CVEs published November 20, 2020
17 CVEs were published on November 20, 2020: 0 critical, 3 high. 1 is now in CISA KEV.
- Published
- 17
- Critical
- 0
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 1
- Fix available
- 2
Most affected products
- Drupal Core · drupal/core +1
- 1
- IBM DB2 for Linux, UNIX and Windows
- 1
- IBM Sterling B2B Integrator
- 1
- IBM VIOS · IBM AIX
- 1
- Mitsubishi Electric MELSEC iQ-R
- 1
- NetIQ Identity Manager
- 1
- Netis Korea D'live set-top box AP
- 1
- ScratchVerifier
- 1
- VMware ESXi
- 1
- VMware ESXi · Workstation +1
- 1
High 3
- CVE-2020-26236Verification Code Hijacking in ScratchVerifierScratchVerifier
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenDrupal Core · drupal/core +1
- CVE-2020-4739IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1,IBM DB2 for Linux, UNIX and Windows
Medium, low and unrated 14
- CVE-2020-4004VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5VMware ESXi · Workstation +1
- CVE-2020-4005VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalatioVMware ESXi
- CVE-2020-28845A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's po
- CVE-2020-20740PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf_get_version().
- CVE-2020-20739im_vips2dz in /libvips/libvips/deprecated/im_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of
- CVE-2020-28974A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or poten
- CVE-2020-28877Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WD
- CVE-2020-19668Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.
- CVE-2020-7842D'live AP command injection vulnerabilityNetis Korea D'live set-top box AP
- CVE-2020-25839NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability.NetIQ Identity Manager
- CVE-2020-4937IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an IBM Sterling B2B Integrator
- CVE-2020-4788IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache unIBM VIOS · IBM AIX
- CVE-2020-5668Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/Mitsubishi Electric MELSEC iQ-R
- CVE-2020-19667Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.