CVEs published December 2, 2020
44 CVEs were published on December 2, 2020: 0 critical, 4 high.
- Published
- 44
- Critical
- 0
- High
- 4
- Medium
- 7
- Low
- 0
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Pixar
- 4
- kernel
- 3
- Apache HttpClient · org.apache.httpcomponents:httpclient
- 1
- Apple macOS · Pixar OpenUSD
- 1
- Canonical software-properties
- 1
- Cloud Foundry CAPI · Cloud Foundry CF Deployment
- 1
- CloudForms
- 1
- CPP-Ethereum
- 1
- Game Networking Sockets
- 1
- golang-github-gorilla-websocket · github.com/gorilla/websoc…
- 1
High 4
- CVE-2020-13493A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.Pixar
- CVE-2020-12524Phoenix Contact BTP Touch Panels uncontrolled resource consumptionPhoenix Contact BTP Touch Panel
- CVE-2020-25638A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.hibernate-core · org.hibernate:hibernate-core
- CVE-2020-5423Cloud Controller is vulnerable to denial of service via YAML parsingCloud Foundry CAPI · Cloud Foundry CF Deployment
Medium, low and unrated 40
- CVE-2020-29279PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 a
- CVE-2020-29280The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
- CVE-2020-29282SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.
- CVE-2020-29283An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php.
- CVE-2020-29284The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the table_id parameter wh
- CVE-2020-29285SQL injection vulnerability was discovered in Point of Sales in PHP/PDO 1.0, which can be exploited via the id parameter to edit_category.ph
- CVE-2020-29287An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter in view_car.php or
- CVE-2020-29288An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable.
- CVE-2020-26244Cryptographic issues in Python oicOpenIDC pyoidc · oic
- CVE-2020-28206An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0.
- CVE-2020-13498An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types.Apple macOS · Pixar OpenUSD
- CVE-2020-13497An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types.Pixar
- CVE-2020-13496An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types.Pixar
- CVE-2020-13494A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files.Pixar
- CVE-2017-2910An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0.libxls
- CVE-2017-14451An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum.CPP-Ethereum
- CVE-2020-29389The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user.
- CVE-2020-25266AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage.
- CVE-2020-29240Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS).
- CVE-2020-25265AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file
- CVE-2020-29239Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS).
- CVE-2020-13956Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the liApache HttpClient · org.apache.httpcomponents:httpclient
- CVE-2020-28273Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remoset-in
- CVE-2020-28272Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remokeyget
- CVE-2020-14369This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actCloudForms
- CVE-2020-29458Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
- CVE-2020-29456Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTMLpapermerge
- CVE-2020-29454Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings UmbracoCms
- CVE-2020-6018Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::DecryGame Networking Sockets
- CVE-2020-14260HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input.HCL Domino
- CVE-2020-4102HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input.HCL Notes
- CVE-2020-27816The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replacopenshift-logging/console
- CVE-2020-25723A reachable assertion issue was found in the USB EHCI emulation code of QEMU.QEMU
- CVE-2012-0955software-properties incorrectly validated TLS certificatesCanonical software-properties
- CVE-2020-14305An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connectkernel
- CVE-2020-7199A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure ManagemenHPE Edgeline Infrastructure Management Software
- CVE-2020-14383A flaw was found in samba's DNS server.samba
- CVE-2020-25656A flaw was found in the Linux kernel.kernel
- CVE-2020-25704A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER.kernel
- CVE-2020-27813An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection.golang-github-gorilla-websocket · github.com/gorilla/websoc…