CVEs published November 30, 2020
40 CVEs were published on November 30, 2020: 1 critical, 3 high.
- Published
- 40
- Critical
- 1
- High
- 3
- Medium
- 5
- Low
- 2
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- IBM Cloud Pak for Security
- 5
- HCL Domino
- 2
- Synology Safe Access
- 2
- Atlassian Automation for Jira
- 1
- FusionCompute
- 1
- HCL iNotes
- 1
- IBM Business Automation Workflow
- 1
- Lenovo PCManager
- 1
- ManageOne
- 1
- SAP SE SAP Adaptive Server Enterprise
- 1
Critical 1
High 3
- CVE-2020-29441An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0.
- CVE-2020-8351A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user toLenovo PCManager
- CVE-2020-27659Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web Synology Safe Access
Medium, low and unrated 36
- CVE-2020-9115ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerabiManageOne
- CVE-2020-9116Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability.FusionCompute
- CVE-2020-4126HCL iNotes is susceptible to a sensitive cookie exposure vulnerability.HCL iNotes
- CVE-2020-4129HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service.HCL Domino
- CVE-2020-14193Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside thAtlassian Automation for Jira
- CVE-2020-4127HCL Domino is susceptible to a Login CSRF vulnerability.HCL Domino
- CVE-2020-16850Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted pa
- CVE-2020-16849An issue was discovered on Canon MF237w 06.07 devices.
- CVE-2020-29438Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification.
- CVE-2020-29439Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module
- CVE-2020-29440Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control
- CVE-2020-11867Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default.
- CVE-2020-27587Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force
- CVE-2020-27586Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
- CVE-2020-27585Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on
- CVE-2020-29395The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.
- CVE-2020-6317In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive informSAP SE SAP Adaptive Server Enterprise
- CVE-2020-17901Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.
- CVE-2020-29392The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a *#06#* backdoor password.
- CVE-2020-29364In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks.
- CVE-2020-29390Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthe
- CVE-2020-25537File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permis
- CVE-2020-28926ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution.
- CVE-2020-29384An issue was discovered in PNGOUT 2020-01-15.
- CVE-2020-4900IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user.IBM Business Automation Workflow
- CVE-2020-4696IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitivIBM Cloud Pak for Security
- CVE-2020-4627IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection.IBM Cloud Pak for Security
- CVE-2020-4626IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a speIBM Cloud Pak for Security
- CVE-2020-4625IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTIBM Cloud Pak for Security
- CVE-2020-4624IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to dIBM Cloud Pak for Security
- CVE-2020-28978The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.
- CVE-2020-28977The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability.
- CVE-2020-28976The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability.
- CVE-2020-29127An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25.
- CVE-2020-25624hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
- CVE-2020-29394A buffer overflow in the dlt_filter_load function in dlt_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows ar