT Field Network Director)
- [CVE-2020-26078](https://cve.now/CVE-2020-26078.md): Cisco IoT Field Network Director File Overwrite Vulnerability (CVSS 4.9, Cisco IoT Field Network Director)
- [CVE-2020-26077](https://cve.now/CVE-2020-26077.md): Cisco IoT Field Network Director Improper Access Control Vulnerability (CVSS 5.0, Cisco IoT Field Network Director)
- [CVE-2020-26076](https://cve.now/CVE-2020-26076.md): Cisco IoT Field Network Director Information Disclosure Vulnerability (CVSS 5.3, Cisco IoT Field Network Director)
- [CVE-2020-26075](https://cve.now/CVE-2020-26075.md): Cisco IoT Field Network REST API Insufficient Input Validation Vulnerability (CVSS 6.3, Cisco IoT Field Network Director)
- [CVE-2020-26072](https://cve.now/CVE-2020-26072.md): Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability (CVSS 8.7, Cisco IoT Field Network Director)
- [CVE-2020-26068](https://cve.now/CVE-2020-26068.md): Cisco Telepresence CE Software and RoomOS Software Unauthorized Token Generation Vulnerability (CVSS 5.5, Cisco TelePresence Endpoint Software)
- [CVE-2020-4592](https://cve.now/CVE-2020-4592.md): IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to a (CVSS 5.3, IBM MQ Appliance)
- [CVE-2020-26554](https://cve.now/CVE-2020-26554.md): REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. (no CVSS)
- [CVE-2020-26933](https://cve.now/CVE-2020-26933.md): Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Acc (CVSS 7.2)
- [CVE-2020-28091](https://cve.now/CVE-2020-28091.md): cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php. (no CVSS)
- [CVE-2020-28362](https://cve.now/CVE-2020-28362.md): Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. (no CVSS, stdlib)
- [CVE-2020-25406](https://cve.now/CVE-2020-25406.md): app\\admin\\controller\\sys\\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files. (no CVSS)
- [CVE-2020-24297](https://cve.now/CVE-2020-24297.md): httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending cra (no CVSS)
- [CVE-2020-28005](https://cve.now/CVE-2020-28005.md): httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing (no CVSS)
- [CVE-2020-26884](https://cve.now/CVE-2020-26884.md): RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. (no CVSS)
- [CVE-2020-28724](https://cve.now/CVE-2020-28724.md): Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. (no CVSS, werkzeug)
- [CVE-2020-6016](https://cve.now/CVE-2020-6016.md): Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP\_Receive (no CVSS, Game Networking Sockets)
- [CVE-2020-7562](https://cve.now/CVE-2020-7562.md): A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and (CVSS 6.3, Web Server on Modicon M340, Modicon Quantum and Modicon Pre…)
- [CVE-2020-7564](https://cve.now/CVE-2020-7564.md): A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Mo (CVSS 6.3, Web Server on Modicon M340, Modicon Quantum and Modicon Pre…)
- [CVE-2020-7563](https://cve.now/CVE-2020-7563.md): A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and (CVSS 6.3, Web Server on Modicon M340, Modicon Quantum and Modicon Pre…)
- [CVE-2020-28361](https://cve.now/CVE-2020-28361.md): Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a head (no CVSS)
- [CVE-2020-24723](https://cve.now/CVE-2020-24723.md): Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Manage (no CVSS)
- [CVE-2020-28917](https://cve.now/CVE-2020-28917.md): An issue was discovered in the view\_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. (no CVSS)
- [CVE-2020-28915](https://cve.now/CVE-2020-28915.md): A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read k (no CVSS)
- [CVE-2020-28366](https://cve.now/CVE-2020-28366.md): Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo (no CVSS, Go toolchain cmd/go · Go toolchain cmd/cgo +1)
- [CVE-2020-28367](https://cve.now/CVE-2020-28367.md): Arbitrary code execution via the go command with cgo in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.