# CVEs published 2020-12-02

44 CVEs were published on December 2, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2020-29279](https://cve.now/CVE-2020-29279.md): PHP remote file inclusion in the assign\_resume\_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 a (no CVSS)
- [CVE-2020-29280](https://cve.now/CVE-2020-29280.md): The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page. (no CVSS)
- [CVE-2020-29282](https://cve.now/CVE-2020-29282.md): SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication. (no CVSS)
- [CVE-2020-29283](https://cve.now/CVE-2020-29283.md): An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php. (no CVSS)
- [CVE-2020-29284](https://cve.now/CVE-2020-29284.md): The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the table\_id parameter wh (no CVSS)
- [CVE-2020-29285](https://cve.now/CVE-2020-29285.md): SQL injection vulnerability was discovered in Point of Sales in PHP/PDO 1.0, which can be exploited via the id parameter to edit\_category.ph (no CVSS)
- [CVE-2020-29287](https://cve.now/CVE-2020-29287.md): An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter in view\_car.php or (no CVSS)
- [CVE-2020-29288](https://cve.now/CVE-2020-29288.md): An SQL injection vulnerability was discovered in Gym Management System In manage\_user.php file, GET parameter 'id' is vulnerable. (no CVSS)
- [CVE-2020-26244](https://cve.now/CVE-2020-26244.md): Cryptographic issues in Python oic (CVSS 6.8, OpenIDC pyoidc · oic)
- [CVE-2020-28206](https://cve.now/CVE-2020-28206.md): An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. (no CVSS)
- [CVE-2020-13498](https://cve.now/CVE-2020-13498.md): An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. (CVSS 4.3, Apple macOS · Pixar OpenUSD)
- [CVE-2020-13497](https://cve.now/CVE-2020-13497.md): An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. (CVSS 4.3, Pixar)
- [CVE-2020-13496](https://cve.now/CVE-2020-13496.md): An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. (CVSS 4.3, Pixar)
- [CVE-2020-13494](https://cve.now/CVE-2020-13494.md): A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files. (CVSS 4.3, Pixar)
- [CVE-2017-2910](https://cve.now/CVE-2017-2910.md): An exploitable Out-of-bounds Write vulnerability exists in the xls\_addCell function of libxls 2.0. (no CVSS, libxls)
- [CVE-2020-13493](https://cve.now/CVE-2020-13493.md): A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. (CVSS 8.8, Pixar)
- [CVE-2017-14451](https://cve.now/CVE-2017-14451.md): An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. (no CVSS, CPP-Ethereum)
- [CVE-2020-29389](https://cve.now/CVE-2020-29389.md): The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. (no CVSS)
- [CVE-2020-25266](https://cve.now/CVE-2020-25266.md): AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. (no CVSS)
- [CVE-2020-29240](https://cve.now/CVE-2020-29240.md): Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2020-25265](https://cve.now/CVE-2020-25265.md): AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file (no CVSS)
- [CVE-2020-29239](https://cve.now/CVE-2020-29239.md): Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2020-13956](https://cve.now/CVE-2020-13956.md): Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the li (CVSS 5.3, Apache HttpClient · org.apache.httpcomponents:httpclient)
- [CVE-2020-12524](https://cve.now/CVE-2020-12524.md): Phoenix Contact BTP Touch Panels uncontrolled resource consumption (CVSS 7.5, Phoenix Contact BTP Touch Panel)
- [CVE-2020-25638](https://cve.now/CVE-2020-25638.md): A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. (CVSS 7.4, hibernate-core · org.hibernate:hibernate-core)
- [CVE-2020-28273](https://cve.now/CVE-2020-28273.md): Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remo (no CVSS, set-in)
- [CVE-2020-28272](https://cve.now/CVE-2020-28272.md): Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remo (no CVSS, keyget)
- [CVE-2020-14369](https://cve.now/CVE-2020-14369.md): This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted act (no CVSS, CloudForms)
- [CVE-2020-29458](https://cve.now/CVE-2020-29458.md): Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem. (no CVSS)
- [CVE-2020-29456](https://cve.now/CVE-2020-29456.md): Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML (no CVSS, papermerge)
- [CVE-2020-5423](https://cve.now/CVE-2020-5423.md): Cloud Controller is vulnerable to denial of service via YAML parsing (CVSS 7.5, Cloud Foundry CAPI · Cloud Foundry CF Deployment)
- [CVE-2020-29454](https://cve.now/CVE-2020-29454.md): Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings (no CVSS, UmbracoCms)
- [CVE-2020-6018](https://cve.now/CVE-2020-6018.md): Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES\_GCM\_DecryptContext::Decry (no CVSS, Game Networking Sockets)
- [CVE-2020-14260](https://cve.now/CVE-2020-14260.md): HCL Domino is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. (no CVSS, HCL Domino)
- [CVE-2020-4102](https://cve.now/CVE-2020-4102.md): HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. (no CVSS, HCL Notes)
- [CVE-2020-27816](https://cve.now/CVE-2020-27816.md): The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replac (no CVSS, openshift-logging/console)
- [CVE-2020-25723](https://cve.now/CVE-2020-25723.md): A reachable assertion issue was found in the USB EHCI emulation code of QEMU. (no CVSS, QEMU)
- [CVE-2012-0955](https://cve.now/CVE-2012-0955.md): software-properties incorrectly validated TLS certificates (CVSS 6.8, Canonical software-properties)
- [CVE-2020-14305](https://cve.now/CVE-2020-14305.md): An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking functionality handled connect (no CVSS, kernel)
- [CVE-2020-7199](https://cve.now/CVE-2020-7199.md): A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Managemen (no CVSS, HPE Edgeline Infrastructure Management Software)
- [CVE-2020-14383](https://cve.now/CVE-2020-14383.md): A flaw was found in samba's DNS server. (no CVSS, samba)
- [CVE-2020-25656](https://cve.now/CVE-2020-25656.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2020-25704](https://cve.now/CVE-2020-25704.md): A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF\_EVENT\_IOC\_SET\_FILTER. (no CVSS, kernel)
- [CVE-2020-27813](https://cve.now/CVE-2020-27813.md): An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection. (no CVSS, golang-github-gorilla-websocket · github.com/gorilla/websoc…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.