# CVEs published 2020-12-10 37 CVEs were published on December 10, 2020: 1 critical, 2 high. Days are UTC. - [CVE-2020-4829](https://cve.now/CVE-2020-4829.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. (CVSS 8.4, IBM VIOS · IBM AIX) - [CVE-2019-4738](https://cve.now/CVE-2019-4738.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1 discloses sensitive information to an authe (CVSS 4.3, IBM Sterling B2B Integrator) - [CVE-2020-8908](https://cve.now/CVE-2020-8908.md): Temp directory permission issue in Guava (CVSS 3.3, Google Guava · com.google.guava:guava) - [CVE-2020-26266](https://cve.now/CVE-2020-26266.md): Uninitialized memory access in Eigen types in TensorFlow (CVSS 4.4, tensorflow · tensorflow-gpu +1) - [CVE-2020-26267](https://cve.now/CVE-2020-26267.md): Lack of validation in data format attributes in TensorFlow (CVSS 4.4, tensorflow · tensorflow-cpu +1) - [CVE-2020-26268](https://cve.now/CVE-2020-26268.md): Write to immutable memory region in TensorFlow (CVSS 4.4, tensorflow · tensorflow-gpu +1) - [CVE-2020-26269](https://cve.now/CVE-2020-26269.md): Heap out of bounds read in filesystem glob matching in TensorFlow (no CVSS, tensorflow · tensorflow-gpu +1) - [CVE-2020-26270](https://cve.now/CVE-2020-26270.md): CHECK-fail in LSTM with zero-length input in TensorFlow (CVSS 4.4, tensorflow · tensorflow-cpu +1) - [CVE-2020-26271](https://cve.now/CVE-2020-26271.md): Heap out of bounds access in MakeEdge in TensorFlow (CVSS 4.4, tensorflow · tensorflow-cpu +1) - [CVE-2020-29311](https://cve.now/CVE-2020-29311.md): Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and be (no CVSS) - [CVE-2020-13526](https://cve.now/CVE-2020-13526.md): SQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. (CVSS 6.4, ProcessMaker) - [CVE-2020-16608](https://cve.now/CVE-2020-16608.md): Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in webPreferences is true) (no CVSS) - [CVE-2020-25967](https://cve.now/CVE-2020-25967.md): The member center function in fastadmin V1.0.0.20200506\_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. (no CVSS) - [CVE-2020-19142](https://cve.now/CVE-2020-19142.md): iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB\_PREFIX parameter to install/install.php. (no CVSS) - [CVE-2020-19527](https://cve.now/CVE-2020-19527.md): iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB\_NAME parameter to install/install.php. (no CVSS) - [CVE-2020-26201](https://cve.now/CVE-2020-26201.md): Askey AP5100W\_Dual\_SIG\_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. (no CVSS) - [CVE-2020-8920](https://cve.now/CVE-2020-8920.md): Overoptimization leads to private information leak in Gerrit (CVSS 3.5, Gerrit · com.google.gerrit:gerrit-plugin-api) - [CVE-2020-8919](https://cve.now/CVE-2020-8919.md): Information leakage in Gerrit (CVSS 3.5, Gerrit) - [CVE-2020-29667](https://cve.now/CVE-2020-29667.md): In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, ca (no CVSS) - [CVE-2020-29666](https://cve.now/CVE-2020-29666.md): In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in (no CVSS) - [CVE-2020-29668](https://cve.now/CVE-2020-29668.md): Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired co (no CVSS) - [CVE-2020-24444](https://cve.now/CVE-2020-24444.md): Blind SSRF in Forms add-on for AEM (CVSS 5.8, Adobe Experience Manager) - [CVE-2020-24445](https://cve.now/CVE-2020-24445.md): Cross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM) (CVSS 9.0, Adobe Systems Incorporated Experience Manager) - [CVE-2020-12595](https://cve.now/CVE-2020-12595.md): An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server (no CVSS, Symantec Messaging Gateway) - [CVE-2020-12594](https://cve.now/CVE-2020-12594.md): A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full (no CVSS, Symantec Messaging Gateway) - [CVE-2020-26407](https://cve.now/CVE-2020-26407.md): A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to pe (CVSS 5.5, Gitlab CE/EE) - [CVE-2020-27351](https://cve.now/CVE-2020-27351.md): Various memory and file descriptor leaks in apt-python (CVSS 2.0, Canonical python-apt) - [CVE-2020-27350](https://cve.now/CVE-2020-27350.md): apt integer wraparound (CVSS 5.7, Canonical apt) - [CVE-2020-2498](https://cve.now/CVE-2020-2498.md): Cross-site scripting vulnerability in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero) - [CVE-2020-2497](https://cve.now/CVE-2020-2497.md): Cross-site scripting vulnerability in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero) - [CVE-2020-2496](https://cve.now/CVE-2020-2496.md): Cross-site scripting vulnerability in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero) - [CVE-2020-2495](https://cve.now/CVE-2020-2495.md): Cross-site scripting vulnerability in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero) - [CVE-2020-2494](https://cve.now/CVE-2020-2494.md): Cross-site Scripting Vulnerability in Music Station (no CVSS, QNAP Systems Music Station) - [CVE-2020-2493](https://cve.now/CVE-2020-2493.md): Cross-site Scripting Vulnerability in Multimedia Console (no CVSS, QNAP Systems Multimedia Console) - [CVE-2019-7198](https://cve.now/CVE-2019-7198.md): Command Injection Vulnerability in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero) - [CVE-2020-2491](https://cve.now/CVE-2020-2491.md): Cross-site Scripting Vulnerability in Photo Station (no CVSS, QNAP Systems Photo Station) - [CVE-2020-12516](https://cve.now/CVE-2020-12516.md): WAGO: PLC families 750-88x and 750-352 prone to DoS attack (CVSS 7.5, WAGO 750-331/xxx-xxx · WAGO 750-352 +8) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.