# CVEs published 2020-11-25

12 CVEs were published on November 25, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-14190](https://cve.now/CVE-2020-14190.md): Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. (no CVSS, Atlassian Fisheye · Atlassian Crucible)
- [CVE-2020-29074](https://cve.now/CVE-2020-29074.md): scan.c in x11vnc 0.9.16 uses IPC\_CREAT|0777 in shmget calls, which allows access by actors other than the current user. (no CVSS)
- [CVE-2020-14191](https://cve.now/CVE-2020-14191.md): Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS (no CVSS, Atlassian Fisheye · Atlassian Crucible)
- [CVE-2020-29070](https://cve.now/CVE-2020-29070.md): osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters. (no CVSS)
- [CVE-2020-26212](https://cve.now/CVE-2020-26212.md): Any GLPI CalDAV calendars is read-only for every authenticated user (CVSS 7.7, glpi-project glpi)
- [CVE-2020-26243](https://cve.now/CVE-2020-26243.md): Memory leak in nanopb (CVSS 7.5, nanopb)
- [CVE-2020-25650](https://cve.now/CVE-2020-25650.md): A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. (no CVSS, spice-vdagent)
- [CVE-2020-29071](https://cve.now/CVE-2020-29071.md): An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. (no CVSS)
- [CVE-2020-29072](https://cve.now/CVE-2020-29072.md): A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. (no CVSS)
- [CVE-2020-26240](https://cve.now/CVE-2020-26240.md): Erroneous Proof of Work calculation in geth (CVSS 5.3, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2020-26241](https://cve.now/CVE-2020-26241.md): Shallow copy bug in geth (CVSS 6.5, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2020-26242](https://cve.now/CVE-2020-26242.md): Denial of service in geth (CVSS 6.5, go-ethereum · github.com/holiman/uint256 +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.