CVEs published December 7, 2020
19 CVEs were published on December 7, 2020: 0 critical, 0 high.
- Published
- 19
- Critical
- 0
- High
- 0
- Medium
- 4
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Kubernetes · github.com/kubernetes/kubernetes +1
- 3
- Eat Spray Love
- 2
- Apache Software Foundation Apache APISIX
- 1
- Apache Software Foundation Apache Groovy · org.codehaus.… +1
- 1
- Druva inSync macOS Client Installers for v6.8.0 and prior
- 1
- Huawei HONOR 20 PRO · HUAWEI Mate +8
- 1
- Kubernetes · k8s.io/client-go +1
- 1
- NLnet Labs Unbound · NLnet Labs NSD
- 1
Medium, low and unrated 19
- CVE-2020-8563Secret leaks in logs for vSphere Provider kube-controller-managerKubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-8564Docker config secrets leaked when file is malformed and loglevel >= 4Kubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-8565Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9Kubernetes · k8s.io/client-go +1
- CVE-2020-8566Ceph RBD adminSecrets exposed in logs when loglevel >= 4Kubernetes · github.com/kubernetes/kubernetes +1
- CVE-2020-28935Local symlink attack in Unbound and NSDNLnet Labs Unbound · NLnet Labs NSD
- CVE-2020-29600In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc
- CVE-2020-17521Apache Groovy provides extension methods to aid with creating temporary directories.Apache Software Foundation Apache Groovy · org.codehaus.… +1
- CVE-2020-29597IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability.
- CVE-2020-13945In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.Apache Software Foundation Apache APISIX
- CVE-2020-29595PlugIns\IDE_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting at IDE_ACDStd!JPEGT
- CVE-2020-26122Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges.
- CVE-2020-26513An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4.
- CVE-2020-27151An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1.
- CVE-2020-9247There is a buffer overflow vulnerability in several Huawei products.Huawei HONOR 20 PRO · HUAWEI Mate +8
- CVE-2020-5798inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privilegeDruva inSync macOS Client Installers for v6.8.0 and prior
- CVE-2020-5800The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify infoEat Spray Love
- CVE-2020-5799The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restricEat Spray Love
- CVE-2020-28727Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php.
- CVE-2020-29599ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-prot