Skip to content
OpenAdvisories

Archive

9 November 2020

Vulnerabilities first published on this day (UTC), newest first.

← October 2020 2020 / November /9 December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.8
    CVE-2020-4651

    IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 is vulnerable to cross-site request forgery …

    IBM Maximo Spatial Asset Management
  • Medium 4.0
    CVE-2020-4650

    IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0 allows web pages to be stored locally which …

    IBM Maximo Spatial Asset Management
  • Medium 6.1
    CVE-2020-28364

    Locust Stored Cross-site Scripting Vulnerability

    A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users.

    locust PyPI
  • Medium 5.5
    CVE-2020-23136

    Microweber Insufficient Session Expiry

    Microweber v1.1.18 is affected by no session expiry after log-out.

    microweber/microweber Packagist
  • Medium 6.8
    CVE-2020-14366

    Path Traversal

    A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be expose…

    Red Hat keycloak org.keycloak:keycloak-parent Maven
  • Medium 5.7
    CVE-2020-25655

    An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correc…

    Red Hat open-cluster-management
  • Medium 4.3
    CVE-2020-24405

    Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

    Adobe Magento Commerce magento/community-edition Web / CMS Packagist
  • Medium 6.5
    CVE-2020-24401

    Incorrect permissions following the deletion of a user role or deactivation of a user

    Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Medium 4.9
    CVE-2020-24402

    Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API

    Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer deta…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist