Skip to content
OpenAdvisories

Archive

November 2020

Vulnerabilities first published in this month (UTC), newest first.

← October 2020 2020 / November December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-13942 Public exploit Scanner template EPSS 69%

    Remote Code Execution in Apache Unomi

    It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly…

    Apache Software Foundation Apache Unomi org.apache.unomi:unomi Maven
  • Critical 9.1
    CVE-2020-7378 Public exploit

    CRIXP OpenCRX Unverified Password Change

    CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to the affected OpenCRX instance can change the password of any user, including admin-Standard, to any chosen va…

    CRIXP OpenCRX
  • Critical 9.8
    CVE-2019-20933 Public exploit Scanner template EPSS 32%

    Improper Authentication in InfluxDB

    InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

    influxdb github.com/influxdata/influxdb influxdb Debian Ubuntu Go
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit Scanner template EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-25592 Public exploit EPSS 58%

    SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi

    In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.

    salt salt salt Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-27955 Public exploit EPSS 82%

    Git LFS can execute a Git binary from the current directory

    Git LFS 2.12.0 allows Remote Code Execution.

    github.com/git-lfs/git-lfs Go
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Azure Linux Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit Scanner template EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021