Skip to content
OpenAdvisories

Archive

19 November 2020

Vulnerabilities first published on this day (UTC), newest first.

← October 2020 2020 / November /19 December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-28210

    A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in Eco…

  • Medium 6.5
    CVE-2020-12496

    ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 2.x exposures sensitive information to an unauthorized actor

    Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware version V2.0.0 and above is prone to exposure of sensitive information to an unauthorized actor. The firmware release has a…

    Endress+Hauser RSG35 - Ecograph T ORSG35 - Ecograph T Neutral/Private Label RSG45 - Memograph M
  • Medium 6.5
    CVE-2020-25700

    SQL Injection in moodle

    In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25702

    Cross-site Scripting (XSS) in moodle

    In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2020-25703

    Exposure of Sensitive Information to an Unauthorized Actor in Moodle

    The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2020-25701

    Privilage Escalation in moodle

    If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions af…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.5
    CVE-2020-28941

    An issue was discovered in drivers/accessibility/speakup/spk_ttyio.c in the Linux kernel through 5.9.9. Local attackers…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Medium 6.4
    CVE-2020-4718

    IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerabil…

    IBM Jazz Reporting Service
  • Medium 5.3
    CVE-2020-15710

    Potential double-free in pulseaudio

    Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/mod…

    Canonical PulseAudio pulseaudio Ubuntu