# CVEs published 2020-12-15

129 CVEs were published on December 15, 2020: 0 critical, 4 high. Days are UTC.

- [CVE-2020-35193](https://cve.now/CVE-2020-35193.md): The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. (no CVSS)
- [CVE-2020-35469](https://cve.now/CVE-2020-35469.md): The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. (no CVSS)
- [CVE-2020-35468](https://cve.now/CVE-2020-35468.md): The Appbase streams Docker image 2.1.2 contains a blank password for the root user. (no CVSS)
- [CVE-2020-35467](https://cve.now/CVE-2020-35467.md): The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. (no CVSS)
- [CVE-2020-35466](https://cve.now/CVE-2020-35466.md): The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. (no CVSS)
- [CVE-2020-35464](https://cve.now/CVE-2020-35464.md): Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. (no CVSS)
- [CVE-2020-35463](https://cve.now/CVE-2020-35463.md): Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. (no CVSS)
- [CVE-2020-35462](https://cve.now/CVE-2020-35462.md): Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. (no CVSS)
- [CVE-2018-16243](https://cve.now/CVE-2018-16243.md): SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, (no CVSS)
- [CVE-2020-29663](https://cve.now/CVE-2020-29663.md): Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring (no CVSS)
- [CVE-2020-35121](https://cve.now/CVE-2020-35121.md): An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. (no CVSS)
- [CVE-2020-35122](https://cve.now/CVE-2020-35122.md): An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. (no CVSS)
- [CVE-2020-35416](https://cve.now/CVE-2020-35416.md): Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (wit (no CVSS)
- [CVE-2020-28072](https://cve.now/CVE-2020-28072.md): A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. (no CVSS)
- [CVE-2020-23957](https://cve.now/CVE-2020-23957.md): Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-T (no CVSS)
- [CVE-2020-35381](https://cve.now/CVE-2020-35381.md): jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call. (no CVSS, github.com/buger/jsonparser)
- [CVE-2020-35380](https://cve.now/CVE-2020-35380.md): GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON. (no CVSS, github.com/tidwall/gjson)
- [CVE-2020-25195](https://cve.now/CVE-2020-25195.md): The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when (no CVSS, Host Engineering H0-ECOM100 Module · Host Engineering H2… +1)
- [CVE-2020-25759](https://cve.now/CVE-2020-25759.md): An issue was discovered on D-Link DSR-250 3.17 devices. (no CVSS)
- [CVE-2020-25758](https://cve.now/CVE-2020-25758.md): An issue was discovered on D-Link DSR-250 3.17 devices. (no CVSS)
- [CVE-2020-25757](https://cve.now/CVE-2020-25757.md): A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system co (no CVSS)
- [CVE-2020-14302](https://cve.now/CVE-2020-14302.md): A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak end (no CVSS, keycloak)
- [CVE-2020-29486](https://cve.now/CVE-2020-29486.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-27147](https://cve.now/CVE-2020-27147.md): TIBCO PartnerExpress REST API (CVSS 6.5, TIBCO Software TIBCO PartnerExpress)
- [CVE-2020-29481](https://cve.now/CVE-2020-29481.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29487](https://cve.now/CVE-2020-29487.md): An issue was discovered in Xen XAPI before 2020-12-15. (no CVSS)
- [CVE-2020-29485](https://cve.now/CVE-2020-29485.md): An issue was discovered in Xen 4.6 through 4.14.x. (no CVSS)
- [CVE-2020-29484](https://cve.now/CVE-2020-29484.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29483](https://cve.now/CVE-2020-29483.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29482](https://cve.now/CVE-2020-29482.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29480](https://cve.now/CVE-2020-29480.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29479](https://cve.now/CVE-2020-29479.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29571](https://cve.now/CVE-2020-29571.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29570](https://cve.now/CVE-2020-29570.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29569](https://cve.now/CVE-2020-29569.md): An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. (no CVSS)
- [CVE-2020-27777](https://cve.now/CVE-2020-27777.md): A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. (no CVSS, kernel)
- [CVE-2020-25712](https://cve.now/CVE-2020-25712.md): A flaw was found in xorg-x11-server before 1.20.10. (no CVSS, xorg-x11-server)
- [CVE-2020-29568](https://cve.now/CVE-2020-29568.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-29567](https://cve.now/CVE-2020-29567.md): An issue was discovered in Xen 4.14.x. (no CVSS)
- [CVE-2020-29566](https://cve.now/CVE-2020-29566.md): An issue was discovered in Xen through 4.14.x. (no CVSS)
- [CVE-2020-27068](https://cve.now/CVE-2020-27068.md): Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel (no CVSS, Android)
- [CVE-2020-27067](https://cve.now/CVE-2020-27067.md): In the l2tp subsystem, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2020-27066](https://cve.now/CVE-2020-27066.md): In xfrm6\_tunnel\_free\_spi of net/ipv6/xfrm6\_tunnel.c, there is a possible use after free due to improper locking. (no CVSS, Android)
- [CVE-2020-27057](https://cve.now/CVE-2020-27057.md): In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-27056](https://cve.now/CVE-2020-27056.md): In SELinux policies of mls, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-27055](https://cve.now/CVE-2020-27055.md): In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insec (no CVSS, Android)
- [CVE-2020-27054](https://cve.now/CVE-2020-27054.md): In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-27053](https://cve.now/CVE-2020-27053.md): In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-27052](https://cve.now/CVE-2020-27052.md): In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a permissions bypass. (no CVSS, Android)
- [CVE-2020-27051](https://cve.now/CVE-2020-27051.md): In NFA\_RwI93WriteMultipleBlocks of nfa\_rw\_api.cc, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-27050](https://cve.now/CVE-2020-27050.md): In rw\_i93\_send\_cmd\_write\_multi\_blocks of rw\_i93.cc, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-27049](https://cve.now/CVE-2020-27049.md): In rw\_t3t\_send\_raw\_frame of rw\_t3t.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27048](https://cve.now/CVE-2020-27048.md): In RW\_SendRawFrame of rw\_main.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27047](https://cve.now/CVE-2020-27047.md): In ce\_t4t\_update\_binary of ce\_t4t.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27046](https://cve.now/CVE-2020-27046.md): In nfc\_ncif\_proc\_ee\_action of nfc\_ncif.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27045](https://cve.now/CVE-2020-27045.md): In CE\_SendRawFrame of ce\_main.cc, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-27044](https://cve.now/CVE-2020-27044.md): In restartWrite of Parcel.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-27043](https://cve.now/CVE-2020-27043.md): In nfc\_enabled of nfc\_main.cc, there is a possible out of bounds read due to an incorrect increment. (no CVSS, Android)
- [CVE-2020-27041](https://cve.now/CVE-2020-27041.md): In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-27040](https://cve.now/CVE-2020-27040.md): In phNxpNciHal\_core\_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27039](https://cve.now/CVE-2020-27039.md): In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-27038](https://cve.now/CVE-2020-27038.md): In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak. (no CVSS, Android)
- [CVE-2020-27037](https://cve.now/CVE-2020-27037.md): In phNxpNciHal\_core\_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27036](https://cve.now/CVE-2020-27036.md): In phNxpNciHal\_send\_ext\_cmd of phNxpNciHal\_ext.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27035](https://cve.now/CVE-2020-27035.md): In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2020-27034](https://cve.now/CVE-2020-27034.md): In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-27033](https://cve.now/CVE-2020-27033.md): In nfc\_ncif\_proc\_get\_routing of nfc\_ncif.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27032](https://cve.now/CVE-2020-27032.md): In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check. (no CVSS, Android)
- [CVE-2020-27031](https://cve.now/CVE-2020-27031.md): In nfc\_data\_event of nfc\_ncif.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27030](https://cve.now/CVE-2020-27030.md): In onCreate of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2020-27029](https://cve.now/CVE-2020-27029.md): In TextView of TextView.java, there is a possible app hang due to improper input validation. (no CVSS, Android)
- [CVE-2020-27028](https://cve.now/CVE-2020-27028.md): In filter\_incoming\_event of hci\_layer.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27027](https://cve.now/CVE-2020-27027.md): In nfc\_ncif\_proc\_get\_routing of nfc\_ncif.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27026](https://cve.now/CVE-2020-27026.md): During boot, the device unlock interface behaves differently depending on if a fingerprint registered to the device is present. (no CVSS, Android)
- [CVE-2020-27025](https://cve.now/CVE-2020-27025.md): In EapFailureNotifier.java and SimRequiredNotifier.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-27024](https://cve.now/CVE-2020-27024.md): In smp\_br\_state\_machine\_event of smp\_br\_main.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-27023](https://cve.now/CVE-2020-27023.md): In setErrorPlaybackState of BluetoothMediaBrowserService.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-27021](https://cve.now/CVE-2020-27021.md): In avrc\_ctrl\_pars\_vendor\_cmd of avrc\_pars\_tg.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0500](https://cve.now/CVE-2020-0500.md): In startInputUncheckedLocked of InputMethodManager.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2020-0499](https://cve.now/CVE-2020-0499.md): In FLAC\_\_bitreader\_read\_rice\_signed\_block of bitreader.c, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0498](https://cve.now/CVE-2020-0498.md): In decode\_packed\_entry\_number of codebook.c, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0497](https://cve.now/CVE-2020-0497.md): In canUseBiometric of BiometricServiceBase, there is a missing permission check. (no CVSS, Android)
- [CVE-2020-0496](https://cve.now/CVE-2020-0496.md): In CPDF\_RenderStatus::LoadSMask of cpdf\_renderstatus.cpp, there is a possible memory corruption due to a use-after free. (no CVSS, Android)
- [CVE-2020-0495](https://cve.now/CVE-2020-0495.md): In decode\_Huffman of JBig2\_SddProc.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2020-0494](https://cve.now/CVE-2020-0494.md): In ih264d\_parse\_ave of ih264d\_sei.c, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0493](https://cve.now/CVE-2020-0493.md): In CPDF\_SampledFunc::v\_Call of cpdf\_sampledfunc.cpp, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2020-0492](https://cve.now/CVE-2020-0492.md): In BitstreamFillCache of bitstream.cpp, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2020-0491](https://cve.now/CVE-2020-0491.md): In readBlock of MatroskaExtractor.cpp, there is a possible denial of service due to resource exhaustion. (no CVSS, Android)
- [CVE-2020-0490](https://cve.now/CVE-2020-0490.md): In floor1\_info\_unpack of floor1.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0489](https://cve.now/CVE-2020-0489.md): In Parse\_data of eas\_mdls.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0488](https://cve.now/CVE-2020-0488.md): In ihevc\_inter\_pred\_chroma\_copy\_ssse3 of ihevc\_inter\_pred\_filters\_ssse3\_intr.c, there is a possible information disclosure due to uninitiali (no CVSS, Android)
- [CVE-2020-0486](https://cve.now/CVE-2020-0486.md): In openAssetFileListener of ContactsProvider2.java, there is a possible permission bypass due to an insecure default value. (no CVSS, Android)
- [CVE-2020-0485](https://cve.now/CVE-2020-0485.md): In areFunctionsSupported of UsbBackend.java, there is a possible access to tethering from a guest account due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0484](https://cve.now/CVE-2020-0484.md): In destroyResources of ComposerClient.h, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-0483](https://cve.now/CVE-2020-0483.md): In DrmManagerService::~DrmManagerService() of DrmManagerService.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-0482](https://cve.now/CVE-2020-0482.md): In command of IncidentService.cpp, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-0481](https://cve.now/CVE-2020-0481.md): In AndroidManifest.xml, there is a possible permissions bypass. (no CVSS, Android)
- [CVE-2020-0480](https://cve.now/CVE-2020-0480.md): In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass due to a missing permission check. (no CVSS, Android)
- [CVE-2020-0479](https://cve.now/CVE-2020-0479.md): In callUnchecked of DocumentsProvider.java, there is a possible permissions bypass. (no CVSS, Android)
- [CVE-2020-0478](https://cve.now/CVE-2020-0478.md): In extend\_frame\_lowbd of restoration.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0477](https://cve.now/CVE-2020-0477.md): In sendLinkConfigurationChangedBroadcast of ClientModeImpl.java, there is a possible information disclosure due to a missing permission chec (no CVSS, Android)
- [CVE-2020-0476](https://cve.now/CVE-2020-0476.md): In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. (no CVSS, Android)
- [CVE-2020-0475](https://cve.now/CVE-2020-0475.md): In createInputConsumer of WindowManagerService.java, there is a possible way to block and intercept input events due to a missing permission (no CVSS, Android)
- [CVE-2020-0474](https://cve.now/CVE-2020-0474.md): In HalCamera::requestNewFrame of HalCamera.cpp, there is a possible use-after-free due to a race condition. (no CVSS, Android)
- [CVE-2020-0473](https://cve.now/CVE-2020-0473.md): In updateIncomingFileConfirmNotification of BluetoothOppNotification.java, there is a possible permissions bypass. (no CVSS, Android)
- [CVE-2020-0368](https://cve.now/CVE-2020-0368.md): In queryInternal of CallLogProvider.java, there is a possible permission bypass due to improper input validation. (no CVSS, Android)
- [CVE-2020-0280](https://cve.now/CVE-2020-0280.md): In nci\_proc\_ee\_management\_rsp of nci\_hrcv.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2020-0244](https://cve.now/CVE-2020-0244.md): In writeBurstBufferBytes of SPDIFEncoder.cpp, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2020-35396](https://cve.now/CVE-2020-35396.md): EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. (no CVSS)
- [CVE-2020-35395](https://cve.now/CVE-2020-35395.md): XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScrip (no CVSS)
- [CVE-2020-28456](https://cve.now/CVE-2020-28456.md): Cross-site Scripting (XSS) (CVSS 7.3, s-cart/core)
- [CVE-2020-28457](https://cve.now/CVE-2020-28457.md): Cross-site Scripting (XSS) (CVSS 7.2, s-cart/core)
- [CVE-2020-8944](https://cve.now/CVE-2020-8944.md): Unchecked buffer overrun in ecall\_restore (CVSS 5.3, Google Asylo)
- [CVE-2020-8942](https://cve.now/CVE-2020-8942.md): Unchecked buffer overrun in enc\_untrusted\_read (CVSS 5.3, Google Asylo)
- [CVE-2020-8943](https://cve.now/CVE-2020-8943.md): Unchecked buffer overrun in enc\_untrusted\_recvfrom (CVSS 5.3, Google Asylo)
- [CVE-2020-8941](https://cve.now/CVE-2020-8941.md): Unchecked buffer overrun in enc\_untrusted\_inet\_pton (CVSS 5.3, Google Asylo)
- [CVE-2020-8940](https://cve.now/CVE-2020-8940.md): Unchecked buffer overrun in enc\_untrusted\_recvmsg (CVSS 5.3, Google Asylo)
- [CVE-2020-8938](https://cve.now/CVE-2020-8938.md): Arbitrary enclave memory location write from untrusted environment (CVSS 5.3, Google Asylo)
- [CVE-2020-8939](https://cve.now/CVE-2020-8939.md): Out of Bounds read in Asylo (CVSS 5.3, Google Asylo)
- [CVE-2020-8937](https://cve.now/CVE-2020-8937.md): Arbitrary enclave memory location write from untrusted environment (CVSS 5.3, Google Asylo)
- [CVE-2020-8936](https://cve.now/CVE-2020-8936.md): Arbitrary enclave memory overwrite vulnerability in ECall ecall\_restore (CVSS 5.3, Google Asylo)
- [CVE-2020-8935](https://cve.now/CVE-2020-8935.md): An arbitrary memory overwrite vulnerability in Asylo versions up to 0.6.0 allow an attacker to make an Ecall\_restore function call to reallo (CVSS 5.3, Google Asylo)
- [CVE-2020-4849](https://cve.now/CVE-2020-4849.md): IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.19 Interim Fix 7 could allow a remote attacker to bypass security restrictions, caused by a (CVSS 5.3, IBM Tivoli Netcool Impact)
- [CVE-2020-4747](https://cve.now/CVE-2020-4747.md): IBM Connect:Direct for UNIX 6.1.0, 6.0.0, 4.3.0, and 4.2.0 can allow a local or remote user to obtain an authenticated CLI session due to im (CVSS 7.4, IBM Sterling Connect:Direct for UNIX)
- [CVE-2020-28203](https://cve.now/CVE-2020-28203.md): An issue was discovered in Foxit Reader and PhantomPDF 10.1.0.37527 and earlier. (no CVSS)
- [CVE-2020-28442](https://cve.now/CVE-2020-28442.md): Prototype Pollution (CVSS 7.5, js-data)
- [CVE-2020-35470](https://cve.now/CVE-2020-35470.md): Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the p (no CVSS)
- [CVE-2020-35471](https://cve.now/CVE-2020-35471.md): Envoy before 1.16.1 mishandles dropped and truncated datagrams, as demonstrated by a segmentation fault for a UDP packet size larger than 15 (no CVSS)
- [CVE-2020-10770](https://cve.now/CVE-2020-10770.md): A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter (no CVSS, keycloak · org.keycloak:keycloak-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.