Skip to content
OpenAdvisories

Archive

November 2020

Vulnerabilities first published in this month (UTC), newest first.

← October 2020 2020 / November December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.8
    CVE-2020-13671 Exploited Public exploit EPSS 36%

    Drupal core Unrestricted Upload of File with Dangerous Type

    Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupa…

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Alpine Packagist
    KEV Jan 18, 2022
  • High 7.8
    CVE-2020-28949 Exploited Public exploit EPSS 85%

    Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrappe…

    drupal7 drupal7 php-pear php-pear Debian Ubuntu Alpine
    KEV Aug 25, 2022
  • High 7.8
    CVE-2020-17087 Exploited Public exploit

    Windows Kernel Local Elevation of Privilege Vulnerability

    Windows Kernel Local Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-13927 Exploited Public exploit EPSS 100%

    Authentication bypass in Apache Airflow

    The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and …

    apache-airflow PyPI
    KEV Jan 18, 2022
  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2020-15999 Exploited Public exploit EPSS 64%

    Heap buffer overflow in CefSharp

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium-browser firefox-esr Browsers Debian Ubuntu Alpine NuGet
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-14750 Exploited Public exploit EPSS 99%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported version…

    Oracle WebLogic Server
    KEV Nov 3, 2021