CVEs published December 17, 2020
62 CVEs were published on December 17, 2020: 2 critical, 3 high. Browse them by severity, product and exploitation status.
- Published
- 62
- Critical
- 2
- High
- 3
- Medium
- 13
- Low
- 2
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Trend Micro InterScan Web Security Virtual Appliance
- 7
- NZXT
- 6
- Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- 4
- Bitdefender Hypervisor Introspection
- 3
- com.fasterxml.jackson.core:jackson-databind
- 2
- IBM Security Key Lifecycle Manager
- 2
- Lantronix
- 2
- Apache TomEE · org.apache.tomee:apache-tomee
- 1
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 1
- github.com/hashicorp/vault
- 1
Critical 2
- CVE-2020-12522Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10WAGO Series PFC · Series Wago Touch Panel 600 Standard L… +2
- CVE-2020-26276SAML authentication vulnerability in Fleetfleetdm fleet · github.com/fleetdm/fleet/v4
High 3
- CVE-2020-12519Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell…Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-12517Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript…Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-15294Compiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339)Bitdefender Hypervisor Introspection
Medium, low and unrated 57
- CVE-2020-14232A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a…HCL Notes
- CVE-2020-27780A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users.pam
- CVE-2020-13516An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13517An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13518An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13511An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13510An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13509An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13931If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and…Apache TomEE · org.apache.tomee:apache-tomee
- CVE-2020-13528An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11…Lantronix
- CVE-2020-13527An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12…Lantronix
- CVE-2020-12523Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device…Phoenix Contact TC MGUARD RS4000 4G VZW VPN · Phoenix Co… +5
- CVE-2020-12521Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the…Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-12518Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently…Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-20138Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
- CVE-2020-20139Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20140Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20141Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20142Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-8466A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8465A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8463A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8464A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8461A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8462A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to…Trend Micro InterScan Web Security Virtual Appliance
Show all 57 entriesShow fewer entries
- CVE-2020-27010A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to…Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-35545Time-based SQL injection exists in Spotweb 1.4.9 via the query string.
- CVE-2020-35490FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-35491FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-4846IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical…IBM Security Key Lifecycle Manager
- CVE-2020-4845IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting.IBM Security Key Lifecycle Manager
- CVE-2020-35489The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution…
- CVE-2020-15293Memory corruption in Bitdefender Hypervisor Introspection (VA-9336)Bitdefender Hypervisor Introspection
- CVE-2020-15292Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)Bitdefender Hypervisor Introspection
- CVE-2020-22083jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.jsonpickle
- CVE-2020-35453HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces.
- CVE-2020-35177HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method.github.com/hashicorp/vault
- CVE-2020-29652A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote…golang.org/x/crypto
- CVE-2020-27199The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass.
- CVE-2020-35123In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer…
- CVE-2020-25011A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software…
- CVE-2020-25010An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software…
- CVE-2020-25094LogRhythm Platform Manager 7.4.9 allows Command Injection.
- CVE-2020-25095LogRhythm Platform Manager (PM) 7.4.9 allows CSRF.
- CVE-2020-25096LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control.
- CVE-2020-29436Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content…
- CVE-2020-35192The official vault docker images before 0.11.6 contain a blank password for a root user.
- CVE-2020-35190The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35184The official composer docker images before 1.8.3 contain a blank password for a root user.
- CVE-2020-35196The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35186The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.
- CVE-2020-35195The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35191The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35197The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35187The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35189The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35185The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.