CVEs published November 24, 2020
58 CVEs were published on November 24, 2020: 1 critical, 2 high.
- Published
- 58
- Critical
- 1
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- VMware SD-WAN Orchestrator
- 6
- Apache Software Foundation Apache Unomi · org.apache.unomi:…
- 1
- CRIXP OpenCRX
- 1
- github.com/go-gitea/gitea
- 1
- github.com/hashicorp/nomad
- 1
- gluster-block
- 1
- heketi · github.com/heketi/heketi
- 1
- highlightjs highlight.js · highlight.js
- 1
- jmrozanec cron-utils · com.cronutils:cron-utils
- 1
- jupyter_server · jupyter-server
- 1
Critical 1
High 2
Medium, low and unrated 55
- CVE-2020-29069_get_flag_ip_localdb in server/mhn/ui/utils.py in Modern Honey Network (MHN) through 2020-11-23 allows attackers to cause a denial-of-servic
- CVE-2020-26237Prototype Pollution in highlight.jshighlightjs highlight.js · highlight.js
- CVE-2020-26235Segmentation fault in Rust time cratetime-rs time · time
- CVE-2020-26232Open redirect in Jupyter Serverjupyter_server · jupyter-server
- CVE-2015-9550An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices.
- CVE-2015-9551An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices.
- CVE-2020-29054An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29055An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29056An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29057An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29058An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29059An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29060An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29061An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29062An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29063An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,
- CVE-2020-29053HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
- CVE-2020-25159Real Time Automation EtherNet/IPReal Time Automation 499ES EtherNet/IP (ENIP) Adaptor Sourc…
- CVE-2020-28329Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image.
- CVE-2020-25640A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection errwildfly · org.wildfly:wildfly-parent
- CVE-2020-28332Barco wePresent WiPG-1600W devices download code without an Integrity Check.
- CVE-2020-28334Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2).
- CVE-2020-28330Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials.
- CVE-2020-28333Barco wePresent WiPG-1600W devices allow Authentication Bypass.
- CVE-2020-28928In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstr
- CVE-2020-13942Remote Code Execution in Apache UnomiApache Software Foundation Apache Unomi · org.apache.unomi:…
- CVE-2020-28331Barco wePresent WiPG-1600W devices have Improper Access Control.
- CVE-2020-28994A SQL injection vulnerability was discovered in Karenderia Multiple Restaurant System, affecting versions 5.4.2 and below.
- CVE-2020-13620Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's abi
- CVE-2020-24815A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allo
- CVE-2020-28726Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php.
- CVE-2020-10762An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations.gluster-block
- CVE-2020-10763An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information.heketi · github.com/heketi/heketi
- CVE-2020-29040An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data
- CVE-2020-4000The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directoryVMware SD-WAN Orchestrator
- CVE-2020-3985The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to aVMware SD-WAN Orchestrator
- CVE-2020-3984The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-injectVMware SD-WAN Orchestrator
- CVE-2020-4003VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injectiVMware SD-WAN Orchestrator
- CVE-2020-4002The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure wayVMware SD-WAN Orchestrator
- CVE-2020-4001The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack.VMware SD-WAN Orchestrator
- CVE-2020-25475SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.
- CVE-2020-25474SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
- CVE-2020-25473SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.
- CVE-2020-25472SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new
- CVE-2020-29006MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php.
- CVE-2020-5674Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan hothe installers of multiple SEIKO EPSON products
- CVE-2020-5641Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the autheNetgear Japan G.K. GS108Ev3
- CVE-2020-29002includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administr
- CVE-2020-29003The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Sp
- CVE-2020-28348HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or github.com/hashicorp/nomad
- CVE-2020-26890Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, almatrix-synapse
- CVE-2020-15928In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.
- CVE-2020-15929In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write
- CVE-2020-28991Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (github.com/go-gitea/gitea
- CVE-2020-25654An ACL bypass flaw was found in pacemaker.pacemaker