# CVEs published 2020-12-01 29 CVEs were published on December 1, 2020: 0 critical, 1 high. Days are UTC. - [CVE-2020-26250](https://cve.now/CVE-2020-26250.md): Base class whitelist configuration ignored in OAuthenticator (CVSS 6.3, jupyterhub oauthenticator · oauthenticator) - [CVE-2020-28582](https://cve.now/CVE-2020-28582.md): An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan) - [CVE-2020-28583](https://cve.now/CVE-2020-28583.md): An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan) - [CVE-2020-28575](https://cve.now/CVE-2020-28575.md): A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate (no CVSS, Trend Micro ServerProtect for Linux) - [CVE-2020-28576](https://cve.now/CVE-2020-28576.md): An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan) - [CVE-2020-28577](https://cve.now/CVE-2020-28577.md): An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan) - [CVE-2020-28573](https://cve.now/CVE-2020-28573.md): An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan) - [CVE-2019-16958](https://cve.now/CVE-2019-16958.md): Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web script or HTML via Locat (no CVSS) - [CVE-2020-8539](https://cve.now/CVE-2020-8539.md): Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unaut (no CVSS) - [CVE-2020-29315](https://cve.now/CVE-2020-29315.md): ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML. (no CVSS, zoujingli/thinkadmin) - [CVE-2020-11990](https://cve.now/CVE-2020-11990.md): We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. (no CVSS, Apache Cordova) - [CVE-2020-6880](https://cve.now/CVE-2020-6880.md): A ZXELINK wireless controller has a SQL injection vulnerability. (no CVSS, ZXV10 W908) - [CVE-2020-28970](https://cve.now/CVE-2020-28970.md): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. (no CVSS) - [CVE-2020-28940](https://cve.now/CVE-2020-28940.md): On Western Digital My Cloud OS 5 devices before 5.06.115, the NAS Admin dashboard has an authentication bypass vulnerability that could allo (no CVSS) - [CVE-2020-28971](https://cve.now/CVE-2020-28971.md): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.06.115. (no CVSS) - [CVE-2020-28993](https://cve.now/CVE-2020-28993.md): A Directory Traversal vulnerability exists in ATX miniCMTS200a Broadband Gateway through 2.0 and Pico CMTS through 2.0. (no CVSS) - [CVE-2020-26762](https://cve.now/CVE-2020-26762.md): A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorize (no CVSS) - [CVE-2020-25181](https://cve.now/CVE-2020-25181.md): WECON PLC Editor Versions 1.3.8 and prior has a heap-based buffer overflow vulnerabilities have been identified that may allow arbitrary cod (no CVSS, WECON PLC Editor) - [CVE-2020-25177](https://cve.now/CVE-2020-25177.md): WECON PLC Editor Versions 1.3.8 and prior has a stack-based buffer overflow vulnerability has been identified that may allow arbitrary code (no CVSS, WECON PLC Editor) - [CVE-2020-7533](https://cve.now/CVE-2020-7533.md): CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication wh (no CVSS, Web Server on Modicon M340, Modicon Quantum and Modicon Pre…) - [CVE-2020-7548](https://cve.now/CVE-2020-7548.md): A CWE-330 - Use of Insufficiently Random Values vulnerability exists in Smartlink, PowerTag, and Wiser Series Gateways (see security notific (no CVSS, Smartlink, PowerTag, and Wiser Series Gateways) - [CVE-2020-7547](https://cve.now/CVE-2020-7547.md): A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security (no CVSS, EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…) - [CVE-2020-7546](https://cve.now/CVE-2020-7546.md): A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitori (no CVSS, EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…) - [CVE-2020-7545](https://cve.now/CVE-2020-7545.md): A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security (no CVSS, EcoStruxureª and SmartStruxureª Power Monitoring and SCADA…) - [CVE-2020-4128](https://cve.now/CVE-2020-4128.md): HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. (no CVSS, HCL Domino) - [CVE-2020-7335](https://cve.now/CVE-2020-7335.md): Privilege Escalation vulnerability in McAfee Total Protection (MTP) (CVSS 7.5, McAfee Total Protection) - [CVE-2020-15257](https://cve.now/CVE-2020-15257.md): containerd-shim API Exposed to Host Network Containers (CVSS 5.2, containerd · github.com/containerd/containerd) - [CVE-2020-9114](https://cve.now/CVE-2020-9114.md): FusionCompute versions 6.3.0, 6.3.1, 6.5.0, 6.5.1 and 8.0.0 have a privilege escalation vulnerability. (no CVSS, FusionCompute) - [CVE-2020-9117](https://cve.now/CVE-2020-9117.md): HUAWEI nova 4 versions earlier than 10.0.0.165(C01E34R2P4) and SydneyM-AL00 versions earlier than 10.0.0.165(C00E66R1P5) have an out-of-boun (no CVSS, HUAWEI nova 4;SydneyM-AL00) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.