# CVEs published 2020-12-03

55 CVEs were published on December 3, 2020: 1 critical, 6 high. Days are UTC.

- [CVE-2020-16123](https://cve.now/CVE-2020-16123.md): Bypass of snapd pulseaudio restrictions (CVSS 4.4, Canonical pulseaudio)
- [CVE-2018-21270](https://cve.now/CVE-2018-21270.md): Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized b (no CVSS, stringstream)
- [CVE-2020-26248](https://cve.now/CVE-2020-26248.md): Blind SQL injection during the CommentGrade process (CVSS 6.8, PrestaShop productcomments · prestashop/productcomments)
- [CVE-2020-29534](https://cve.now/CVE-2020-29534.md): An issue was discovered in the Linux kernel before 5.9.3. (no CVSS)
- [CVE-2020-29529](https://cve.now/CVE-2020-29529.md): HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypas (no CVSS, github.com/hashicorp/go-slug)
- [CVE-2020-23736](https://cve.now/CVE-2020-23736.md): There is a local denial of service vulnerability in DaDa accelerator 5.6.19.816,, attackers can use constructed programs to cause computer c (no CVSS)
- [CVE-2020-23738](https://cve.now/CVE-2020-23738.md): There is a local denial of service vulnerability in Advanced SystemCare 13 PRO 13.5.0.174. (no CVSS)
- [CVE-2020-17527](https://cve.now/CVE-2020-17527.md): Apache Tomcat: Request header mix-up between HTTP/2 streams (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2020-23741](https://cve.now/CVE-2020-23741.md): In AnyView (network police) network monitoring software 4.6.0.1, there is a local denial of service vulnerability in AnyView, attackers can (no CVSS)
- [CVE-2020-23740](https://cve.now/CVE-2020-23740.md): In DriverGenius 9.61.5480.28 there is a local privilege escalation vulnerability in the driver wizard, attackers can use constructed program (no CVSS)
- [CVE-2020-28175](https://cve.now/CVE-2020-28175.md): There is a local privilege escalation vulnerability in Alfredo Milani Comparetti SpeedFan 4.52. (no CVSS)
- [CVE-2020-23727](https://cve.now/CVE-2020-23727.md): There is a local denial of service vulnerability in the Antiy Zhijia Terminal Defense System 5.0.2.10121559 and an attacker can cause a comp (no CVSS)
- [CVE-2020-23726](https://cve.now/CVE-2020-23726.md): There is a local denial of service vulnerability in Wise Care 365 5.5.4, attackers can cause computer crash (BSOD). (no CVSS)
- [CVE-2020-13525](https://cve.now/CVE-2020-13525.md): The sort parameter in the download page /sysworkflow/en/neoclassic/reportTables/reportTables\_Ajax is vulnerable to SQL injection in ProcessM (CVSS 6.4, ProcessMaker)
- [CVE-2020-13524](https://cve.now/CVE-2020-13524.md): An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD files. (CVSS 6.3, Pixar)
- [CVE-2020-13584](https://cve.now/CVE-2020-13584.md): An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. (CVSS 8.8, Webkit)
- [CVE-2020-23735](https://cve.now/CVE-2020-23735.md): In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. (no CVSS)
- [CVE-2020-25693](https://cve.now/CVE-2020-25693.md): A flaw was found in CImg in versions prior to 2.9.3. (no CVSS, CImg)
- [CVE-2020-28251](https://cve.now/CVE-2020-28251.md): NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provid (no CVSS)
- [CVE-2020-27778](https://cve.now/CVE-2020-27778.md): A flaw was found in Poppler in the way certain PDF files were converted into HTML. (no CVSS, poppler)
- [CVE-2020-14351](https://cve.now/CVE-2020-14351.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2020-27783](https://cve.now/CVE-2020-27783.md): A XSS vulnerability was discovered in python-lxml's clean module. (CVSS 6.1, python-lxml · lxml)
- [CVE-2020-13543](https://cve.now/CVE-2020-13543.md): A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. (CVSS 8.8, Webkit)
- [CVE-2020-13542](https://cve.now/CVE-2020-13542.md): A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. (CVSS 9.3, LogicalDoc)
- [CVE-2020-13531](https://cve.now/CVE-2020-13531.md): A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. (CVSS 8.8, Pixar)
- [CVE-2020-14381](https://cve.now/CVE-2020-14381.md): A flaw was found in the Linux kernel’s futex implementation. (CVSS 7.8, kernel)
- [CVE-2020-28923](https://cve.now/CVE-2020-28923.md): An issue was discovered in Play Framework 2.8.0 through 2.8.4. (no CVSS, com.typesafe.play:play)
- [CVE-2020-25649](https://cve.now/CVE-2020-25649.md): A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. (no CVSS, jackson-databind · com.fasterxml.jackson.core:jackson-datab…)
- [CVE-2020-28939](https://cve.now/CVE-2020-28939.md): OpenClinic version 0.8.2 is affected by a medical/test\_new.php insecure file upload vulnerability. (no CVSS)
- [CVE-2020-28938](https://cve.now/CVE-2020-28938.md): OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on (no CVSS)
- [CVE-2020-2323](https://cve.now/CVE-2020-2323.md): Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers with Overall/Read per (no CVSS, Jenkins project Jenkins Chaos Monkey Plugin · io.jenkins.pl…)
- [CVE-2020-2324](https://cve.now/CVE-2020-2324.md): Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins CVS Plugin · org.jenkins-ci.plugins…)
- [CVE-2020-2320](https://cve.now/CVE-2020-2320.md): Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. (no CVSS, Jenkins project Jenkins Plugin Installation Manager Tool ·…)
- [CVE-2020-2321](https://cve.now/CVE-2020-2321.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to shelve, unshelve, or (no CVSS, Jenkins project Jenkins Shelve Project Plugin · org.jenkins…)
- [CVE-2020-2322](https://cve.now/CVE-2020-2322.md): Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Re (no CVSS, Jenkins project Jenkins Chaos Monkey Plugin · io.jenkins.pl…)
- [CVE-2020-28937](https://cve.now/CVE-2020-28937.md): OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to access any patient's med (no CVSS)
- [CVE-2020-6017](https://cve.now/CVE-2020-6017.md): Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP\_ReceiveUnreliableSegment (no CVSS, Game Networking Sockets)
- [CVE-2020-6021](https://cve.now/CVE-2020-6021.md): Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repa (no CVSS, Check Point Endpoint Security Client for Windows)
- [CVE-2020-6111](https://cve.now/CVE-2020-6111.md): An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controll (CVSS 7.5, Allen-Bradley)
- [CVE-2020-5680](https://cve.now/CVE-2020-5680.md): Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS) (no CVSS, EC-CUBE CO. EC-CUBE · ec-cube/ec-cube)
- [CVE-2020-5677](https://cve.now/CVE-2020-5677.md): Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary script via unspecified (no CVSS, WESEEK GROWI)
- [CVE-2020-5678](https://cve.now/CVE-2020-5678.md): Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script via unspecified vec (no CVSS, WESEEK GROWI)
- [CVE-2020-5679](https://cve.now/CVE-2020-5679.md): Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks. (no CVSS, EC-CUBE CO. EC-CUBE · ec-cube/ec-cube)
- [CVE-2020-5638](https://cve.now/CVE-2020-5638.md): Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NEO Enterprise License (no CVSS, NEOJAPAN desknet's NEO)
- [CVE-2020-5676](https://cve.now/CVE-2020-5676.md): GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vectors. (no CVSS, WESEEK GROWI)
- [CVE-2020-26246](https://cve.now/CVE-2020-26246.md): Authorization bypass in Pimcore (CVSS 7.7, pimcore)
- [CVE-2020-14318](https://cve.now/CVE-2020-14318.md): A flaw was found in the way samba handled file and directory permissions. (CVSS 4.3, samba)
- [CVE-2020-14339](https://cve.now/CVE-2020-14339.md): A flaw was found in libvirt, where it leaked a file descriptor for \`/dev/mapper/control\` into the QEMU process. (no CVSS, libvirt)
- [CVE-2020-25711](https://cve.now/CVE-2020-25711.md): A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operatio (no CVSS, infinispan · org.infinispan:infinispan-core)
- [CVE-2020-27759](https://cve.now/CVE-2020-27759.md): In IntensityCompare() of /MagickCore/quantize.c, a double value was being casted to int and returned, which in some cases caused a value out (no CVSS, ImageMagick)
- [CVE-2020-27760](https://cve.now/CVE-2020-27760.md): In \`GammaImage()\` of /MagickCore/enhance.c, depending on the \`gamma\` value, it's possible to trigger a divide-by-zero condition when a craft (no CVSS, ImageMagick)
- [CVE-2020-27761](https://cve.now/CVE-2020-27761.md): WritePALMImage() in /coders/palm.c used size\_t casts in several areas of a calculation which could lead to values outside the range of repre (no CVSS, ImageMagick)
- [CVE-2020-27762](https://cve.now/CVE-2020-27762.md): A flaw was found in ImageMagick in coders/hdr.c. (no CVSS, ImageMagick)
- [CVE-2020-27763](https://cve.now/CVE-2020-27763.md): A flaw was found in ImageMagick in MagickCore/resize.c. (no CVSS, ImageMagick)
- [CVE-2020-27764](https://cve.now/CVE-2020-27764.md): In /MagickCore/statistic.c, there are several areas in ApplyEvaluateOperator() where a size\_t cast should have been a ssize\_t cast, which ca (no CVSS, ImageMagick)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.