# CVEs published 2020-12-09

130 CVEs were published on December 9, 2020: 5 critical, 47 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-17156](https://cve.now/CVE-2020-17156.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2020-17158](https://cve.now/CVE-2020-17158.md): Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 for Finance and Operations)
- [CVE-2020-17159](https://cve.now/CVE-2020-17159.md): Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code Language Support for Java Exte…)
- [CVE-2020-17152](https://cve.now/CVE-2020-17152.md): Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 for Finance and Operations)
- [CVE-2020-17153](https://cve.now/CVE-2020-17153.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2020-17148](https://cve.now/CVE-2020-17148.md): Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code Remote - SSH Extension)
- [CVE-2020-17150](https://cve.now/CVE-2020-17150.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code TS-Lint Extension)
- [CVE-2020-17145](https://cve.now/CVE-2020-17145.md): Azure DevOps Server and Team Foundation Services Spoofing Vulnerability (CVSS 5.4, Microsoft Azure DevOps Server 2019 Update · Microsoft Az… +3)
- [CVE-2020-17147](https://cve.now/CVE-2020-17147.md): Dynamics CRM Webclient Cross-site Scripting Vulnerability (CVSS 8.7, Microsoft Dynamics 365 (on-premises))
- [CVE-2020-17142](https://cve.now/CVE-2020-17142.md): Microsoft Exchange Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2020-17143](https://cve.now/CVE-2020-17143.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 8.8, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2020-17144](https://cve.now/CVE-2020-17144.md): Microsoft Exchange Remote Code Execution Vulnerability (CVSS 8.4, KEV, Microsoft Exchange Server 2010 Service Pack 3 Update Rollup)
- [CVE-2020-17140](https://cve.now/CVE-2020-17140.md): Windows SMB Information Disclosure Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2020-17141](https://cve.now/CVE-2020-17141.md): Microsoft Exchange Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2020-17138](https://cve.now/CVE-2020-17138.md): Windows Error Reporting Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2020-17139](https://cve.now/CVE-2020-17139.md): Windows Overlay Filter Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-17136](https://cve.now/CVE-2020-17136.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-17137](https://cve.now/CVE-2020-17137.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-17133](https://cve.now/CVE-2020-17133.md): Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics NAV)
- [CVE-2020-17134](https://cve.now/CVE-2020-17134.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-17135](https://cve.now/CVE-2020-17135.md): Azure DevOps Server Spoofing Vulnerability (CVSS 6.4, Microsoft Azure DevOps Server 2019 Update · Microsoft Azure…)
- [CVE-2020-17131](https://cve.now/CVE-2020-17131.md): Chakra Scripting Engine Memory Corruption Vulnerability (CVSS 4.2, Microsoft ChakraCore · Microsoft Edge +1)
- [CVE-2020-17132](https://cve.now/CVE-2020-17132.md): Microsoft Exchange Remote Code Execution Vulnerability (CVSS 9.1, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2020-17129](https://cve.now/CVE-2020-17129.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +3)
- [CVE-2020-17130](https://cve.now/CVE-2020-17130.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft 365 Apps for Enterprise · Microsoft Excel)
- [CVE-2020-17127](https://cve.now/CVE-2020-17127.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel 2010 Service Pack)
- [CVE-2020-17128](https://cve.now/CVE-2020-17128.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +4)
- [CVE-2020-17124](https://cve.now/CVE-2020-17124.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2020-17125](https://cve.now/CVE-2020-17125.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +3)
- [CVE-2020-17126](https://cve.now/CVE-2020-17126.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +3)
- [CVE-2020-17122](https://cve.now/CVE-2020-17122.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2010 Service Pack · Microsoft Office We… +1)
- [CVE-2020-17123](https://cve.now/CVE-2020-17123.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2010… +3)
- [CVE-2020-17120](https://cve.now/CVE-2020-17120.md): Microsoft SharePoint Information Disclosure Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-17121](https://cve.now/CVE-2020-17121.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-17118](https://cve.now/CVE-2020-17118.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-17119](https://cve.now/CVE-2020-17119.md): Microsoft Outlook Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3)
- [CVE-2020-17115](https://cve.now/CVE-2020-17115.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-17117](https://cve.now/CVE-2020-17117.md): Microsoft Exchange Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2020-17099](https://cve.now/CVE-2020-17099.md): Windows Lock Screen Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2020-17103](https://cve.now/CVE-2020-17103.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2020-17096](https://cve.now/CVE-2020-17096.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2020-17097](https://cve.now/CVE-2020-17097.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2020-17098](https://cve.now/CVE-2020-17098.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2020-17094](https://cve.now/CVE-2020-17094.md): Windows Error Reporting Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2020-17095](https://cve.now/CVE-2020-17095.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.5, Microsoft Windows)
- [CVE-2020-17089](https://cve.now/CVE-2020-17089.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2020-17092](https://cve.now/CVE-2020-17092.md): Windows Network Connections Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16996](https://cve.now/CVE-2020-16996.md): Kerberos Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows Server · Microsoft Windows Server,)
- [CVE-2020-17002](https://cve.now/CVE-2020-17002.md): Azure SDK for C Security Feature Bypass Vulnerability (CVSS 7.4, Microsoft azure-c-shared-utility · Microsoft azure-uamqp… +4)
- [CVE-2020-16964](https://cve.now/CVE-2020-16964.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16971](https://cve.now/CVE-2020-16971.md): Azure SDK for Java Security Feature Bypass Vulnerability (CVSS 7.4, Microsoft Azure SDK · com.microsoft.azure:azure-eventhubs +1)
- [CVE-2020-16961](https://cve.now/CVE-2020-16961.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16962](https://cve.now/CVE-2020-16962.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16963](https://cve.now/CVE-2020-16963.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16959](https://cve.now/CVE-2020-16959.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16960](https://cve.now/CVE-2020-16960.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-16958](https://cve.now/CVE-2020-16958.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2020-7339](https://cve.now/CVE-2020-7339.md): Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm (CVSS 6.3, McAfee Database Security)
- [CVE-2020-10143](https://cve.now/CVE-2020-10143.md): Macrium Reflect includes an OpenSSL component that specifies an OPENSSLDIR variable as C:\\openssl\\. (CVSS 7.8, Macrium Reflect)
- [CVE-2020-29259](https://cve.now/CVE-2020-29259.md): Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php. (no CVSS)
- [CVE-2020-29258](https://cve.now/CVE-2020-29258.md): Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php. (no CVSS)
- [CVE-2020-29257](https://cve.now/CVE-2020-29257.md): Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php. (no CVSS)
- [CVE-2020-16600](https://cve.now/CVE-2020-16600.md): A Use After Free vulnerability exists in Artifex Software, Inc. (no CVSS)
- [CVE-2020-16599](https://cve.now/CVE-2020-16599.md): A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.3 (no CVSS)
- [CVE-2020-16593](https://cve.now/CVE-2020-16593.md): A Null Pointer Dereference vulnerability exists in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.3 (no CVSS)
- [CVE-2020-16592](https://cve.now/CVE-2020-16592.md): A use after free issue exists in the Binary File Descriptor (BFD) library (aka libbfd) in GNU Binutils 2.34 in bfd\_hash\_lookup, as demonstra (no CVSS)
- [CVE-2020-16591](https://cve.now/CVE-2020-16591.md): A Denial of Service vulnerability exists in the Binary File Descriptor (BFD) in GNU Binutils 2.35 due to an invalid read in process\_symbol\_t (no CVSS)
- [CVE-2020-16590](https://cve.now/CVE-2020-16590.md): A double free vulnerability exists in the Binary File Descriptor (BFD) (aka libbrd) in GNU Binutils 2.35 in the process\_symbol\_table, as dem (no CVSS)
- [CVE-2020-25499](https://cve.now/CVE-2020-25499.md): TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. (no CVSS)
- [CVE-2020-26257](https://cve.now/CVE-2020-26257.md): Denial of service attack via incorrect parameters to federation APIs (CVSS 6.5, matrix-org synapse · matrix-synapse)
- [CVE-2020-28086](https://cve.now/CVE-2020-28086.md): pass through 1.7.3 has a possibility of using a password for an unintended resource. (no CVSS)
- [CVE-2020-2049](https://cve.now/CVE-2020-2049.md): Cortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation (CVSS 7.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2020-2020](https://cve.now/CVE-2020-2020.md): Cortex XDR Agent: Exceptional condition denial-of-service (DoS) (CVSS 5.5, Palo Alto Networks Cortex XDR Agent)
- [CVE-2020-29660](https://cve.now/CVE-2020-29660.md): A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. (no CVSS)
- [CVE-2020-29661](https://cve.now/CVE-2020-29661.md): A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. (no CVSS)
- [CVE-2020-7776](https://cve.now/CVE-2020-7776.md): Cross-site Scripting (XSS) (CVSS 7.1, phpoffice/phpspreadsheet · phpoffice/phpexcel)
- [CVE-2020-7787](https://cve.now/CVE-2020-7787.md): Improper Authentication (CVSS 8.2, react-adal)
- [CVE-2020-17529](https://cve.now/CVE-2020-17529.md): Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header (no CVSS, Apache Software Foundation Apache NuttX)
- [CVE-2020-17528](https://cve.now/CVE-2020-17528.md): Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length (no CVSS, Apache Software Foundation Apache NuttX)
- [CVE-2020-26836](https://cve.now/CVE-2020-26836.md): SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulne (CVSS 3.4, SAP SE SAP Solution Manager)
- [CVE-2020-26837](https://cve.now/CVE-2020-26837.md): SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious script that can exp (CVSS 8.5, SAP SE SAP Solution Manager)
- [CVE-2020-26838](https://cve.now/CVE-2020-26838.md): SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows a (CVSS 9.1, SAP SE SAP Business Warehouse · SAP SE SAP BW4HANA)
- [CVE-2020-26832](https://cve.now/CVE-2020-26832.md): SAP AS ABAP (SAP Landscape Transformation), versions - 2011\_1\_620, 2011\_1\_640, 2011\_1\_700, 2011\_1\_710, 2011\_1\_730, 2011\_1\_731, 2011\_1\_752, 2 (CVSS 7.6, SAP SE SAP NetWeaver AS ABAP · SAP SE SAP S4 HANA)
- [CVE-2020-26835](https://cve.now/CVE-2020-26835.md): SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input maliciou (CVSS 5.3, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2020-26834](https://cve.now/CVE-2020-26834.md): SAP HANA Database, version - 2.0, does not correctly validate the username when performing SAML bearer token-based user authentication. (CVSS 4.2, SAP SE SAP HANA Database)
- [CVE-2020-26826](https://cve.now/CVE-2020-26826.md): Process Integration Monitoring of SAP NetWeaver AS JAVA, versions - 7.31, 7.40, 7.50, allows an attacker to upload any file (including scrip (CVSS 6.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-26828](https://cve.now/CVE-2020-26828.md): SAP Disclosure Management, version - 10.1, provides capabilities for authorized users to upload and download content of specific file type. (CVSS 5.4, SAP SE SAP Disclosure Management.)
- [CVE-2020-26261](https://cve.now/CVE-2020-26261.md): user-readable api tokens in systemd units (CVSS 7.9, jupyterhub systemdspawner · jupyterhub-systemdspawner)
- [CVE-2020-26831](https://cve.now/CVE-2020-26831.md): SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML entities during crys (CVSS 9.6, SAP SE SAP BusinessObjects BI Platform)
- [CVE-2020-26830](https://cve.now/CVE-2020-26830.md): SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, does not perform necessary authorization checks for an authenticated u (CVSS 7.6, SAP SE SAP Solution Manager)
- [CVE-2020-26829](https://cve.now/CVE-2020-26829.md): SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary connections from processe (CVSS 10.0, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-26816](https://cve.now/CVE-2020-26816.md): SAP AS JAVA (Key Storage Service), versions - 7.10, 7.11, 7.20 ,7.30, 7.31, 7.40, 7.50, has the key material which is stored in the SAP NetW (CVSS 5.4, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2020-26260](https://cve.now/CVE-2020-26260.md): Server Side Request Forgery in BookStack (CVSS 6.4, BookStackApp BookStack)
- [CVE-2020-29659](https://cve.now/CVE-2020-29659.md): A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execute code as SYSTEM by (no CVSS)
- [CVE-2020-25199](https://cve.now/CVE-2020-25199.md): A heap-based buffer overflow vulnerability exists within the WECON LeviStudioU Release Build 2019-09-21 and prior when processing project fi (no CVSS, WECON Technology Co., Ltd LeviStudioU)
- [CVE-2020-23520](https://cve.now/CVE-2020-23520.md): imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality. (no CVSS)
- [CVE-2020-7337](https://cve.now/CVE-2020-7337.md): Incorrect Permission Assignment for Critical Resource (CVSS 6.5, McAfee VirusScan Enterprise)
- [CVE-2020-29657](https://cve.now/CVE-2020-29657.md): In JerryScript 2.3.0, there is an out-of-bounds read in main\_print\_unhandled\_exception in the main-utils.c file. (no CVSS)
- [CVE-2020-29655](https://cve.now/CVE-2020-29655.md): An injection vulnerability exists in RT-AC88U Download Master before 3.1.0.108. (no CVSS)
- [CVE-2020-29656](https://cve.now/CVE-2020-29656.md): An information disclosure vulnerability exists in RT-AC88U Download Master before 3.1.0.108. (no CVSS)
- [CVE-2020-29651](https://cve.now/CVE-2020-29651.md): A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to (no CVSS, py)
- [CVE-2020-27349](https://cve.now/CVE-2020-27349.md): aptdaemon performed policykit permissions checks too late (no CVSS, Canonical aptdaemon)
- [CVE-2020-16128](https://cve.now/CVE-2020-16128.md): Aptdaemon error messages disclosed file existence to unprivileged users via dbus properties (CVSS 3.8, Canonical aptdaemon)
- [CVE-2020-10146](https://cve.now/CVE-2020-10146.md): Microsoft Teams displayName stored cross-site scripting vulnerability (CVSS 5.7, Microsoft Teams)
- [CVE-2020-26970](https://cve.now/CVE-2020-26970.md): When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one b (no CVSS, Mozilla Thunderbird)
- [CVE-2020-26969](https://cve.now/CVE-2020-26969.md): Mozilla developers reported memory safety bugs present in Firefox 82. (no CVSS, Mozilla Firefox)
- [CVE-2020-26968](https://cve.now/CVE-2020-26968.md): Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26967](https://cve.now/CVE-2020-26967.md): When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with eleme (no CVSS, Mozilla Firefox)
- [CVE-2020-26966](https://cve.now/CVE-2020-26966.md): Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26965](https://cve.now/CVE-2020-26965.md): Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26964](https://cve.now/CVE-2020-26964.md): If the Remote Debugging via USB feature was enabled in Firefox for Android on an Android version prior to Android 6.0, untrusted apps could (no CVSS, Mozilla Firefox)
- [CVE-2020-26963](https://cve.now/CVE-2020-26963.md): Repeated calls to the history and location interfaces could have been used to hang the browser. (no CVSS, Mozilla Firefox)
- [CVE-2020-26962](https://cve.now/CVE-2020-26962.md): Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. (no CVSS, Mozilla Firefox)
- [CVE-2020-26961](https://cve.now/CVE-2020-26961.md): When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming f (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26960](https://cve.now/CVE-2020-26960.md): If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a poten (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26959](https://cve.now/CVE-2020-26959.md): During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corru (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26958](https://cve.now/CVE-2020-26958.md): Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26957](https://cve.now/CVE-2020-26957.md): OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. (no CVSS, Mozilla Firefox)
- [CVE-2020-26956](https://cve.now/CVE-2020-26956.md): In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26955](https://cve.now/CVE-2020-26955.md): When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download opera (no CVSS, Mozilla Firefox)
- [CVE-2020-26954](https://cve.now/CVE-2020-26954.md): When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de (no CVSS, Mozilla Firefox)
- [CVE-2020-26953](https://cve.now/CVE-2020-26953.md): It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phish (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26952](https://cve.now/CVE-2020-26952.md): Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially exploitable crash wh (no CVSS, Mozilla Firefox)
- [CVE-2020-26951](https://cve.now/CVE-2020-26951.md): A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-26950](https://cve.now/CVE-2020-26950.md): In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condi (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-25627](https://cve.now/CVE-2020-25627.md): The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. (no CVSS, Moodle · moodle/moodle)
- [CVE-2020-27614](https://cve.now/CVE-2020-27614.md): AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and all (no CVSS)
- [CVE-2020-16587](https://cve.now/CVE-2020-16587.md): A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartI (no CVSS)
- [CVE-2020-16588](https://cve.now/CVE-2020-16588.md): A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a de (no CVSS)
- [CVE-2020-16589](https://cve.now/CVE-2020-16589.md): A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.