CVEs published December 17, 2020
62 CVEs were published on December 17, 2020: 2 critical, 3 high.
- Published
- 62
- Critical
- 2
- High
- 3
- Medium
- 13
- Low
- 2
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Trend Micro InterScan Web Security Virtual Appliance
- 7
- NZXT
- 6
- Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- 4
- Bitdefender Hypervisor Introspection
- 3
- com.fasterxml.jackson.core:jackson-databind
- 2
- IBM Security Key Lifecycle Manager
- 2
- Lantronix
- 2
- Apache TomEE · org.apache.tomee:apache-tomee
- 1
- fleetdm fleet · github.com/fleetdm/fleet/v4
- 1
- github.com/hashicorp/vault
- 1
Critical 2
- CVE-2020-12522Command Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW10WAGO Series PFC · Series Wago Touch Panel 600 Standard L… +2
- CVE-2020-26276SAML authentication vulnerability in Fleetfleetdm fleet · github.com/fleetdm/fleet/v4
High 3
- CVE-2020-12519Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-12517Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulnerable website (local privilege escalation).Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-15294Compiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339)Bitdefender Hypervisor Introspection
Medium, low and unrated 57
- CVE-2020-14232A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attacker resulting in a sHCL Notes
- CVE-2020-27780A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users.pam
- CVE-2020-13516An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13517An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13518An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13511An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13510An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13509An information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13931If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the Apache TomEE · org.apache.tomee:apache-tomee
- CVE-2020-13528An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9Lantronix
- CVE-2020-13527An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0.0R9, 3.4.0.0R12 andLantronix
- CVE-2020-12523Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configurationPhoenix Contact TC MGUARD RS4000 4G VZW VPN · Phoenix Co… +5
- CVE-2020-12521Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-12518Phoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.Phoenix Contact AXC F · Phoenix Contact RFC 4072S (10513… +1
- CVE-2020-20138Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.
- CVE-2020-20139Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20140Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20141Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-20142Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.
- CVE-2020-8466A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing methodTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8465A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using aTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8463A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization cheTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8464A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to comeTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8461A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8462A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamperTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-27010A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamperTrend Micro InterScan Web Security Virtual Appliance
- CVE-2020-35545Time-based SQL injection exists in Spotweb 1.4.9 via the query string.
- CVE-2020-35490FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-35491FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-4846IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical errIBM Security Key Lifecycle Manager
- CVE-2020-4845IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting.IBM Security Key Lifecycle Manager
- CVE-2020-35489The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because
- CVE-2020-15293Memory corruption in Bitdefender Hypervisor Introspection (VA-9336)Bitdefender Hypervisor Introspection
- CVE-2020-15292Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333)Bitdefender Hypervisor Introspection
- CVE-2020-22083jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function.jsonpickle
- CVE-2020-35453HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces.
- CVE-2020-35177HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method.github.com/hashicorp/vault
- CVE-2020-29652A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackersgolang.org/x/crypto
- CVE-2020-27199The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass.
- CVE-2020-35123In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in the saml consumer st
- CVE-2020-25011A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Versi
- CVE-2020-25010An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers Software Version:R000
- CVE-2020-25094LogRhythm Platform Manager 7.4.9 allows Command Injection.
- CVE-2020-25095LogRhythm Platform Manager (PM) 7.4.9 allows CSRF.
- CVE-2020-25096LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control.
- CVE-2020-29436Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain access to content ou
- CVE-2020-35192The official vault docker images before 0.11.6 contain a blank password for a root user.
- CVE-2020-35190The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35184The official composer docker images before 1.8.3 contain a blank password for a root user.
- CVE-2020-35196The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35186The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user.
- CVE-2020-35195The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35191The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35197The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35187The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35189The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user.
- CVE-2020-35185The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user.