CVEs published November 23, 2020
57 CVEs were published on November 23, 2020: 2 critical, 6 high. 1 is now in CISA KEV.
- Published
- 57
- Critical
- 2
- High
- 6
- Medium
- 17
- Low
- 2
- Unrated
- 30
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- MongoDB Server
- 11
- Extensible Firmware Interface Development Kit
- 7
- octobercms october · october/cms
- 3
- TYPO3.CMS · typo3/cms-core +1
- 3
- BlueZ
- 2
- IBM Spectrum Protect Plus
- 2
- linux kernel
- 2
- octobercms october · october/backend
- 2
- CA Unified Infrastructure Management
- 1
- ceph
- 1
Critical 2
- CVE-2020-4006VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerabiliVMware Workspace One Access (Access), VMware Workspace One…
- CVE-2020-4854IBM Spectrum Protect Plus 10.1.0 thorugh 10.1.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for IBM Spectrum Protect Plus
High 6
- CVE-2020-26228Cleartext storage of session identifierTYPO3.CMS · typo3/cms-core +1
- CVE-2020-15246Local File Inclusion by unauthenticated usersoctobercms october · october/cms
- CVE-2020-26239Cross-Site Scripting in Scratch browser addonsScratchAddons
- CVE-2020-7927Potential privilege escalation in Ops Manager APIMongoDB Ops Manager
- CVE-2020-7777Arbitrary Code Executionjsen
- CVE-2020-7925Denial of Service when processing malformed Role namesMongoDB Server
Medium, low and unrated 49
- CVE-2020-28984prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, displ
- CVE-2020-25660A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients coceph
- CVE-2020-25696A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6PostgreSQL
- CVE-2020-26229XML External Entity in Dashboard WidgetTYPO3.CMS · typo3/cms-core +1
- CVE-2020-25688A flaw was found in rhacm versions before 2.0.5 and before 2.1.0.rhacm
- CVE-2020-26227Cross-Site Scripting in Fluid view helpersTYPO3.CMS · typo3/cms-core +1
- CVE-2020-24227Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfile
- CVE-2020-26231Bypass of fix for CVE-2020-15247, Twig sandbox escapeoctobercms october · october/cms
- CVE-2018-16719In Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a denial of service (BSOD) or possibly have unspe
- CVE-2018-16720In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2018-16721In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2018-16722In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2020-28360Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF.private-ip
- CVE-2018-16723In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unsp
- CVE-2020-15437The Linux kernel before version 5.8 is vulnerable to a NULL pointer dereference in drivers/tty/serial/8250/8250_core.c:serial8250_isa_init_plinux kernel
- CVE-2020-15436Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or cause a denial of serlinux kernel
- CVE-2020-15249Stored XSS by authenticated backend user with access to upload filesoctobercms october · october/backend
- CVE-2020-15248Privilege escalation by backend users assigned to the default "Publisher" system roleoctobercms october · october/backend
- CVE-2020-28927There is a Stored XSS in Magicpin v2.1 in the User Registration section.
- CVE-2020-15247Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.octobercms october · october/cms
- CVE-2020-28896Mutt before 2.0.2 and NeoMutt before 2020-11-20 did not ensure that $ssl_force_tls was processed if an IMAP server's initial server response
- CVE-2020-28864Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a
- CVE-2018-20803Infinite loop in aggregation expressionMongoDB Server
- CVE-2020-4783IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to obtain sensitive information, caused by the failure to propIBM Spectrum Protect Plus
- CVE-2020-4771IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.10.and 7.1.0.000 through 7.1.11 could allow a remote attacker to obtain sensitiIBM Spectrum Protect Operations Center
- CVE-2020-7928Improper neutralization of null byte leads to read overrunMongoDB Server
- CVE-2020-6939Tableau Server installations configured with Site-Specific SAML that allows the APIs to be used by unauthenticated users.Tableau Server
- CVE-2020-12352Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access.BlueZ
- CVE-2020-12351Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.BlueZ
- CVE-2019-14587Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.Extensible Firmware Interface Development Kit
- CVE-2019-14586Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosureExtensible Firmware Interface Development Kit
- CVE-2019-14575Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via loExtensible Firmware Interface Development Kit
- CVE-2019-14563Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.Extensible Firmware Interface Development Kit
- CVE-2019-14562Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local aExtensible Firmware Interface Development Kit
- CVE-2019-14559Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.Extensible Firmware Interface Development Kit
- CVE-2019-14553Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.Extensible Firmware Interface Development Kit
- CVE-2020-28421CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackeCA Unified Infrastructure Management
- CVE-2020-1778Bypassing user account validationOTRS AG OTRS
- CVE-2019-2393Crash while joining collections with $lookupMongoDB Server
- CVE-2019-20923Crash while handling internal Javascript exception typesMongoDB Server
- CVE-2019-20924Invariant in IndexBoundsBuilderMongoDB Server
- CVE-2019-2392$mod can result in undefined behaviorMongoDB Server
- CVE-2018-20805Invariant with $elemMatchMongoDB Server
- CVE-2018-20802Post-auth queries on compound index may crash mongodMongoDB Server
- CVE-2018-20804Invariant failure in applyOpsMongoDB Server
- CVE-2020-7926Specific query can cause a DoS against MongoDB ServerMongoDB Server
- CVE-2020-27985Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without us
- CVE-2020-28053HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA privategithub.com/hashicorp/consul
- CVE-2020-0569Out of bounds write in Intel(R) PROSet/Wireless WiFi products on Windows 10 may allow an authenticated user to potentially enable denial of Intel(R) PROSet/Wireless WiFi products on Windows