CVEs published December 1, 2020
29 CVEs were published on December 1, 2020: 0 critical, 1 high.
- Published
- 29
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Trend Micro Apex One · Trend Micro OfficeScan
- 5
- EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…
- 3
- WECON PLC Editor
- 2
- Apache Cordova
- 1
- containerd · github.com/containerd/containerd
- 1
- FusionCompute
- 1
- HCL Domino
- 1
- HUAWEI nova 4;SydneyM-AL00
- 1
- jupyterhub oauthenticator · oauthenticator
- 1
- McAfee Total Protection
- 1
High 1
Medium, low and unrated 28
- CVE-2020-26250Base class whitelist configuration ignored in OAuthenticatorjupyterhub oauthenticator · oauthenticator
- CVE-2020-28582An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2020-28583An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2020-28575A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalateTrend Micro ServerProtect for Linux
- CVE-2020-28576An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2020-28577An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2020-28573An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticatedTrend Micro Apex One · Trend Micro OfficeScan
- CVE-2019-16958Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Locat
- CVE-2020-8539Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unaut
- CVE-2020-29315ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.zoujingli/thinkadmin
- CVE-2020-11990We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications.Apache Cordova
- CVE-2020-6880A ZXELINK wireless controller has a SQL injection vulnerability.ZXV10 W908
- CVE-2020-28970An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.
- CVE-2020-28940On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allo
- CVE-2020-28971An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115.
- CVE-2020-28993A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0.
- CVE-2020-26762A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorize
- CVE-2020-25181WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary codWECON PLC Editor
- CVE-2020-25177WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code WECON PLC Editor
- CVE-2020-7533CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication whWeb Server on Modicon M340, Modicon Quantum and Modicon Pre…
- CVE-2020-7548A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notificSmartlink, PowerTag, and Wiser Series Gateways
- CVE-2020-7547A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see securityEcoStruxureª and SmartStruxureª Power Monitoring and SCADA…
- CVE-2020-7546A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power MonitoriEcoStruxureª and SmartStruxureª Power Monitoring and SCADA…
- CVE-2020-7545A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…
- CVE-2020-4128HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service.HCL Domino
- CVE-2020-15257containerd-shim API Exposed to Host Network Containerscontainerd · github.com/containerd/containerd
- CVE-2020-9114FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability.FusionCompute
- CVE-2020-9117HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-bounHUAWEI nova 4;SydneyM-AL00