# CVEs published 2020-11-27 33 CVEs were published on November 27, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-26245](https://cve.now/CVE-2020-26245.md): Prototype Pollution leading to Command Injection in systeminformation (CVSS 8.1, sebhildebrandt systeminformation · systeminformation) - [CVE-2020-29367](https://cve.now/CVE-2020-29367.md): blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data. (no CVSS, blosc2) - [CVE-2020-28921](https://cve.now/CVE-2020-28921.md): An issue was discovered in Devid Espenschied PC Analyser through 4.10. (no CVSS) - [CVE-2020-28922](https://cve.now/CVE-2020-28922.md): An issue was discovered in Devid Espenschied PC Analyser through 4.10. (no CVSS) - [CVE-2020-25708](https://cve.now/CVE-2020-25708.md): A divide by zero issue was found to occur in libvncserver-0.9.12. (no CVSS, libvncserver) - [CVE-2020-10772](https://cve.now/CVE-2020-10772.md): An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. (no CVSS, unbound) - [CVE-2017-15680](https://cve.now/CVE-2017-15680.md): In Crafter CMS Crafter Studio 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative da (no CVSS, org.craftercms:crafter-core) - [CVE-2017-15681](https://cve.now/CVE-2017-15681.md): In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files fro (no CVSS, org.craftercms:crafter-studio) - [CVE-2017-15682](https://cve.now/CVE-2017-15682.md): In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS (no CVSS, org.craftercms:crafter-core) - [CVE-2017-15683](https://cve.now/CVE-2017-15683.md): In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieva (no CVSS, org.craftercms:crafter-core) - [CVE-2017-15684](https://cve.now/CVE-2017-15684.md): Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the opera (no CVSS, org.craftercms:crafter-studio) - [CVE-2017-15685](https://cve.now/CVE-2017-15685.md): Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). (no CVSS, org.craftercms:crafter-studio) - [CVE-2017-15686](https://cve.now/CVE-2017-15686.md): Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies. (no CVSS, org.craftercms:crafter-studio) - [CVE-2020-25014](https://cve.now/CVE-2020-25014.md): A stack-based buffer overflow in fbwifi\_continue.cgi on Zyxel UTM and VPN series of gateways running firmware version V4.30 through to V4.55 (no CVSS) - [CVE-2020-27746](https://cve.now/CVE-2020-27746.md): Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is a (no CVSS) - [CVE-2020-27745](https://cve.now/CVE-2020-27745.md): Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin. (no CVSS) - [CVE-2020-7780](https://cve.now/CVE-2020-7780.md): Cross-site Request Forgery (CSRF) (CVSS 6.3, com.softwaremill.akka-http-session:core\_2.13 · com.softw… +1) - [CVE-2019-19878](https://cve.now/CVE-2019-19878.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19877](https://cve.now/CVE-2019-19877.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19876](https://cve.now/CVE-2019-19876.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19875](https://cve.now/CVE-2019-19875.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19874](https://cve.now/CVE-2019-19874.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19873](https://cve.now/CVE-2019-19873.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2020-29138](https://cve.now/CVE-2020-29138.md): Incorrect Access Control in the configuration backup path in SAGEMCOM F@ST3486 NET DOCSIS 3.0, software NET\_4.109.0, allows remote unauthent (no CVSS) - [CVE-2019-19872](https://cve.now/CVE-2019-19872.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2019-19869](https://cve.now/CVE-2019-19869.md): An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. (no CVSS) - [CVE-2020-25738](https://cve.now/CVE-2020-25738.md): CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL i (no CVSS) - [CVE-2020-29144](https://cve.now/CVE-2020-29144.md): In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard (no CVSS) - [CVE-2020-29145](https://cve.now/CVE-2020-29145.md): In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a web base module in BSCS iX that is vulnerable to stored XSS via the name or descr (no CVSS) - [CVE-2020-29136](https://cve.now/CVE-2020-29136.md): In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). (no CVSS) - [CVE-2020-29137](https://cve.now/CVE-2020-29137.md): cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). (no CVSS) - [CVE-2020-29135](https://cve.now/CVE-2020-29135.md): cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). (no CVSS) - [CVE-2020-29133](https://cve.now/CVE-2020-29133.md): jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature, as demonstrated by a .jpg.html filename in the signImgFile (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-11-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.