# CVEs published 2020-12-17

62 CVEs were published on December 17, 2020: 2 critical, 3 high. Days are UTC.

- [CVE-2020-14232](https://cve.now/CVE-2020-14232.md): A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a… (no CVSS, HCL Notes)
- [CVE-2020-27780](https://cve.now/CVE-2020-27780.md): A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. (no CVSS, pam)
- [CVE-2020-13516](https://cve.now/CVE-2020-13516.md): An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13517](https://cve.now/CVE-2020-13517.md): An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13518](https://cve.now/CVE-2020-13518.md): An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13511](https://cve.now/CVE-2020-13511.md): An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13510](https://cve.now/CVE-2020-13510.md): An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13509](https://cve.now/CVE-2020-13509.md): An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0. (CVSS 6.5, NZXT)
- [CVE-2020-13931](https://cve.now/CVE-2020-13931.md): If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and… (no CVSS, Apache TomEE · org.apache.tomee:apache-tomee)
- [CVE-2020-13528](https://cve.now/CVE-2020-13528.md): An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11… (CVSS 3.1, Lantronix)
- [CVE-2020-13527](https://cve.now/CVE-2020-13527.md): An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12… (CVSS 4.8, Lantronix)
- [CVE-2020-12523](https://cve.now/CVE-2020-12523.md): Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device… (CVSS 5.4, Phoenix Contact TC MGUARD RS4000 4G VZW VPN · Phoenix Co… +5)
- [CVE-2020-12521](https://cve.now/CVE-2020-12521.md): Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the… (CVSS 6.5, Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1)
- [CVE-2020-12519](https://cve.now/CVE-2020-12519.md): Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell… (CVSS 8.8, Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1)
- [CVE-2020-12518](https://cve.now/CVE-2020-12518.md): Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently… (CVSS 5.5, Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1)
- [CVE-2020-12517](https://cve.now/CVE-2020-12517.md): Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript… (CVSS 8.8, Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1)
- [CVE-2020-12522](https://cve.now/CVE-2020-12522.md): Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions \<=FW10 (CVSS 10.0, WAGO Series PFC · Series Wago Touch Panel 600 Standard L… +2)
- [CVE-2020-20138](https://cve.now/CVE-2020-20138.md): Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4. (no CVSS)
- [CVE-2020-20139](https://cve.now/CVE-2020-20139.md): Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17. (no CVSS)
- [CVE-2020-20140](https://cve.now/CVE-2020-20140.md): Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17. (no CVSS)
- [CVE-2020-20141](https://cve.now/CVE-2020-20141.md): Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17. (no CVSS)
- [CVE-2020-20142](https://cve.now/CVE-2020-20142.md): Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17. (no CVSS)
- [CVE-2020-8466](https://cve.now/CVE-2020-8466.md): A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8465](https://cve.now/CVE-2020-8465.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8463](https://cve.now/CVE-2020-8463.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8464](https://cve.now/CVE-2020-8464.md): A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8461](https://cve.now/CVE-2020-8461.md): A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-8462](https://cve.now/CVE-2020-8462.md): A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-27010](https://cve.now/CVE-2020-27010.md): A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to… (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2020-35545](https://cve.now/CVE-2020-35545.md): Time-based SQL injection exists in Spotweb 1.4.9 via the query string. (no CVSS)
- [CVE-2020-26276](https://cve.now/CVE-2020-26276.md): SAML authentication vulnerability in Fleet (CVSS 10.0, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2020-35490](https://cve.now/CVE-2020-35490.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-35491](https://cve.now/CVE-2020-35491.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-4846](https://cve.now/CVE-2020-4846.md): IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical… (CVSS 2.7, IBM Security Key Lifecycle Manager)
- [CVE-2020-4845](https://cve.now/CVE-2020-4845.md): IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2020-35489](https://cve.now/CVE-2020-35489.md): The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution… (no CVSS)
- [CVE-2020-15293](https://cve.now/CVE-2020-15293.md): Memory corruption in Bitdefender Hypervisor Introspection (VA-9336) (CVSS 6.1, Bitdefender Hypervisor Introspection)
- [CVE-2020-15294](https://cve.now/CVE-2020-15294.md): Compiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339) (CVSS 7.8, Bitdefender Hypervisor Introspection)
- [CVE-2020-15292](https://cve.now/CVE-2020-15292.md): Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333) (CVSS 5.5, Bitdefender Hypervisor Introspection)
- [CVE-2020-22083](https://cve.now/CVE-2020-22083.md): jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. (no CVSS, jsonpickle)
- [CVE-2020-35453](https://cve.now/CVE-2020-35453.md): HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. (no CVSS)
- [CVE-2020-35177](https://cve.now/CVE-2020-35177.md): HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. (no CVSS, github.com/hashicorp/vault)
- [CVE-2020-29652](https://cve.now/CVE-2020-29652.md): A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote… (no CVSS, golang.org/x/crypto)
- [CVE-2020-27199](https://cve.now/CVE-2020-27199.md): The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. (no CVSS)
- [CVE-2020-35123](https://cve.now/CVE-2020-35123.md): In Zimbra Collaboration Suite Network Edition versions \< 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer… (no CVSS)
- [CVE-2020-25011](https://cve.now/CVE-2020-25011.md): A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software… (no CVSS)
- [CVE-2020-25010](https://cve.now/CVE-2020-25010.md): An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software… (no CVSS)
- [CVE-2020-25094](https://cve.now/CVE-2020-25094.md): LogRhythm Platform Manager 7.4.9 allows Command Injection. (no CVSS)
- [CVE-2020-25095](https://cve.now/CVE-2020-25095.md): LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. (no CVSS)
- [CVE-2020-25096](https://cve.now/CVE-2020-25096.md): LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. (no CVSS)
- [CVE-2020-29436](https://cve.now/CVE-2020-29436.md): Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content… (no CVSS)
- [CVE-2020-35192](https://cve.now/CVE-2020-35192.md): The official vault docker images before 0.11.6 contain a blank password for a root user. (no CVSS)
- [CVE-2020-35190](https://cve.now/CVE-2020-35190.md): The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35184](https://cve.now/CVE-2020-35184.md): The official composer docker images before 1.8.3 contain a blank password for a root user. (no CVSS)
- [CVE-2020-35196](https://cve.now/CVE-2020-35196.md): The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35186](https://cve.now/CVE-2020-35186.md): The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. (no CVSS)
- [CVE-2020-35195](https://cve.now/CVE-2020-35195.md): The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35191](https://cve.now/CVE-2020-35191.md): The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35197](https://cve.now/CVE-2020-35197.md): The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35187](https://cve.now/CVE-2020-35187.md): The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35189](https://cve.now/CVE-2020-35189.md): The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35185](https://cve.now/CVE-2020-35185.md): The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.