Skip to content
OpenAdvisories

Archive

November 2020

Vulnerabilities first published in this month (UTC), newest first.

← October 2020 2020 / November December 2020 →
  1. 18
  2. 253
  3. 354
  4. 440
  5. 560
  6. 674
  7. 73
  8. 88
  9. 942
  10. 1059
  11. 11131
  12. 12159
  13. 1337
  14. 14 
  15. 158
  16. 1677
  17. 1759
  18. 1864
  19. 1962
  20. 2017
  21. 218
  22. 22 
  23. 2357
  24. 2460
  25. 2512
  26. 2619
  27. 2733
  28. 289
  29. 299
  30. 3040
All Critical High Medium Low Exploited only Public exploit

207 results · Clear filters · Feed

  • High 8.0
    CVE-2020-26207

    Unsafe deserialization in DatabaseSchemaViewer

    DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted `.dbschema` file. The patch was released in v2.7.4.3. As a workaround, ensure `.dbschema` files from untrusted sources …

    martinjw dbschemareader
  • High 7.7
    CVE-2020-26211

    Cross-Site Scripting in BookStack

    In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionall…

    BookStackApp BookStack ssddanbrown/bookstack Packagist
  • High 7.7
    CVE-2020-26210

    Cross-Site Scripting in BookStack

    In BookStack before version 0.30.4, a user with permissions to edit a page could add an attached link which would execute untrusted JavaScript code when clicked by a viewer of the page. Dangerous content may remain in the database after this update. If you th…

    BookStackApp BookStack
  • High 8.8
    CVE-2020-16009 Exploited EPSS 48%

    Inappropriate implementation in V8

    Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu NuGet
    KEV Nov 3, 2021
  • High 7.5
    CVE-2020-7758

    Path Traversal

    This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary f…

    browserless-chrome Browsers npm
  • High 7.5
    CVE-2020-10937

    Access Restriction Bypass in go-ipfs

    An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the at…

    github.com/ipfs/go-ipfs Go
  • High 8.8
    CVE-2020-25849

    Openfind MailGates/MailAudit - Command Injection

    MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameter after attackers obtain the user’s access token.

    Openfind MailGates MailAudit