CVE-2020-11986

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This causes the code of the build script to be invoked at load time of the project. Apache NetBeans up to and including 12.0 did not request consent from the user for the analysis of the project at load time. This in turn will run potentially malicious code, from an external source, without the consent of the user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-119878.2Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a speciCVE-2020-119888.2Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParseCVE-2020-119899.8Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication CVE-2020-11997.8An elevation of privilege vulnerability exists when the Windows Feedback Hub improperly handles objects in memory, aka 'Windows Feedback HubCVE-2020-119903.3We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who coulCVE-2020-119917.5When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system entities, could be usCVE-2020-119937.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logginCVE-2020-119947.5Server-Side Template Injection and arbitrary file disclosure on Camel templating componentsCVE-2020-119959.8A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo usCVE-2020-119967.5A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could tCVE-2020-119974.3Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users shaCVE-2020-119989.8A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of