CVEs published December 18, 2020
66 CVEs were published on December 18, 2020: 1 critical, 8 high.
- Published
- 66
- Critical
- 1
- High
- 8
- Medium
- 8
- Low
- 1
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- NZXT
- 4
- Apache DolphinScheduler · org.apache.dolphinscheduler:dolph…
- 1
- Ceph
- 1
- HCL iNotes
- 1
- HCL Notes
- 1
- HCL Verse
- 1
- HPE StoreEver MSL Tape Libraries; HPE StoreEver 1/8 G2 Tape…
- 1
- HPE Systems Insight Manager
- 1
- IBM Planning Analytics
- 1
- iLO Amplifier Pack
- 1
Critical 1
High 8
- CVE-2020-13519A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0.NZXT"
- CVE-2020-13514A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13513A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13512A privilege escalation vulnerability exists in the WinRing0x64 Driver Privileged I/O Write IRPs functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-13515A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c40a148 functionality of NZXT CAM 4.8.0.NZXT
- CVE-2020-26280XSS in OpenSlidesOpenSlides
- CVE-2020-26174tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained
- CVE-2020-7838A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value.Smilegate STOVE Client
Medium, low and unrated 57
- CVE-2020-7201A potential security vulnerability has been identified in the HPE StoreEver MSL2024 Tape Library and HPE StoreEver 1/8 G2 Tape Autoloaders.HPE StoreEver MSL Tape Libraries; HPE StoreEver 1/8 G2 Tape…
- CVE-2020-7203A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70.iLO Amplifier Pack
- CVE-2020-7200A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.HPE Systems Insight Manager
- CVE-2020-14224A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthenticated attacker resultHCL Notes
- CVE-2020-14271HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content.HCL iNotes
- CVE-2020-4080HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of message content.HCL Verse
- CVE-2020-5803Relative Path Traversal in Marvell QConvergeConsole GUI 5.5.0.74 allows a remote, authenticated attacker to delete arbitrary files on disk aMarvell QConvergeConsole GUI
- CVE-2020-17520In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verification mechanism by conPulsar Manager
- CVE-2020-20298Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attack
- CVE-2020-20300SQL injection vulnerability in the wp_where function in WeiPHP 5.0.
- CVE-2020-20299WeiPHP 5.0 does not properly restrict access to pages, related to using POST.
- CVE-2020-27687ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails.
- CVE-2020-20285There is a XSS in the user login page in zzcms 2019.
- CVE-2020-20276An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be
- CVE-2020-20277There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 du
- CVE-2020-26251CORS configuration is possibly vulnerableopen-zaak
- CVE-2020-4764IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized aIBM Planning Analytics
- CVE-2020-25901Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned
- CVE-2020-25495A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject ar
- CVE-2020-25494Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevel
- CVE-2020-26171In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated.
- CVE-2020-26172Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a sessi
- CVE-2020-26173An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by provi
- CVE-2020-26175In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in order to change pro
- CVE-2020-26176An issue was discovered in tangro Business Workflow before 1.18.1.
- CVE-2020-26177In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited b
- CVE-2020-26178In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authentic
- CVE-2019-16955SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
- CVE-2019-16957SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
- CVE-2020-35548An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software.
- CVE-2020-35549An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software.
- CVE-2020-35550An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software.
- CVE-2020-35551An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software.
- CVE-2020-35552An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chipsets) software.
- CVE-2020-35553An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software.
- CVE-2020-35554An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software.
- CVE-2020-35555An issue was discovered on LG mobile devices with Android OS 10 software.
- CVE-2020-35479MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php.
- CVE-2020-35480An issue was discovered in MediaWiki before 1.35.1.
- CVE-2020-35477MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations.
- CVE-2020-35478MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php.
- CVE-2020-35475In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML.
- CVE-2020-35474In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentcha
- CVE-2020-27640The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within
- CVE-2020-27639The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attack
- CVE-2020-27154The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gai
- CVE-2020-25608The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Inj
- CVE-2020-25609The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insuffic
- CVE-2020-27340The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malic
- CVE-2020-25606The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper
- CVE-2020-25611The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due t
- CVE-2020-25610The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control
- CVE-2020-25612The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient
- CVE-2020-24693The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insuffici
- CVE-2020-28052An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66.org.bouncycastle:bcprov-jdk15to18 · org.bouncycastle:bcp… +5
- CVE-2020-11974In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.Apache DolphinScheduler · org.apache.dolphinscheduler:dolph…
- CVE-2020-27781User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation.Ceph