# CVEs published 2020-12-26

28 CVEs were published on December 26, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-35245](https://cve.now/CVE-2020-35245.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser. (no CVSS)
- [CVE-2020-35244](https://cve.now/CVE-2020-35244.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup. (no CVSS)
- [CVE-2020-35243](https://cve.now/CVE-2020-35243.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb. (no CVSS)
- [CVE-2020-35242](https://cve.now/CVE-2020-35242.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory. (no CVSS)
- [CVE-2020-29203](https://cve.now/CVE-2020-29203.md): struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J\_STRUCT\_GET\_string\_ELEMENT. (no CVSS)
- [CVE-2020-28759](https://cve.now/CVE-2020-28759.md): The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. (no CVSS)
- [CVE-2020-35364](https://cve.now/CVE-2020-35364.md): Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then… (no CVSS)
- [CVE-2020-35284](https://cve.now/CVE-2020-35284.md): Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a… (no CVSS)
- [CVE-2020-35362](https://cve.now/CVE-2020-35362.md): DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. (no CVSS)
- [CVE-2020-35359](https://cve.now/CVE-2020-35359.md): Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit. (no CVSS)
- [CVE-2020-35450](https://cve.now/CVE-2020-35450.md): Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set\_language calls. (no CVSS)
- [CVE-2020-35437](https://cve.now/CVE-2020-35437.md): Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar\[path\] parameter in a POST request to the /\_core/profile/… (no CVSS)
- [CVE-2020-35349](https://cve.now/CVE-2020-35349.md): Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field\_title (aka a title on the custom fields page). (no CVSS)
- [CVE-2020-35376](https://cve.now/CVE-2020-35376.md): Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the… (no CVSS)
- [CVE-2020-35347](https://cve.now/CVE-2020-35347.md): CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add. (no CVSS)
- [CVE-2020-35346](https://cve.now/CVE-2020-35346.md): CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2020-35388](https://cve.now/CVE-2020-35388.md): rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool… (no CVSS)
- [CVE-2020-35575](https://cve.now/CVE-2020-35575.md): A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to… (no CVSS)
- [CVE-2020-29385](https://cve.now/CVE-2020-29385.md): GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write\_indexes. (no CVSS)
- [CVE-2020-29172](https://cve.now/CVE-2020-29172.md): A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP… (no CVSS)
- [CVE-2020-27515](https://cve.now/CVE-2020-27515.md): A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the… (no CVSS)
- [CVE-2020-26766](https://cve.now/CVE-2020-26766.md): A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User… (no CVSS)
- [CVE-2020-25917](https://cve.now/CVE-2020-25917.md): Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. (no CVSS)
- [CVE-2020-35713](https://cve.now/CVE-2020-35713.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell… (no CVSS)
- [CVE-2020-35714](https://cve.now/CVE-2020-35714.md): Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via… (no CVSS)
- [CVE-2020-35715](https://cve.now/CVE-2020-35715.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters… (no CVSS)
- [CVE-2020-35716](https://cve.now/CVE-2020-35716.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a… (no CVSS)
- [CVE-2020-20412](https://cve.now/CVE-2020-20412.md): lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2020-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.