CVEs published December 16, 2020
45 CVEs were published on December 16, 2020: 1 critical, 3 high.
- Published
- 45
- Critical
- 1
- High
- 3
- Medium
- 13
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- IBM Financial Transaction Manager
- 5
- Dell BSAFE Micro Edition Suite
- 2
- HCL BigFix Inventory
- 2
- WESEEK GROWI
- 2
- x-stream xstream · com.thoughtworks.xstream:xstream
- 2
- connection-tester
- 1
- datatables.net
- 1
- IBM Sterling B2B Integrator
- 1
- IBM Sterling File Gateway
- 1
- Infraware ML Report
- 1
Critical 1
High 3
Medium, low and unrated 41
- CVE-2020-4908IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the logIBM Financial Transaction Manager
- CVE-2020-4907IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information IBM Financial Transaction Manager
- CVE-2020-4906IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by anoIBM Financial Transaction Manager
- CVE-2020-4905IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain sensitive informationIBM Financial Transaction Manager
- CVE-2020-4904IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forgery which could allow IBM Financial Transaction Manager
- CVE-2020-4658IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2020-4657IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2020-28931Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to
- CVE-2020-28930A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (2
- CVE-2020-28929Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely r
- CVE-2020-26274Command Injection Vulnerability in systeminformationsebhildebrandt systeminformation · systeminformation
- CVE-2020-35133irfanView 4.56 contains an error processing parsing files of type .pcx.
- CVE-2019-14478AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client.
- CVE-2019-14481AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client.
- CVE-2019-14476AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server.
- CVE-2019-14479AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution.
- CVE-2020-5359Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability.Dell BSAFE Micro Edition Suite
- CVE-2020-26198Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applicaIntegrated Dell Remote Access Controller
- CVE-2019-14482AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client.
- CVE-2019-14483AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure.
- CVE-2019-14480AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication
- CVE-2019-14477AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwor
- CVE-2020-29607A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through
- CVE-2020-4008The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way.VMware Carbon Black Cloud macOS Sensor
- CVE-2020-14248BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be senHCL BigFix Inventory
- CVE-2020-14254TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2.HCL BigFix Inventory
- CVE-2020-25622An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-25621An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-25620An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-25619An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-25618An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-25617An issue was discovered in SolarWinds N-Central 12.3.0.670.
- CVE-2020-29361An issue was discovered in p11-kit 0.21.1 through 0.23.21.
- CVE-2020-29362An issue was discovered in p11-kit 0.21.1 through 0.23.21.
- CVE-2020-29363An issue was discovered in p11-kit 0.23.6 through 0.23.21.
- CVE-2020-5683Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI WESEEK GROWI
- CVE-2020-5682Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 serieWESEEK GROWI
- CVE-2020-26273sqlite ATTACH allows some filesystem accessosquery
- CVE-2020-26258Server-Side Forgery Request can be activated unmarshalling with XStreamx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2020-26259XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshallingx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.net.opentsdb:opentsdb