# CVEs published 2020-12-16

45 CVEs were published on December 16, 2020: 1 critical, 3 high. Days are UTC.

- [CVE-2020-4908](https://cve.now/CVE-2020-4908.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 returns the product version and release information on the log (CVSS 5.3, IBM Financial Transaction Manager)
- [CVE-2020-4907](https://cve.now/CVE-2020-4907.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow a remote attacker to obtain sensitive information (CVSS 5.3, IBM Financial Transaction Manager)
- [CVE-2020-4906](https://cve.now/CVE-2020-4906.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 allows web pages to be stored locally which can be read by ano (CVSS 4.0, IBM Financial Transaction Manager)
- [CVE-2020-4905](https://cve.now/CVE-2020-4905.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an remote attacker to obtain sensitive information (CVSS 5.9, IBM Financial Transaction Manager)
- [CVE-2020-4904](https://cve.now/CVE-2020-4904.md): IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 is vulnerable to cross-site request forgery which could allow (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2020-4658](https://cve.now/CVE-2020-4658.md): IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Sterling File Gateway)
- [CVE-2020-4657](https://cve.now/CVE-2020-4657.md): IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. (CVSS 6.1, IBM Sterling B2B Integrator)
- [CVE-2020-28931](https://cve.now/CVE-2020-28931.md): Lack of an anti-CSRF token in the entire administrative interface in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to (no CVSS)
- [CVE-2020-28930](https://cve.now/CVE-2020-28930.md): A Cross-Site Scripting (XSS) issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (2 (no CVSS)
- [CVE-2020-28929](https://cve.now/CVE-2020-28929.md): Unrestricted access to the log downloader functionality in EPSON EPS TSE Server 8 (21.0.11) allows an unauthenticated attacker to remotely r (no CVSS)
- [CVE-2020-26274](https://cve.now/CVE-2020-26274.md): Command Injection Vulnerability in systeminformation (CVSS 6.4, sebhildebrandt systeminformation · systeminformation)
- [CVE-2020-7781](https://cve.now/CVE-2020-7781.md): Command Injection (CVSS 9.8, connection-tester)
- [CVE-2020-35133](https://cve.now/CVE-2020-35133.md): irfanView 4.56 contains an error processing parsing files of type .pcx. (no CVSS)
- [CVE-2019-14478](https://cve.now/CVE-2019-14478.md): AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. (no CVSS)
- [CVE-2019-14481](https://cve.now/CVE-2019-14481.md): AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. (no CVSS)
- [CVE-2019-14476](https://cve.now/CVE-2019-14476.md): AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. (no CVSS)
- [CVE-2019-14479](https://cve.now/CVE-2019-14479.md): AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. (no CVSS)
- [CVE-2020-7837](https://cve.now/CVE-2020-7837.md): An issue was discovered in ML Report Program. (CVSS 7.5, Infraware ML Report)
- [CVE-2020-5360](https://cve.now/CVE-2020-5360.md): Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to a Buffer Under-Read Vulnerability. (CVSS 7.5, Dell BSAFE Micro Edition Suite)
- [CVE-2020-5359](https://cve.now/CVE-2020-5359.md): Dell BSAFE Micro Edition Suite, versions prior to 4.5, are vulnerable to an Unchecked Return Value Vulnerability. (CVSS 5.8, Dell BSAFE Micro Edition Suite)
- [CVE-2020-26198](https://cve.now/CVE-2020-26198.md): Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web applica (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2019-14482](https://cve.now/CVE-2019-14482.md): AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. (no CVSS)
- [CVE-2019-14483](https://cve.now/CVE-2019-14483.md): AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. (no CVSS)
- [CVE-2019-14480](https://cve.now/CVE-2019-14480.md): AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication (no CVSS)
- [CVE-2019-14477](https://cve.now/CVE-2019-14477.md): AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwor (no CVSS)
- [CVE-2020-29607](https://cve.now/CVE-2020-29607.md): A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through (no CVSS)
- [CVE-2020-4008](https://cve.now/CVE-2020-4008.md): The installer of the macOS Sensor for VMware Carbon Black Cloud (prior to 3.5.1) handles certain files in an insecure way. (no CVSS, VMware Carbon Black Cloud macOS Sensor)
- [CVE-2020-14248](https://cve.now/CVE-2020-14248.md): BigFix Inventory up to v10.0.2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sen (no CVSS, HCL BigFix Inventory)
- [CVE-2020-14254](https://cve.now/CVE-2020-14254.md): TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. (no CVSS, HCL BigFix Inventory)
- [CVE-2020-25622](https://cve.now/CVE-2020-25622.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-25621](https://cve.now/CVE-2020-25621.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-25620](https://cve.now/CVE-2020-25620.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-25619](https://cve.now/CVE-2020-25619.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-25618](https://cve.now/CVE-2020-25618.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-25617](https://cve.now/CVE-2020-25617.md): An issue was discovered in SolarWinds N-Central 12.3.0.670. (no CVSS)
- [CVE-2020-29361](https://cve.now/CVE-2020-29361.md): An issue was discovered in p11-kit 0.21.1 through 0.23.21. (no CVSS)
- [CVE-2020-29362](https://cve.now/CVE-2020-29362.md): An issue was discovered in p11-kit 0.21.1 through 0.23.21. (no CVSS)
- [CVE-2020-29363](https://cve.now/CVE-2020-29363.md): An issue was discovered in p11-kit 0.23.6 through 0.23.21. (no CVSS)
- [CVE-2020-28458](https://cve.now/CVE-2020-28458.md): Prototype Pollution (CVSS 7.3, datatables.net)
- [CVE-2020-5683](https://cve.now/CVE-2020-5683.md): Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI (no CVSS, WESEEK GROWI)
- [CVE-2020-5682](https://cve.now/CVE-2020-5682.md): Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series), and GROWI v3 serie (no CVSS, WESEEK GROWI)
- [CVE-2020-26273](https://cve.now/CVE-2020-26273.md): sqlite ATTACH allows some filesystem access (CVSS 5.2, osquery)
- [CVE-2020-26258](https://cve.now/CVE-2020-26258.md): Server-Side Forgery Request can be activated unmarshalling with XStream (CVSS 6.3, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2020-26259](https://cve.now/CVE-2020-26259.md): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling (CVSS 6.8, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2020-35476](https://cve.now/CVE-2020-35476.md): A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. (no CVSS, net.opentsdb:opentsdb)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.