# CVEs published 2020-11-24

58 CVEs were published on November 24, 2020: 1 critical, 2 high. Days are UTC.

- [CVE-2020-26238](https://cve.now/CVE-2020-26238.md): Critical vulnerability found in cron-utils (CVSS 7.9, jmrozanec cron-utils · com.cronutils:cron-utils)
- [CVE-2020-29069](https://cve.now/CVE-2020-29069.md): \_get\_flag\_ip\_localdb in server/mhn/ui/utils.py in Modern Honey Network (MHN) through 2020-11-23 allows attackers to cause a denial-of-servic (no CVSS)
- [CVE-2020-26237](https://cve.now/CVE-2020-26237.md): Prototype Pollution in highlight.js (CVSS 5.8, highlightjs highlight.js · highlight.js)
- [CVE-2020-26235](https://cve.now/CVE-2020-26235.md): Segmentation fault in Rust time crate (CVSS 5.3, time-rs time · time)
- [CVE-2020-26232](https://cve.now/CVE-2020-26232.md): Open redirect in Jupyter Server (CVSS 4.1, jupyter\_server · jupyter-server)
- [CVE-2015-9550](https://cve.now/CVE-2015-9550.md): An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. (no CVSS)
- [CVE-2015-9551](https://cve.now/CVE-2015-9551.md): An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. (no CVSS)
- [CVE-2020-29054](https://cve.now/CVE-2020-29054.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29055](https://cve.now/CVE-2020-29055.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29056](https://cve.now/CVE-2020-29056.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29057](https://cve.now/CVE-2020-29057.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29058](https://cve.now/CVE-2020-29058.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29059](https://cve.now/CVE-2020-29059.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29060](https://cve.now/CVE-2020-29060.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29061](https://cve.now/CVE-2020-29061.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29062](https://cve.now/CVE-2020-29062.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29063](https://cve.now/CVE-2020-29063.md): An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, (no CVSS)
- [CVE-2020-29053](https://cve.now/CVE-2020-29053.md): HRSALE 2.0.0 allows XSS via the admin/project/projects\_calendar set\_date parameter. (no CVSS)
- [CVE-2020-25159](https://cve.now/CVE-2020-25159.md): Real Time Automation EtherNet/IP (no CVSS, Real Time Automation 499ES EtherNet/IP (ENIP) Adaptor Sourc…)
- [CVE-2020-28329](https://cve.now/CVE-2020-28329.md): Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. (no CVSS)
- [CVE-2020-25640](https://cve.now/CVE-2020-25640.md): A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection err (no CVSS, wildfly · org.wildfly:wildfly-parent)
- [CVE-2020-28332](https://cve.now/CVE-2020-28332.md): Barco wePresent WiPG-1600W devices download code without an Integrity Check. (no CVSS)
- [CVE-2020-28334](https://cve.now/CVE-2020-28334.md): Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). (no CVSS)
- [CVE-2020-28330](https://cve.now/CVE-2020-28330.md): Barco wePresent WiPG-1600W devices have Unprotected Transport of Credentials. (no CVSS)
- [CVE-2020-28333](https://cve.now/CVE-2020-28333.md): Barco wePresent WiPG-1600W devices allow Authentication Bypass. (no CVSS)
- [CVE-2020-28928](https://cve.now/CVE-2020-28928.md): In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstr (no CVSS)
- [CVE-2020-13942](https://cve.now/CVE-2020-13942.md): Remote Code Execution in Apache Unomi (no CVSS, Apache Software Foundation Apache Unomi · org.apache.unomi:…)
- [CVE-2020-28331](https://cve.now/CVE-2020-28331.md): Barco wePresent WiPG-1600W devices have Improper Access Control. (no CVSS)
- [CVE-2020-28994](https://cve.now/CVE-2020-28994.md): A SQL injection vulnerability was discovered in Karenderia Multiple Restaurant System, affecting versions 5.4.2 and below. (no CVSS)
- [CVE-2020-13620](https://cve.now/CVE-2020-13620.md): Fastweb FASTGate GPON FGA2130FWB devices through 2020-05-26 allow CSRF via the router administration web panel, leading to an attacker's abi (no CVSS)
- [CVE-2020-24815](https://cve.now/CVE-2020-24815.md): A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 allo (no CVSS)
- [CVE-2020-28726](https://cve.now/CVE-2020-28726.md): Open redirect in SeedDMS 6.0.13 via the dropfolderfileform1 parameter to out/out.AddDocument.php. (no CVSS)
- [CVE-2020-7378](https://cve.now/CVE-2020-7378.md): CRIXP OpenCRX Unverified Password Change (CVSS 9.1, CRIXP OpenCRX)
- [CVE-2020-10762](https://cve.now/CVE-2020-10762.md): An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. (no CVSS, gluster-block)
- [CVE-2020-10763](https://cve.now/CVE-2020-10763.md): An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. (no CVSS, heketi · github.com/heketi/heketi)
- [CVE-2020-29040](https://cve.now/CVE-2020-29040.md): An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data (no CVSS)
- [CVE-2020-4000](https://cve.now/CVE-2020-4000.md): The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 allows for executing files through directory (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-3985](https://cve.now/CVE-2020-3985.md): The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 allows an access to set arbitrary authorization levels leading to a (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-3984](https://cve.now/CVE-2020-3984.md): The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3 and 3.4.x prior to 3.4.4 does not apply correct input validation which allows for SQL-inject (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-4003](https://cve.now/CVE-2020-4003.md): VMware SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 was found to be vulnerable to SQL-injecti (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-4002](https://cve.now/CVE-2020-4002.md): The SD-WAN Orchestrator 3.3.2 prior to 3.3.2 P3, 3.4.x prior to 3.4.4, and 4.0.x prior to 4.0.1 handles system parameters in an insecure way (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-4001](https://cve.now/CVE-2020-4001.md): The SD-WAN Orchestrator 3.3.2, 3.4.x, and 4.0.x has default passwords allowing for a Pass-the-Hash Attack. (no CVSS, VMware SD-WAN Orchestrator)
- [CVE-2020-25475](https://cve.now/CVE-2020-25475.md): SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action. (no CVSS)
- [CVE-2020-25474](https://cve.now/CVE-2020-25474.md): SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor\_name parameter. (no CVSS)
- [CVE-2020-25473](https://cve.now/CVE-2020-25473.md): SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies. (no CVSS)
- [CVE-2020-25472](https://cve.now/CVE-2020-25472.md): SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new (no CVSS)
- [CVE-2020-29006](https://cve.now/CVE-2020-29006.md): MISP before 2.4.135 lacks an ACL check, related to app/Controller/GalaxyElementsController.php and app/Model/GalaxyElement.php. (no CVSS)
- [CVE-2019-20925](https://cve.now/CVE-2019-20925.md): Denial of service via malformed network packet (CVSS 7.5, MongoDB Server)
- [CVE-2020-5674](https://cve.now/CVE-2020-5674.md): Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan ho (no CVSS, the installers of multiple SEIKO EPSON products)
- [CVE-2020-5641](https://cve.now/CVE-2020-5641.md): Cross-site request forgery (CSRF) vulnerability in GS108Ev3 firmware version 2.06.10 and earlier allows remote attackers to hijack the authe (no CVSS, Netgear Japan G.K. GS108Ev3)
- [CVE-2020-29002](https://cve.now/CVE-2020-29002.md): includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administr (no CVSS)
- [CVE-2020-29003](https://cve.now/CVE-2020-29003.md): The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Sp (no CVSS)
- [CVE-2020-28348](https://cve.now/CVE-2020-28348.md): HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-26890](https://cve.now/CVE-2020-26890.md): Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, al (no CVSS, matrix-synapse)
- [CVE-2020-15928](https://cve.now/CVE-2020-15928.md): In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal. (no CVSS)
- [CVE-2020-15929](https://cve.now/CVE-2020-15929.md): In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write (no CVSS)
- [CVE-2020-28991](https://cve.now/CVE-2020-28991.md): Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines ( (no CVSS, github.com/go-gitea/gitea)
- [CVE-2020-25654](https://cve.now/CVE-2020-25654.md): An ACL bypass flaw was found in pacemaker. (no CVSS, pacemaker)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.