# CVEs published 2020-11-20

17 CVEs were published on November 20, 2020: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-4004](https://cve.now/CVE-2020-4004.md): VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5 (no CVSS, VMware ESXi · Workstation +1)
- [CVE-2020-4005](https://cve.now/CVE-2020-4005.md): VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalatio (no CVSS, VMware ESXi)
- [CVE-2020-28845](https://cve.now/CVE-2020-28845.md): A CSV injection vulnerability in the Admin portal for Netskope 75.0 allows an unauthenticated user to inject malicious payload in admin's po (no CVSS)
- [CVE-2020-20740](https://cve.now/CVE-2020-20740.md): PDFResurrect before 0.20 lack of header validation checks causes heap-buffer-overflow in pdf\_get\_version(). (no CVSS)
- [CVE-2020-20739](https://cve.now/CVE-2020-20739.md): im\_vips2dz in /libvips/libvips/deprecated/im\_vips2dz.c in libvips before 8.8.2 has an uninitialized variable which may cause the leakage of (no CVSS)
- [CVE-2020-26236](https://cve.now/CVE-2020-26236.md): Verification Code Hijacking in ScratchVerifier (CVSS 7.5, ScratchVerifier)
- [CVE-2020-28974](https://cve.now/CVE-2020-28974.md): A slab-out-of-bounds read in fbcon in the Linux kernel before 5.9.7 could be used by local attackers to read privileged information or poten (no CVSS)
- [CVE-2020-28877](https://cve.now/CVE-2020-28877.md): Buffer overflow in in the copy\_msg\_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WD (no CVSS)
- [CVE-2020-13671](https://cve.now/CVE-2020-13671.md): Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect exten (CVSS 8.8, KEV, Drupal Core · drupal/core +1)
- [CVE-2020-19668](https://cve.now/CVE-2020-19668.md): Unverified indexs into the array lead to out of bound access in the gif\_out\_code function in fromgif.c in libsixel 1.8.6. (no CVSS)
- [CVE-2020-7842](https://cve.now/CVE-2020-7842.md): D'live AP command injection vulnerability (CVSS 6.4, Netis Korea D'live set-top box AP)
- [CVE-2020-25839](https://cve.now/CVE-2020-25839.md): NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. (no CVSS, NetIQ Identity Manager)
- [CVE-2020-4937](https://cve.now/CVE-2020-4937.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.2 uses weaker than expected cryptographic algorithms that could allow an (CVSS 5.9, IBM Sterling B2B Integrator)
- [CVE-2020-4739](https://cve.now/CVE-2020-4739.md): IBM DB2 Accessories Suite for Linux, UNIX, and Windows, DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, (CVSS 7.8, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2020-4788](https://cve.now/CVE-2020-4788.md): IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache un (CVSS 5.1, IBM VIOS · IBM AIX)
- [CVE-2020-5668](https://cve.now/CVE-2020-5668.md): Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/ (no CVSS, Mitsubishi Electric MELSEC iQ-R)
- [CVE-2020-19667](https://cve.now/CVE-2020-19667.md): Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.