CVEs published November 27, 2020
33 CVEs were published on November 27, 2020: 0 critical, 1 high.
- Published
- 33
- Critical
- 0
- High
- 1
- Medium
- 1
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- org.craftercms:crafter-studio
- 4
- org.craftercms:crafter-core
- 3
- blosc2
- 1
- com.softwaremill.akka-http-session:core_2.13 · com.softw… +1
- 1
- libvncserver
- 1
- sebhildebrandt systeminformation · systeminformation
- 1
- unbound
- 1
High 1
Medium, low and unrated 32
- CVE-2020-29367blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data.blosc2
- CVE-2020-28921An issue was discovered in Devid Espenschied PC Analyser through 4.10.
- CVE-2020-28922An issue was discovered in Devid Espenschied PC Analyser through 4.10.
- CVE-2020-25708A divide by zero issue was found to occur in libvncserver-0.9.12.libvncserver
- CVE-2020-10772An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414.unbound
- CVE-2017-15680In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative daorg.craftercms:crafter-core
- CVE-2017-15681In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files froorg.craftercms:crafter-studio
- CVE-2017-15682In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS org.craftercms:crafter-core
- CVE-2017-15683In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrievaorg.craftercms:crafter-core
- CVE-2017-15684Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operaorg.craftercms:crafter-studio
- CVE-2017-15685Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE).org.craftercms:crafter-studio
- CVE-2017-15686Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.org.craftercms:crafter-studio
- CVE-2020-25014A stack-based buffer overflow in fbwifi_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55
- CVE-2020-27746Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is a
- CVE-2020-27745Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.
- CVE-2020-7780Cross-site Request Forgery (CSRF)com.softwaremill.akka-http-session:core_2.13 · com.softw… +1
- CVE-2019-19878An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19877An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19876An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19875An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19874An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19873An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2020-29138Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET_4.109.0, allows remote unauthent
- CVE-2019-19872An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2019-19869An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.
- CVE-2020-25738CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL i
- CVE-2020-29144In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard
- CVE-2020-29145In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or descr
- CVE-2020-29136In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).
- CVE-2020-29137cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).
- CVE-2020-29135cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567).
- CVE-2020-29133jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile