CVEs published December 8, 2020
116 CVEs were published on December 8, 2020: 0 critical, 5 high. 3 are now in CISA KEV.
- Published
- 116
- Critical
- 0
- High
- 5
- Medium
- 6
- Low
- 0
- Unrated
- 105
- Now in CISA KEV
- 3
- Fix available
- 75
Most affected products
- Apple macOS
- 17
- ImageMagick
- 17
- Apple watchOS · Apple iOS and iPadOS +2
- 13
- Apple tvOS · Apple watchOS +2
- 7
- Apple watchOS · Apple iOS and iPadOS +1
- 6
- Apple iOS and iPadOS · Apple macOS
- 5
- Apple iOS and iPadOS
- 4
- Moodle · moodle/moodle
- 4
- Apple tvOS · Apple watchOS +1
- 2
- getkirby kirby · getkirby/panel +1
- 2
High 5
- CVE-2020-26249Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) VulnerabilityCog-Creators Red-Dashboard · red-dashboard
- CVE-2020-27930A memory corruption issue was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27932A type confusion issue was addressed with improved state handling.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-26233Remote Code Execution in Git Credential Manager Coremicrosoft Git-Credential-Manager-Core
- CVE-2020-26254omniauth-apple allows attacker to fake their email address during authenticationnhosoya omniauth-apple · omniauth-apple
Medium, low and unrated 111
- CVE-2020-26234Disabled Hostname Verification in OpenCastopencast · org.opencastproject:opencast-kernel
- CVE-2020-27755in SetImageExtent() of /MagickCore/image.c, an incorrect image depth size can cause a memory leak because the code which checks for the propImageMagick
- CVE-2020-27753There are several memory leaks in the MIFF coder in /coders/miff.c due to improper image depth values, which can be triggered by a speciallyImageMagick
- CVE-2020-27752A flaw was found in ImageMagick in MagickCore/quantum-private.h.ImageMagick
- CVE-2020-26256Denial of service in fast-csvC2FO fast-csv · fast-csv +1
- CVE-2020-27821A flaw was found in the memory management API of QEMU during the initialization of a memory region cache.QEMU
- CVE-2020-28274Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remdeepref
- CVE-2020-27918A use after free issue was addressed with improved memory management.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-9991This issue was addressed with improved checks.Apple tvOS · Apple watchOS +3
- CVE-2020-27896A path handling issue was addressed with improved validation.Apple macOS
- CVE-2020-25667TIFFGetProfiles() in /coders/tiff.c calls strstr() which causes a large out-of-bounds read when it searches for `"dc:format=\"image/dng\"` wImageMagick
- CVE-2020-25664In WriteOnePNGImage() of the PNG coder at coders/png.c, an improper call to AcquireVirtualMemory() and memset() allows for an out-of-bounds ImageMagick
- CVE-2020-25663A call to ConformPixelInfo() in the SetImageAlphaChannel() routine of /MagickCore/channel.c caused a subsequent heap-use-after-free or heap-ImageMagick
- CVE-2020-27950A memory initialization issue was addressed.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27929A logic issue existed in the handling of Group FaceTime calls.Apple iOS
- CVE-2020-27917A use after free issue was addressed with improved memory management.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27926A use after free issue was addressed with improved memory management.Apple iOS and iPadOS
- CVE-2020-27916An out-of-bounds write was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27927An out-of-bounds write issue was addressed with improved bounds checking.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27925An issue existed in the handling of incoming calls.Apple iOS and iPadOS
- CVE-2020-27911An integer overflow was addressed through improved input validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27912An out-of-bounds write was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27909An out-of-bounds read was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27910An out-of-bounds read was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27905A memory corruption issue was addressed with improved state management.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-27906Multiple integer overflows were addressed with improved input validation.Apple macOS
- CVE-2020-27902An authentication issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2020-27898A denial of service issue was addressed with improved state handling.Apple macOS
- CVE-2020-27904A logic issue existed resulting in memory corruption.Apple macOS
- CVE-2020-27903This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2020-27900An issue existed in the handling of snapshots.Apple macOS
- CVE-2020-10017An out-of-bounds write was addressed with improved input validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-27895An information disclosure issue existed in the transition of program state.Apple iTunes for Windows
- CVE-2020-27894The issue was addressed with additional user controls.Apple macOS
- CVE-2020-10014A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2020-10016A memory corruption issue was addressed with improved state management.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-10012An access issue was addressed with improved access restrictions.Apple macOS
- CVE-2020-10007A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-10011An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2020-10003An issue existed within the path validation logic for symlinks.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-10004A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2020-10013A logic issue was addressed with improved state management.Apple tvOS · Apple iOS and iPadOS
- CVE-2020-10010A path handling issue was addressed with improved validation.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-10009A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-9996A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS
- CVE-2020-10006This issue was addressed with improved entitlements.Apple macOS
- CVE-2020-9989The issue was addressed with improved deletion.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-9974A logic issue was addressed with improved state management.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-10002A logic issue was addressed with improved state management.Apple watchOS · Apple iOS and iPadOS +2
- CVE-2020-14207The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data fro
- CVE-2020-14206The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
- CVE-2020-14205The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization c
- CVE-2020-28946An improper webserver configuration on Plum IK-401 devices with firmware before 1.02 allows an attacker (with network access to the device)
- CVE-2020-9999A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2020-9993The issue was addressed with improved UI handling.Apple watchOS · Apple Safari +1
- CVE-2020-9965An out-of-bounds read was addressed with improved input validation.Apple tvOS · Apple watchOS +2
- CVE-2020-9969An access issue was addressed with additional sandbox restrictions.Apple tvOS · Apple watchOS +2
- CVE-2020-9987An inconsistent user interface issue was addressed with improved state management.Apple Safari
- CVE-2020-9988The issue was addressed with improved deletion.Apple iOS and iPadOS · Apple macOS
- CVE-2020-9981A use after free issue was addressed with improved memory management.Apple tvOS · Apple watchOS +1
- CVE-2020-9977A validation issue existed in the entitlement verification.Apple iOS and iPadOS · Apple macOS
- CVE-2020-9963The issue was addressed with improved handling of icon caches.Apple iOS and iPadOS · Apple macOS
- CVE-2020-9949A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2020-9972A buffer overflow issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2020-9943An out-of-bounds read was addressed with improved bounds checking.Apple tvOS · Apple watchOS +2
- CVE-2020-9947A use after free issue was addressed with improved memory management.Apple tvOS · Apple watchOS +4
- CVE-2020-9966An out-of-bounds read was addressed with improved input validation.Apple tvOS · Apple watchOS +2
- CVE-2020-9950A use after free issue was addressed with improved memory management.Apple tvOS · Apple watchOS +2
- CVE-2020-9954A buffer overflow issue was addressed with improved memory handling.Apple tvOS · Apple watchOS +1
- CVE-2020-9849An information disclosure issue was addressed with improved state management.Apple tvOS · Apple watchOS +2
- CVE-2020-9945A spoofing issue existed in the handling of URLs.Apple macOS
- CVE-2020-9944An out-of-bounds read was addressed with improved bounds checking.Apple tvOS · Apple watchOS +2
- CVE-2020-9922A logic issue was addressed with improved state management.Apple macOS
- CVE-2020-9942An inconsistent user interface issue was addressed with improved state management.Apple Safari · Apple macOS
- CVE-2020-1971EDIPARTYNAME NULL pointer dereferenceOpenSSL
- CVE-2020-29576The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user.
- CVE-2020-29564The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user.
- CVE-2020-29575The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-29577The official znc docker images before 1.7.1-slim contain a blank password for a root user.
- CVE-2020-29580The official storm Docker images before 1.2.1 contain a blank password for a root user.
- CVE-2020-29602The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-29601The official notary docker images before signer-0.6.1-1 contain a blank password for a root user.
- CVE-2020-29581The official spiped docker images before 1.5-alpine contain a blank password for a root user.
- CVE-2020-29579The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user.
- CVE-2020-29578The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-26255PHP Phar archives could be uploaded and executed in Kirbygetkirby kirby · getkirby/panel +1
- CVE-2020-25955SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS) via the 'add subjec
- CVE-2020-25889Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page.
- CVE-2020-29539A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor to have a remote au
- CVE-2020-29540API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Serv
- CVE-2020-26253.dev domains treated as local in Kirbygetkirby kirby · getkirby/panel +1
- CVE-2020-25628The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk.Moodle · moodle/moodle
- CVE-2020-25629A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain accessMoodle · moodle/moodle
- CVE-2020-25630A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping tMoodle · moodle/moodle
- CVE-2020-25631A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapMoodle · moodle/moodle
- CVE-2020-27822A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final.wildfly · org.wildfly:wildfly-parent
- CVE-2020-25692A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs.openldap
- CVE-2020-27818A flaw was found in the check_chunk_name() function of pngcheck-2.4.0.pngcheck
- CVE-2020-25677A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissions.ceph-ansible
- CVE-2020-17531Deserialization flaw in EOL Tapestry 4.Apache Software Foundation Apache Tapestry · org.apache.tap…
- CVE-2020-25665The PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine WritePALMImage() because it needs to be ofImageMagick
- CVE-2020-25666There are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is possible during simple math calculations.ImageMagick
- CVE-2020-25674WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit condition that can allow an out-of-bounds READ viaImageMagick
- CVE-2020-25675In the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding calculations performed on unconstrained pixel offsetsImageMagick
- CVE-2020-25676In CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and InterpolatePixelInfo(), which are all funcImageMagick
- CVE-2020-27750A flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h.ImageMagick
- CVE-2020-27751A flaw was found in ImageMagick in MagickCore/quantum-export.c.ImageMagick
- CVE-2020-27754In IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which could return overflowed values to the caller whImageMagick
- CVE-2020-27756In ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to divide-by-zero conditions which also lead tImageMagick
- CVE-2020-27757A floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could lead to undefined behavior in the form of a ImageMagick
- CVE-2020-27758A flaw was found in ImageMagick in coders/txt.c.ImageMagick