CVE-2020-27628: In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE archive
November 2020
Browse CVE records published in November 2020, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1371 matching CVEs · Page 14 of 28.
CVE-2020-27617: eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure.
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-27553: In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option...
In BASETech GE-131 BT-1837836 firmware 20180921, the web-server on the system is configured with the option “DocumentRoot /etc“. This allows an attacker with network access to the web-server to download any files from the “/etc” folder without authentication. No path traversal sequences are needed to exploit this vulnerability.
Published Nov 17, 2020 · Updated Aug 4, 2024
CVE-2020-27486: Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow.
Garmin Forerunner 235 before 8.20 is affected by: Buffer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the string length provided in the data section of the PRG file. It allocates memory for the string immediately, and then copies the string into the TVM object by using a function similar to strcpy. This copy can exceed the length of the allocated string data and overwrite heap data. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27622: In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE ve...
In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27555: Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows rem...
Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands as the root user.
Published Nov 17, 2020 · Updated Aug 4, 2024
CVE-2020-27557: Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows loc...
Unprotected Storage of Credentials vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials.
Published Nov 17, 2020 · Updated Aug 4, 2024
CVE-2020-27589: Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certific...
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-27481: An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage o...
An unauthenticated SQL Injection vulnerability in Good Layers LMS Plugin <= 2.1.4 exists due to the usage of "wp_ajax_nopriv" call in WordPress, which allows any unauthenticated user to get access to the function "gdlr_lms_cancel_booking" where POST Parameter "id" was sent straight into SQL query without sanitization.
Published Nov 12, 2020 · Updated Aug 4, 2024
CVE-2020-27586: Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
Quick Heal Total Security before version 19.0 transmits quarantine and sysinfo files via clear text.
Published Nov 30, 2020 · Updated Aug 4, 2024
CVE-2020-27587: Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in...
Quick Heal Total Security before 19.0 allows attackers with local admin rights to obtain access to files in the File Vault via a brute-force attack on the password.
Published Nov 30, 2020 · Updated Aug 4, 2024
CVE-2020-27524: On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395)...
On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services.
Published Nov 11, 2020 · Updated Aug 4, 2024
CVE-2020-27485: Garmin Forerunner 235 before 8.20 is affected by: Array index error.
Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check the index provided when accessing the local variable in the LGETV and LPUTV instructions. This provides the ability to both read and write memory outside the bounds of the TVM context allocation. It can be leveraged to construct a use-after-free scenario, leading to a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27484: Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow.
Garmin Forerunner 235 before 8.20 is affected by: Integer Overflow. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter fails to check for overflow when allocating the array for the NEWA instruction. This a constrained read/write primitive across the entire MAX32630 address space. A successful exploit would allow a ConnectIQ app store application to escape and perform activities outside the restricted application execution environment.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27422: In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used,...
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27423: Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to per...
Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27483: Garmin Forerunner 235 before 8.20 is affected by: Array index error.
Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability, the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction, DUP. The offset is unchecked and memory prior to the start of the execution stack can be read and treated as a TVM object. A successful exploit could use the vulnerability to leak runtime information such as the heap handle or pointer for a number of TVM context variables. Some reachable values may be controlled enough to forge a TVM object on the stack, leading to possible remote code execution.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27459: Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post.
Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27402: The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to roo...
The HK1 Box S905X3 TV Box contains a vulnerability that allows a local unprivileged user to escalate to root using the /system/xbin/su binary via a serial port (UART) connection or using adb.
Published Nov 5, 2020 · Updated Aug 4, 2024
CVE-2020-27385: Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allow...
Incorrect Access Control in the FileEditor (/Admin/Views/FileEditor/) in FlexDotnetCMS before v1.5.11 allows an authenticated remote attacker to read and write to existing files outside the web root. The files can be accessed via directory traversal, i.e., by entering a .. (dot dot) path such as ..\..\..\..\..\<file> in the input field of the FileEditor. In FlexDotnetCMS before v1.5.8, it is also possible to access files by specifying the full path (e.g., C:\<file>). The files can then be edited via the FileEditor.
Published Nov 12, 2020 · Updated Aug 4, 2024
CVE-2020-27386: An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to...
An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using the FileEditor (in v1.5.8 and prior) or the FileManager's rename function (in v1.5.7 and prior) to rename the file to an executable extension (e.g., ASP), and finally executing the file via an HTTP GET request to /<path_to_file>.
Published Nov 12, 2020 · Updated Aug 4, 2024
CVE-2020-27403: A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 an...
A vulnerability in the TCL Android Smart TV series V8-R851T02-LF1 V295 and below and V8-T658T01-LF1 V373 and below by TCL Technology Group Corporation allows an attacker on the adjacent network to arbitrarily browse and download sensitive files over an insecure web server running on port 7989 that lists all files & directories. An unprivileged remote attacker on the adjacent network, can download most system files, leading to serious critical information disclosure. Also, some TV models and/or FW versions may expose the webserver with the entire filesystem accessible on another port. For example, nmap scan for all ports run directly from the TV model U43P6046 (Android 8.0) showed port 7983 not mentioned in the original CVE description, but containing the same directory listing of the entire filesystem. This webserver is bound (at least) to localhost interface and accessible freely to all unprivileged installed apps on the Android such as a regular web browser. Any app can therefore read any files of any other apps including Android system settings including sensitive data such as saved passwords, private keys etc.
Published Nov 10, 2020 · Updated Aug 4, 2024
CVE-2020-27387: An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker...
An unrestricted file upload issue in HorizontCMS through 1.0.0-beta allows an authenticated remote attacker (with access to the FileManager) to upload and execute arbitrary PHP code by uploading a PHP payload, and then using the FileManager's rename function to provide the payload (which will receive a random name on the server) with the PHP extension, and finally executing the PHP file via an HTTP GET request to /storage/<php_file_name>. NOTE: the vendor has patched this while leaving the version number at 1.0.0-beta.
Published Nov 5, 2020 · Updated Aug 4, 2024
CVE-2020-27253: A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior.
A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to specifically craft a malicious packet resulting in a denial-of-service condition on the device.
Published Nov 26, 2020 · Updated Aug 4, 2024
CVE-2020-27251: A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior.
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious port ranges, which could result in remote code execution.
Published Nov 26, 2020 · Updated Aug 4, 2024
CVE-2020-27255: A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior.
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious set attribute requests, which could result in the leaking of sensitive information. This information disclosure could lead to the bypass of address space layout randomization (ASLR).
Published Nov 26, 2020 · Updated Aug 4, 2024
CVE-2020-27207: Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strle...
Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlcipher_codec_pragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.
Published Nov 26, 2020 · Updated Aug 4, 2024
CVE-2020-27218: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to...
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Published Nov 28, 2020 · Updated Aug 4, 2024
CVE-2020-27191: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted stri...
LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Published Nov 16, 2020 · Updated Aug 4, 2024
CVE-2020-27192: BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabl...
BinaryNights ForkLift 3.4 was compiled with the com.apple.security.cs.disable-library-validation flag enabled which allowed a local attacker to inject code into ForkLift. This would allow the attacker to run malicious code with escalated privileges through ForkLift's helper tool.
Published Nov 17, 2020 · Updated Aug 4, 2024
CVE-2020-27193: A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote att...
A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
Published Nov 12, 2020 · Updated Aug 4, 2024
CVE-2020-27217: In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages...
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
Published Nov 13, 2020 · Updated Aug 4, 2024
CVE-2020-27196: An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2.
An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-27152: An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2.
An issue was discovered in ioapic_lazy_update_eoi in arch/x86/kvm/ioapic.c in the Linux kernel before 5.9.2. It has an infinite loop related to improper interaction between a resampler and edge triggering, aka CID-77377064c3a9.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-27018: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side reque...
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability.
Published Nov 9, 2020 · Updated Aug 4, 2024
CVE-2020-27017: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Ent...
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Published Nov 9, 2020 · Updated Aug 4, 2024
CVE-2020-27019: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disc...
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key.
Published Nov 9, 2020 · Updated Aug 4, 2024
CVE-2020-27016: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site reques...
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Published Nov 9, 2020 · Updated Aug 4, 2024
CVE-2020-26933: Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1....
Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack.
Published Nov 18, 2020 · Updated Aug 4, 2024
CVE-2020-26819: SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authe...
SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that allows them to read and delete database logfiles because of Improper Access Control.
Published Nov 10, 2020 · Updated Aug 4, 2024
CVE-2020-26939: In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive inf...
In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
Published Nov 2, 2020 · Updated Aug 4, 2024
CVE-2020-26804: In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab.
In Sentrifugo 3.2, users can share an announcement under "Organization -> Announcements" tab. Also, in this page, users can upload attachments with the shared announcements. This "Upload Attachment" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.
Published Nov 12, 2020 · Updated Aug 4, 2024
CVE-2020-26936: Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.
Cloudera Data Engineering (CDE) before 1.1 was vulnerable to a CSRF attack.
Published Nov 26, 2020 · Updated Aug 4, 2024
CVE-2020-26817: SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from un...
SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
Published Nov 10, 2020 · Updated Aug 4, 2024
CVE-2020-26882: In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/f...
In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-26807: SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are...
SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone to modify the files in the folder.
Published Nov 10, 2020 · Updated Aug 4, 2024
CVE-2020-26892: The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired creden...
The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.
Published Nov 6, 2020 · Updated Aug 4, 2024
CVE-2020-26815: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized att...
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.
Published Nov 10, 2020 · Updated Aug 4, 2024
CVE-2020-26884: RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability.
RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application.
Published Nov 18, 2020 · Updated Aug 4, 2024
CVE-2020-26803: In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab.
In Sentrifugo 3.2, users can upload an image under "Assets -> Add" tab. This "Upload Images" functionality is suffered from "Unrestricted File Upload" vulnerability so attacker can upload malicious files using this functionality and control the server.
Published Nov 12, 2020 · Updated Aug 4, 2024