# CVEs published 2020-11-30

40 CVEs were published on November 30, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-9115](https://cve.now/CVE-2020-9115.md): ManageOne versions 6.5.1.1.B010, 6.5.1.1.B020, 6.5.1.1.B030, 6.5.1.1.B040, ,6.5.1.1.B050, 8.0.0 and 8.0.1 have a command injection vulnerabi (no CVSS, ManageOne)
- [CVE-2020-9116](https://cve.now/CVE-2020-9116.md): Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. (no CVSS, FusionCompute)
- [CVE-2020-4126](https://cve.now/CVE-2020-4126.md): HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. (no CVSS, HCL iNotes)
- [CVE-2020-4129](https://cve.now/CVE-2020-4129.md): HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. (no CVSS, HCL Domino)
- [CVE-2020-14193](https://cve.now/CVE-2020-14193.md): Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache templates in files inside th (no CVSS, Atlassian Automation for Jira)
- [CVE-2020-4127](https://cve.now/CVE-2020-4127.md): HCL Domino is susceptible to a Login CSRF vulnerability. (no CVSS, HCL Domino)
- [CVE-2020-29441](https://cve.now/CVE-2020-29441.md): An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. (CVSS 7.2)
- [CVE-2020-16850](https://cve.now/CVE-2020-16850.md): Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted pa (no CVSS)
- [CVE-2020-16849](https://cve.now/CVE-2020-16849.md): An issue was discovered on Canon MF237w 06.07 devices. (no CVSS)
- [CVE-2020-29438](https://cve.now/CVE-2020-29438.md): Tesla Model X vehicles before 2020-11-23 have key fobs that accept firmware updates without signature verification. (no CVSS)
- [CVE-2020-29439](https://cve.now/CVE-2020-29439.md): Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a body control module (no CVSS)
- [CVE-2020-29440](https://cve.now/CVE-2020-29440.md): Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob with the body control (no CVSS)
- [CVE-2020-11867](https://cve.now/CVE-2020-11867.md): Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. (no CVSS)
- [CVE-2020-27587](https://cve.now/CVE-2020-27587.md): Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force (no CVSS)
- [CVE-2020-27586](https://cve.now/CVE-2020-27586.md): Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text. (no CVSS)
- [CVE-2020-27585](https://cve.now/CVE-2020-27585.md): Quick Heal Total Security before 19.0 allows attackers with local admin rights to modify sensitive anti virus settings via a brute-attack on (no CVSS)
- [CVE-2020-8351](https://cve.now/CVE-2020-8351.md): A privilege escalation vulnerability was reported in Lenovo PCManager prior to version 3.0.50.9162 that could allow an authenticated user to (CVSS 7.8, Lenovo PCManager)
- [CVE-2020-29395](https://cve.now/CVE-2020-29395.md): The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. (no CVSS)
- [CVE-2020-6317](https://cve.now/CVE-2020-6317.md): In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive inform (CVSS 2.6, SAP SE SAP Adaptive Server Enterprise)
- [CVE-2020-17901](https://cve.now/CVE-2020-17901.md): Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user. (no CVSS)
- [CVE-2020-29392](https://cve.now/CVE-2020-29392.md): The Estil Hill Lock Password Manager Safe app 2.3 for iOS has a \*#06#\* backdoor password. (no CVSS)
- [CVE-2020-29364](https://cve.now/CVE-2020-29364.md): In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. (no CVSS)
- [CVE-2020-29390](https://cve.now/CVE-2020-29390.md): Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthe (no CVSS)
- [CVE-2020-25537](https://cve.now/CVE-2020-25537.md): File upload vulnerability exists in UCMS 1.5.0, and the attacker can take advantage of this vulnerability to obtain server management permis (no CVSS)
- [CVE-2020-28926](https://cve.now/CVE-2020-28926.md): ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. (no CVSS)
- [CVE-2020-29384](https://cve.now/CVE-2020-29384.md): An issue was discovered in PNGOUT 2020-01-15. (no CVSS)
- [CVE-2020-4900](https://cve.now/CVE-2020-4900.md): IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. (CVSS 5.1, IBM Business Automation Workflow)
- [CVE-2020-4696](https://cve.now/CVE-2020-4696.md): IBM Cloud Pak for Security 1.3.0.1(CP4S) does not invalidate session after logout which could allow an authenticated user to obtain sensitiv (CVSS 5.3, IBM Cloud Pak for Security)
- [CVE-2020-4627](https://cve.now/CVE-2020-4627.md): IBM Cloud Pak for Security 1.3.0.1(CP4S) potentially vulnerable to CVS Injection. (CVSS 6.5, IBM Cloud Pak for Security)
- [CVE-2020-4626](https://cve.now/CVE-2020-4626.md): IBM Cloud Pak for Security 1.3.0.1 (CP4S) could reveal sensitive information about the internal network to an authenticated user using a spe (CVSS 5.0, IBM Cloud Pak for Security)
- [CVE-2020-4625](https://cve.now/CVE-2020-4625.md): IBM Cloud Pak for Security 1.3.0.1(CP4S) could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTT (CVSS 4.0, IBM Cloud Pak for Security)
- [CVE-2020-4624](https://cve.now/CVE-2020-4624.md): IBM Cloud Pak for Security 1.3.0.1 (CP4S) uses weaker than expected cryptographic algorithms during negotiation could allow an attacker to d (CVSS 3.7, IBM Cloud Pak for Security)
- [CVE-2020-28978](https://cve.now/CVE-2020-28978.md): The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. (no CVSS)
- [CVE-2020-28977](https://cve.now/CVE-2020-28977.md): The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. (no CVSS)
- [CVE-2020-28976](https://cve.now/CVE-2020-28976.md): The Canto plugin 1.3.0 for WordPress contains a blind SSRF vulnerability. (no CVSS)
- [CVE-2020-27660](https://cve.now/CVE-2020-27660.md): SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL command (CVSS 9.6, Synology Safe Access)
- [CVE-2020-27659](https://cve.now/CVE-2020-27659.md): Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web (CVSS 8.4, Synology Safe Access)
- [CVE-2020-29127](https://cve.now/CVE-2020-29127.md): An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. (no CVSS)
- [CVE-2020-25624](https://cve.now/CVE-2020-25624.md): hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver. (no CVSS)
- [CVE-2020-29394](https://cve.now/CVE-2020-29394.md): A buffer overflow in the dlt\_filter\_load function in dlt\_common.c from dlt-daemon through 2.18.5 (GENIVI Diagnostic Log and Trace) allows ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.