CVEs published November 19, 2020
62 CVEs were published on November 19, 2020: 1 critical, 8 high. 1 is now in CISA KEV.
- Published
- 62
- Critical
- 1
- High
- 8
- Medium
- 5
- Low
- 1
- Unrated
- 47
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- IGSS Definition (Def.exe)
- 9
- moodle · moodle/moodle
- 6
- EcoStruxure Building Operation WebReports V1.9 -
- 5
- PLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- 5
- Modicon M221, all references, all versions
- 4
- Nextcloud Social
- 2
- Beckhoff TwinCat XAR
- 1
- BIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-I…
- 1
- Canonical PulseAudio
- 1
- com.coloros.codebook
- 1
Critical 1
High 8
- CVE-2020-28209A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and EnEcoStruxure Building Operation Enterprise Server installer…
- CVE-2020-7567A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attModicon M221, all references, all versions
- CVE-2020-7566A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker toModicon M221, all references, all versions
- CVE-2020-7565A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker Modicon M221, all references, all versions
- CVE-2020-28949Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as fildrupal/core · pear/archive_tar
- CVE-2020-12510Beckhoff: Privilege Escalation through TwinCat SystemBeckhoff TwinCat XAR
- CVE-2020-9049victor Web Client and C•CURE Web Client JSON Web Token (JWT) VulnerabilityJohnson Controls victor Web Client · Johnson Controls C•CUR…
- CVE-2020-4701IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by impropeIBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 53
- CVE-2020-28953In BigBlueButton before 2.2.29, a user can vote more than once in a single poll.
- CVE-2020-28954web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting contr
- CVE-2020-7568A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) thModicon M221, all references, all versions
- CVE-2020-7558A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution IGSS Definition (Def.exe)
- CVE-2020-7557A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution wIGSS Definition (Def.exe)
- CVE-2020-7556A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution IGSS Definition (Def.exe)
- CVE-2020-7555A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution IGSS Definition (Def.exe)
- CVE-2020-7554A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version IGSS Definition (Def.exe)
- CVE-2020-7553A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution IGSS Definition (Def.exe)
- CVE-2020-7552A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code ExecutioIGSS Definition (Def.exe)
- CVE-2020-7551A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code ExecutioIGSS Definition (Def.exe)
- CVE-2020-7550A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version IGSS Definition (Def.exe)
- CVE-2020-7544A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause prEcoStruxureª Operator Terminal Expert runtime
- CVE-2020-7559A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª ContPLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- CVE-2020-7538A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now UnPLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- CVE-2020-28213A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (alPLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- CVE-2020-28212A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (nPLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- CVE-2020-28211A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that PLC Simulator on EcoStruxureª Control Expert (now Unity Pro)
- CVE-2020-7573A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote atEcoStruxure Building Operation WebReports V1.9 -
- CVE-2020-7572A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.EcoStruxure Building Operation WebReports V1.9 -
- CVE-2020-7571A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStEcoStruxure Building Operation WebReports V1.9 -
- CVE-2020-7570A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure BuildEcoStruxure Building Operation WebReports V1.9 -
- CVE-2020-7569A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 thatEcoStruxure Building Operation WebReports V1.9 -
- CVE-2020-28210A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building OpeEcoStruxure Building Operation WebStation V2.0 -
- CVE-2020-25989Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20.
- CVE-2020-28350A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter.
- CVE-2020-28924An issue was discovered in Rclone before 1.53.3.github.com/rclone/rclone
- CVE-2020-28951libuci in OpenWrt before 18.06.9 and 19.x before 19.07.5 may encounter a use after free when using malicious package names.
- CVE-2020-28948Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.pear/archive_tar · drupal/core
- CVE-2020-22394In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.
- CVE-2020-28947In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
- CVE-2020-12496ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actorEndress+Hauser RSG35 - Ecograph T · Endress+Hauser ORSG3… +2
- CVE-2020-28942An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol.
- CVE-2020-6879Some ZTE devices have input verification vulnerabilities.ZXHN Z500 · ZXHN F670L
- CVE-2020-25700In moodle, some database module web services allowed students to add entries within groups they did not belong to.moodle · moodle/moodle
- CVE-2020-25702In Moodle, it was possible to include JavaScript when re-naming content bank items.moodle · moodle/moodle
- CVE-2020-25703The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden.moodle · moodle/moodle
- CVE-2020-25701If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would emoodle · moodle/moodle
- CVE-2020-25698Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course.moodle · moodle/moodle
- CVE-2020-11831OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovoicemanager V2.0.1.com.oppo.ovoicemanager
- CVE-2020-11830QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0.com.oppo.qualityprotect
- CVE-2020-11829Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.codebook V2.0.0_5493com.coloros.codebook
- CVE-2020-28941An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9.
- CVE-2020-28054JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly
- CVE-2020-4718IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting.IBM Jazz Reporting Service
- CVE-2020-15710Potential double-free in pulseaudioCanonical PulseAudio
- CVE-2019-20933InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT tokgithub.com/influxdata/influxdb
- CVE-2020-8278Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.Nextcloud Social
- CVE-2020-8279Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.Nextcloud Social
- CVE-2020-8277A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versiNodeJS Node
- CVE-2020-5947In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequence numbers from the BBIG-IP 2000 series (C112), BIG-IP 4000 series (C113), BIG-I…
- CVE-2020-25699In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles witmoodle · moodle/moodle
- CVE-2020-7561A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause Easergy T300 with firmware 2.7 and older