# CVEs published 2020-12-20

2 CVEs were published on December 20, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-35579](https://cve.now/CVE-2020-35579.md): tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and lau (no CVSS)
- [CVE-2020-35573](https://cve.now/CVE-2020-35573.md): srs2.c in PostSRSd before 1.10 allows remote attackers to cause a denial of service (CPU consumption) via a long timestamp tag in an SRS add (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.