CVEs published November 25, 2020
12 CVEs were published on November 25, 2020: 0 critical, 2 high.
- Published
- 12
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Atlassian Fisheye · Atlassian Crucible
- 2
- go-ethereum · github.com/ethereum/go-ethereum
- 2
- glpi-project glpi
- 1
- go-ethereum · github.com/holiman/uint256 +1
- 1
- nanopb
- 1
- spice-vdagent
- 1
High 2
Medium, low and unrated 10
- CVE-2020-14190Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL.Atlassian Fisheye · Atlassian Crucible
- CVE-2020-29074scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
- CVE-2020-14191Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoSAtlassian Fisheye · Atlassian Crucible
- CVE-2020-29070osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
- CVE-2020-25650A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine.spice-vdagent
- CVE-2020-29071An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19.
- CVE-2020-29072A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19.
- CVE-2020-26240Erroneous Proof of Work calculation in gethgo-ethereum · github.com/ethereum/go-ethereum
- CVE-2020-26241Shallow copy bug in gethgo-ethereum · github.com/ethereum/go-ethereum
- CVE-2020-26242Denial of service in gethgo-ethereum · github.com/holiman/uint256 +1