# CVEs published 2020-12-07

19 CVEs were published on December 7, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-8563](https://cve.now/CVE-2020-8563.md): Secret leaks in logs for vSphere Provider kube-controller-manager (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-8564](https://cve.now/CVE-2020-8564.md): Docker config secrets leaked when file is malformed and loglevel \>= 4 (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-8565](https://cve.now/CVE-2020-8565.md): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \>= 9 (CVSS 4.7, Kubernetes · k8s.io/client-go +1)
- [CVE-2020-8566](https://cve.now/CVE-2020-8566.md): Ceph RBD adminSecrets exposed in logs when loglevel \>= 4 (CVSS 4.7, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2020-28935](https://cve.now/CVE-2020-28935.md): Local symlink attack in Unbound and NSD (no CVSS, NLnet Labs Unbound · NLnet Labs NSD)
- [CVE-2020-29600](https://cve.now/CVE-2020-29600.md): In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc (no CVSS)
- [CVE-2020-17521](https://cve.now/CVE-2020-17521.md): Apache Groovy provides extension methods to aid with creating temporary directories. (no CVSS, Apache Software Foundation Apache Groovy · org.codehaus.… +1)
- [CVE-2020-29597](https://cve.now/CVE-2020-29597.md): IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. (no CVSS)
- [CVE-2020-13945](https://cve.now/CVE-2020-13945.md): In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. (no CVSS, Apache Software Foundation Apache APISIX)
- [CVE-2020-29595](https://cve.now/CVE-2020-29595.md): PlugIns\\IDE\_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting at IDE\_ACDStd!JPEGT (no CVSS)
- [CVE-2020-26122](https://cve.now/CVE-2020-26122.md): Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. (no CVSS)
- [CVE-2020-26513](https://cve.now/CVE-2020-26513.md): An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. (no CVSS)
- [CVE-2020-27151](https://cve.now/CVE-2020-27151.md): An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. (no CVSS)
- [CVE-2020-9247](https://cve.now/CVE-2020-9247.md): There is a buffer overflow vulnerability in several Huawei products. (no CVSS, Huawei HONOR 20 PRO · HUAWEI Mate +8)
- [CVE-2020-5798](https://cve.now/CVE-2020-5798.md): inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privilege (no CVSS, Druva inSync macOS Client Installers for v6.8.0 and prior)
- [CVE-2020-5800](https://cve.now/CVE-2020-5800.md): The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify info (no CVSS, Eat Spray Love)
- [CVE-2020-5799](https://cve.now/CVE-2020-5799.md): The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileged access to restric (no CVSS, Eat Spray Love)
- [CVE-2020-28727](https://cve.now/CVE-2020-28727.md): Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChooser.php. (no CVSS)
- [CVE-2020-29599](https://cve.now/CVE-2020-29599.md): ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-prot (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.