# CVEs published 2020-11-26

19 CVEs were published on November 26, 2020: 0 critical, 1 high. Days are UTC.

- [CVE-2020-12262](https://cve.now/CVE-2020-12262.md): Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS. (no CVSS)
- [CVE-2020-29129](https://cve.now/CVE-2020-29129.md): ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the to (no CVSS)
- [CVE-2020-26936](https://cve.now/CVE-2020-26936.md): Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack. (no CVSS)
- [CVE-2020-29042](https://cve.now/CVE-2020-29042.md): An issue was discovered in BigBlueButton through 2.2.29. (no CVSS)
- [CVE-2020-29043](https://cve.now/CVE-2020-29043.md): An issue was discovered in BigBlueButton through 2.2.29. (no CVSS)
- [CVE-2020-13886](https://cve.now/CVE-2020-13886.md): Intelbras TIP 200 60.61.75.15, TIP 200 LITE 60.61.75.15, and TIP 300 65.61.75.22 devices allow cgi-bin/cgiServer.exx?page=../ Directory Trav (no CVSS)
- [CVE-2020-27663](https://cve.now/CVE-2020-27663.md): In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read (no CVSS)
- [CVE-2020-27662](https://cve.now/CVE-2020-27662.md): In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data fr (no CVSS)
- [CVE-2020-27207](https://cve.now/CVE-2020-27207.md): Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher\_codec\_pragma and sqlite3Strlen30 in sqlite3.c. (no CVSS)
- [CVE-2020-7778](https://cve.now/CVE-2020-7778.md): Prototype Pollution (CVSS 7.3, systeminformation)
- [CVE-2020-7779](https://cve.now/CVE-2020-7779.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, djvalidator)
- [CVE-2020-29128](https://cve.now/CVE-2020-29128.md): petl before 1.68, in some configurations, allows resolution of entities in an XML document. (no CVSS, petl)
- [CVE-2020-27251](https://cve.now/CVE-2020-27251.md): A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. (no CVSS, FactoryTalk Linx)
- [CVE-2020-27255](https://cve.now/CVE-2020-27255.md): A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. (no CVSS, FactoryTalk Linx)
- [CVE-2020-27253](https://cve.now/CVE-2020-27253.md): A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. (no CVSS, FactoryTalk Linx)
- [CVE-2020-25652](https://cve.now/CVE-2020-25652.md): A flaw was found in the spice-vdagentd daemon, where it did not properly handle client connections that can be established via the UNIX doma (no CVSS, spice-vdagent)
- [CVE-2020-25653](https://cve.now/CVE-2020-25653.md): A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. (no CVSS, spice-vdagent)
- [CVE-2020-25651](https://cve.now/CVE-2020-25651.md): A flaw was found in the SPICE file transfer protocol. (no CVSS, spice-vdagent)
- [CVE-2020-29130](https://cve.now/CVE-2020-29130.md): slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the t (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.