CVEs published December 21, 2020
49 CVEs were published on December 21, 2020: 0 critical, 4 high.
- Published
- 49
- Critical
- 0
- High
- 4
- Medium
- 9
- Low
- 2
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- IBM Security Secret Server
- 4
- <ZXHN E8810, ZXHN E8820, ZXHN E8822>
- 2
- Apache Software Foundation Apache Airflow · apache-airflow
- 1
- Atlassian Crucible
- 1
- crewjam/saml · github.com/crewjam/saml
- 1
- datacharmer dbdeployer · github.com/datacharmer/dbdeployer
- 1
- Emerson Rosemount X-STREAM Gas Analyzer
- 1
- gohugoio hugo · github.com/gohugoio/hugo
- 1
- HCL iNotes
- 1
- http-rs async-h1 · async-h1
- 1
High 4
- CVE-2020-26284Hugo can execute a binary from the current directory on Windowsgohugoio hugo · github.com/gohugoio/hugo
- CVE-2020-4840IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Security Secret Server
- CVE-2020-4988Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of servicLoopback
- CVE-2020-26263RSA vulnerability in tslite-ngtlsfuzzer tlslite-ng · tlslite-ng
Medium, low and unrated 45
- CVE-2020-35622An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1.
- CVE-2020-35623An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1.
- CVE-2020-35624An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1.
- CVE-2020-35625An issue was discovered in the Widgets extension for MediaWiki through 1.35.1.
- CVE-2020-35626An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1.
- CVE-2020-26281request smuggling in async-h1http-rs async-h1 · async-h1
- CVE-2020-29596MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a
- CVE-2020-26277Arbitrary read/write in DBdeployerdatacharmer dbdeployer · github.com/datacharmer/dbdeployer
- CVE-2020-8995Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that all
- CVE-2020-11717An issue was discovered in Programi 014 31.01.2020.
- CVE-2018-7580Philips Hue is vulnerable to a Denial of Service attack.
- CVE-2020-35151The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injec
- CVE-2020-35606Arbitrary command execution can occur in Webmin through 1.962.
- CVE-2020-35605The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename cont
- CVE-2020-35604An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.
- CVE-2020-21378SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.php.
- CVE-2020-21377SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.
- CVE-2020-4843IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user.IBM Security Secret Server
- CVE-2020-4842IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retIBM Security Secret Server
- CVE-2020-4841IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTPIBM Security Secret Server
- CVE-2020-26275Open redirect vulnerabilityjupyter-server jupyter_server · jupyter-server
- CVE-2020-4870IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications.IBM MQ
- CVE-2020-4794IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process MaIBM Automation Workstream Services · IBM Business Proces… +1
- CVE-2020-4757IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting.IBM Content Navigator
- CVE-2020-4555IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impersIBM Financial Transaction Manager
- CVE-2020-5808In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a partiTenable.sc
- CVE-2020-25860The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signatuPengutronix RAUC
- CVE-2020-6882ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials o<ZXHN E8810, ZXHN E8820, ZXHN E8822>
- CVE-2020-6881ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of <ZXHN E8810, ZXHN E8820, ZXHN E8822>
- CVE-2020-26422Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture fileThe Wireshark Foundation Wireshark
- CVE-2020-14225HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content.HCL iNotes
- CVE-2020-27254Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to impEmerson Rosemount X-STREAM Gas Analyzer
- CVE-2020-17526Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on siApache Software Foundation Apache Airflow · apache-airflow
- CVE-2020-35497A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name,ovirt-engine
- CVE-2020-27846A signature verification vulnerability exists in crewjam/saml.crewjam/saml · github.com/crewjam/saml
- CVE-2020-3999VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior tVMware ESXi, VMware Workstation,VMware Fusion and VMware Cl…
- CVE-2019-16959SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.
- CVE-2020-35276EgavilanMedia ECM Address Book 1.0 is affected by SQL injection.
- CVE-2020-35275Coastercms v5.8.18 is affected by cross-site Scripting (XSS).
- CVE-2020-35274DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges.
- CVE-2020-35273EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privil
- CVE-2020-26049Nifty-PM CPE 2.3 is affected by stored HTML injection.
- CVE-2020-35590LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limi
- CVE-2020-35589The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS.
- CVE-2020-29447Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerAtlassian Crucible