CVEs published December 27, 2020
13 CVEs were published on December 27, 2020: 0 critical, 2 high. Browse them by severity, product and exploitation status.
- Published
- 13
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Backblaze
- 2
- autobahn
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- com.xuxueli:xxl-job-core
- 1
- Jiransecurity Spamsniper
- 1
- woocommerce/woocommerce
- 1
High 2
Medium, low and unrated 11
- CVE-2020-35736GateOne 1.1 allows arbitrary file download without authentication via /downloads/..
- CVE-2020-29156The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id…woocommerce/woocommerce
- CVE-2020-29250CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
- CVE-2020-29249CXUUCMS V3 allows class="layui-input" XSS.
- CVE-2020-29299Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action.
- CVE-2020-29204XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via…com.xuxueli:xxl-job-core
- CVE-2020-35729KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
- CVE-2020-35448An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1.
- CVE-2020-8290Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to…Backblaze
- CVE-2020-8289Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in…Backblaze
- CVE-2020-35678Autobahn|Python before 20.12.3 allows redirect header injection.autobahn