CVEs published December 10, 2020
37 CVEs were published on December 10, 2020: 1 critical, 2 high.
- Published
- 37
- Critical
- 1
- High
- 2
- Medium
- 10
- Low
- 4
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- QNAP Systems QTS · QNAP Systems QuTS hero
- 5
- tensorflow · tensorflow-cpu +1
- 3
- tensorflow · tensorflow-gpu +1
- 3
- Symantec Messaging Gateway
- 2
- Adobe Experience Manager
- 1
- Adobe Systems Incorporated Experience Manager
- 1
- Canonical apt
- 1
- Canonical python-apt
- 1
- Gerrit
- 1
- Gerrit · com.google.gerrit:gerrit-plugin-api
- 1
Critical 1
High 2
Medium, low and unrated 34
- CVE-2019-4738IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an autheIBM Sterling B2B Integrator
- CVE-2020-8908Temp directory permission issue in GuavaGoogle Guava · com.google.guava:guava
- CVE-2020-26266Uninitialized memory access in Eigen types in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2020-26267Lack of validation in data format attributes in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2020-26268Write to immutable memory region in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2020-26269Heap out of bounds read in filesystem glob matching in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2020-26270CHECK-fail in LSTM with zero-length input in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2020-26271Heap out of bounds access in MakeEdge in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2020-29311Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and be
- CVE-2020-13526SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11.ProcessMaker
- CVE-2020-16608Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true)
- CVE-2020-25967The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability.
- CVE-2020-19142iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php.
- CVE-2020-19527iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php.
- CVE-2020-26201Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level.
- CVE-2020-8920Overoptimization leads to private information leak in GerritGerrit · com.google.gerrit:gerrit-plugin-api
- CVE-2020-8919Information leakage in GerritGerrit
- CVE-2020-29667In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, ca
- CVE-2020-29666In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in
- CVE-2020-29668Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired co
- CVE-2020-24444Blind SSRF in Forms add-on for AEMAdobe Experience Manager
- CVE-2020-12595An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup serverSymantec Messaging Gateway
- CVE-2020-12594A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full Symantec Messaging Gateway
- CVE-2020-26407A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to peGitlab CE/EE
- CVE-2020-27351Various memory and file descriptor leaks in apt-pythonCanonical python-apt
- CVE-2020-27350apt integer wraparoundCanonical apt
- CVE-2020-2498Cross-site scripting vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-2497Cross-site scripting vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-2496Cross-site scripting vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-2495Cross-site scripting vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-2494Cross-site Scripting Vulnerability in Music StationQNAP Systems Music Station
- CVE-2020-2493Cross-site Scripting Vulnerability in Multimedia ConsoleQNAP Systems Multimedia Console
- CVE-2019-7198Command Injection Vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-2491Cross-site Scripting Vulnerability in Photo StationQNAP Systems Photo Station