CVEs published December 15, 2020
129 CVEs were published on December 15, 2020: 0 critical, 4 high.
- Published
- 129
- Critical
- 0
- High
- 4
- Medium
- 12
- Low
- 0
- Unrated
- 113
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Android
- 68
- Google Asylo
- 10
- s-cart/core
- 2
- github.com/buger/jsonparser
- 1
- github.com/tidwall/gjson
- 1
- Host Engineering H0-ECOM100 Module · Host Engineering H2… +1
- 1
- IBM Sterling Connect:Direct for UNIX
- 1
- IBM Tivoli Netcool Impact
- 1
- js-data
- 1
- kernel
- 1
High 4
- CVE-2020-28456Cross-site Scripting (XSS)s-cart/core
- CVE-2020-28457Cross-site Scripting (XSS)s-cart/core
- CVE-2020-4747IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to imIBM Sterling Connect:Direct for UNIX
- CVE-2020-28442Prototype Pollutionjs-data
Medium, low and unrated 125
- CVE-2020-35193The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35469The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user.
- CVE-2020-35468The Appbase streams Docker image 2.1.2 contains a blank password for the root user.
- CVE-2020-35467The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user.
- CVE-2020-35466The Blackfire Docker image through 2020-12-14 contains a blank password for the root user.
- CVE-2020-35464Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user.
- CVE-2020-35463Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user.
- CVE-2020-35462Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user.
- CVE-2018-16243SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc,
- CVE-2020-29663Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring
- CVE-2020-35121An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence.
- CVE-2020-35122An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence.
- CVE-2020-35416Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (wit
- CVE-2020-28072A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0.
- CVE-2020-23957Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-T
- CVE-2020-35381jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.github.com/buger/jsonparser
- CVE-2020-35380GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.github.com/tidwall/gjson
- CVE-2020-25195The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when Host Engineering H0-ECOM100 Module · Host Engineering H2… +1
- CVE-2020-25759An issue was discovered on D-Link DSR-250 3.17 devices.
- CVE-2020-25758An issue was discovered on D-Link DSR-250 3.17 devices.
- CVE-2020-25757A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system co
- CVE-2020-14302A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endkeycloak
- CVE-2020-29486An issue was discovered in Xen through 4.14.x.
- CVE-2020-27147TIBCO PartnerExpress REST APITIBCO Software TIBCO PartnerExpress
- CVE-2020-29481An issue was discovered in Xen through 4.14.x.
- CVE-2020-29487An issue was discovered in Xen XAPI before 2020-12-15.
- CVE-2020-29485An issue was discovered in Xen 4.6 through 4.14.x.
- CVE-2020-29484An issue was discovered in Xen through 4.14.x.
- CVE-2020-29483An issue was discovered in Xen through 4.14.x.
- CVE-2020-29482An issue was discovered in Xen through 4.14.x.
- CVE-2020-29480An issue was discovered in Xen through 4.14.x.
- CVE-2020-29479An issue was discovered in Xen through 4.14.x.
- CVE-2020-29571An issue was discovered in Xen through 4.14.x.
- CVE-2020-29570An issue was discovered in Xen through 4.14.x.
- CVE-2020-29569An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x.
- CVE-2020-27777A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication.kernel
- CVE-2020-25712A flaw was found in xorg-x11-server before 1.20.10.xorg-x11-server
- CVE-2020-29568An issue was discovered in Xen through 4.14.x.
- CVE-2020-29567An issue was discovered in Xen 4.14.x.
- CVE-2020-29566An issue was discovered in Xen through 4.14.x.
- CVE-2020-27068Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernelAndroid
- CVE-2020-27067In the l2tp subsystem, there is a possible use after free due to a race condition.Android
- CVE-2020-27066In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking.Android
- CVE-2020-27057In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check.Android
- CVE-2020-27056In SELinux policies of mls, there is a missing permission check.Android
- CVE-2020-27055In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insecAndroid
- CVE-2020-27054In onFactoryReset of BluetoothManagerService.java, there is a missing permission check.Android
- CVE-2020-27053In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missing permission check.Android
- CVE-2020-27052In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a permissions bypass.Android
- CVE-2020-27051In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-27050In rw_i93_send_cmd_write_multi_blocks of rw_i93.cc, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-27049In rw_t3t_send_raw_frame of rw_t3t.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-27048In RW_SendRawFrame of rw_main.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-27047In ce_t4t_update_binary of ce_t4t.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27046In nfc_ncif_proc_ee_action of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27045In CE_SendRawFrame of ce_main.cc, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2020-27044In restartWrite of Parcel.cpp, there is a possible memory corruption due to a use after free.Android
- CVE-2020-27043In nfc_enabled of nfc_main.cc, there is a possible out of bounds read due to an incorrect increment.Android
- CVE-2020-27041In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent.Android
- CVE-2020-27040In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27039In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-27038In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak.Android
- CVE-2020-27037In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27036In phNxpNciHal_send_ext_cmd of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-27035In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking.Android
- CVE-2020-27034In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-27033In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27032In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check.Android
- CVE-2020-27031In nfc_data_event of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27030In onCreate of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy.Android
- CVE-2020-27029In TextView of TextView.java, there is a possible app hang due to improper input validation.Android
- CVE-2020-27028In filter_incoming_event of hci_layer.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27027In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27026During boot, the device unlock interface behaves differently depending on if a fingerprint registered to the device is present.Android
- CVE-2020-27025In EapFailureNotifier.java and SimRequiredNotifier.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-27024In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-27023In setErrorPlaybackState of BluetoothMediaBrowserService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-27021In avrc_ctrl_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0500In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2020-0499In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2020-0498In decode_packed_entry_number of codebook.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2020-0497In canUseBiometric of BiometricServiceBase, there is a missing permission check.Android
- CVE-2020-0496In CPDF_RenderStatus::LoadSMask of cpdf_renderstatus.cpp, there is a possible memory corruption due to a use-after free.Android
- CVE-2020-0495In decode_Huffman of JBig2_SddProc.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2020-0494In ih264d_parse_ave of ih264d_sei.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2020-0493In CPDF_SampledFunc::v_Call of cpdf_sampledfunc.cpp, there is a possible out of bounds read due to improper input validation.Android
- CVE-2020-0492In BitstreamFillCache of bitstream.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2020-0491In readBlock of MatroskaExtractor.cpp, there is a possible denial of service due to resource exhaustion.Android
- CVE-2020-0490In floor1_info_unpack of floor1.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0489In Parse_data of eas_mdls.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0488In ihevc_inter_pred_chroma_copy_ssse3 of ihevc_inter_pred_filters_ssse3_intr.c, there is a possible information disclosure due to uninitialiAndroid
- CVE-2020-0486In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value.Android
- CVE-2020-0485In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check.Android
- CVE-2020-0484In destroyResources of ComposerClient.h, there is possible memory corruption due to a use after free.Android
- CVE-2020-0483In DrmManagerService::~DrmManagerService() of DrmManagerService.cpp, there is a possible memory corruption due to a use after free.Android
- CVE-2020-0482In command of IncidentService.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2020-0481In AndroidManifest.xml, there is a possible permissions bypass.Android
- CVE-2020-0480In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check.Android
- CVE-2020-0479In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass.Android
- CVE-2020-0478In extend_frame_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2020-0477In sendLinkConfigurationChangedBroadcast of ClientModeImpl.java, there is a possible information disclosure due to a missing permission checAndroid
- CVE-2020-0476In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs.Android
- CVE-2020-0475In createInputConsumer of WindowManagerService.java, there is a possible way to block and intercept input events due to a missing permissionAndroid
- CVE-2020-0474In HalCamera::requestNewFrame of HalCamera.cpp, there is a possible use-after-free due to a race condition.Android
- CVE-2020-0473In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass.Android
- CVE-2020-0368In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation.Android
- CVE-2020-0280In nci_proc_ee_management_rsp of nci_hrcv.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2020-0244In writeBurstBufferBytes of SPDIFEncoder.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2020-35396EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php.
- CVE-2020-35395XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScrip
- CVE-2020-8944Unchecked buffer overrun in ecall_restoreGoogle Asylo
- CVE-2020-8942Unchecked buffer overrun in enc_untrusted_readGoogle Asylo
- CVE-2020-8943Unchecked buffer overrun in enc_untrusted_recvfromGoogle Asylo
- CVE-2020-8941Unchecked buffer overrun in enc_untrusted_inet_ptonGoogle Asylo
- CVE-2020-8940Unchecked buffer overrun in enc_untrusted_recvmsgGoogle Asylo
- CVE-2020-8938Arbitrary enclave memory location write from untrusted environmentGoogle Asylo
- CVE-2020-8939Out of Bounds read in AsyloGoogle Asylo
- CVE-2020-8937Arbitrary enclave memory location write from untrusted environmentGoogle Asylo
- CVE-2020-8936Arbitrary enclave memory overwrite vulnerability in ECall ecall_restoreGoogle Asylo
- CVE-2020-8935An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall_restore function call to realloGoogle Asylo
- CVE-2020-4849IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a IBM Tivoli Netcool Impact
- CVE-2020-28203An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier.
- CVE-2020-35470Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the p
- CVE-2020-35471Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 15
- CVE-2020-10770A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter keycloak · org.keycloak:keycloak-core