# CVEs published 2020-12-21 49 CVEs were published on December 21, 2020: 0 critical, 4 high. Days are UTC. - [CVE-2020-26284](https://cve.now/CVE-2020-26284.md): Hugo can execute a binary from the current directory on Windows (CVSS 7.7, gohugoio hugo · github.com/gohugoio/hugo) - [CVE-2020-35622](https://cve.now/CVE-2020-35622.md): An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. (no CVSS) - [CVE-2020-35623](https://cve.now/CVE-2020-35623.md): An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. (no CVSS) - [CVE-2020-35624](https://cve.now/CVE-2020-35624.md): An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. (no CVSS) - [CVE-2020-35625](https://cve.now/CVE-2020-35625.md): An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. (no CVSS) - [CVE-2020-35626](https://cve.now/CVE-2020-35626.md): An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. (no CVSS) - [CVE-2020-26281](https://cve.now/CVE-2020-26281.md): request smuggling in async-h1 (CVSS 6.8, http-rs async-h1 · async-h1) - [CVE-2020-29596](https://cve.now/CVE-2020-29596.md): MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the first parameter in a (no CVSS) - [CVE-2020-26277](https://cve.now/CVE-2020-26277.md): Arbitrary read/write in DBdeployer (CVSS 6.1, datacharmer dbdeployer · github.com/datacharmer/dbdeployer) - [CVE-2020-8995](https://cve.now/CVE-2020-8995.md): Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that all (no CVSS) - [CVE-2020-11717](https://cve.now/CVE-2020-11717.md): An issue was discovered in Programi 014 31.01.2020. (no CVSS) - [CVE-2018-7580](https://cve.now/CVE-2018-7580.md): Philips Hue is vulnerable to a Denial of Service attack. (no CVSS) - [CVE-2020-35151](https://cve.now/CVE-2020-35151.md): The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injec (no CVSS) - [CVE-2020-35606](https://cve.now/CVE-2020-35606.md): Arbitrary command execution can occur in Webmin through 1.962. (no CVSS) - [CVE-2020-35605](https://cve.now/CVE-2020-35605.md): The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename cont (no CVSS) - [CVE-2020-35604](https://cve.now/CVE-2020-35604.md): An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used. (no CVSS) - [CVE-2020-21378](https://cve.now/CVE-2020-21378.md): SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin\_members\_group.php. (no CVSS) - [CVE-2020-21377](https://cve.now/CVE-2020-21377.md): SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter. (no CVSS) - [CVE-2020-4843](https://cve.now/CVE-2020-4843.md): IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. (CVSS 6.3, IBM Security Secret Server) - [CVE-2020-4842](https://cve.now/CVE-2020-4842.md): IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is ret (CVSS 2.7, IBM Security Secret Server) - [CVE-2020-4841](https://cve.now/CVE-2020-4841.md): IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP (CVSS 5.9, IBM Security Secret Server) - [CVE-2020-4840](https://cve.now/CVE-2020-4840.md): IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 7.4, IBM Security Secret Server) - [CVE-2020-26275](https://cve.now/CVE-2020-26275.md): Open redirect vulnerability (CVSS 6.1, jupyter-server jupyter\_server · jupyter-server) - [CVE-2020-4870](https://cve.now/CVE-2020-4870.md): IBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing connecting applications. (CVSS 5.9, IBM MQ) - [CVE-2020-4794](https://cve.now/CVE-2020-4794.md): IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Ma (CVSS 5.4, IBM Automation Workstream Services · IBM Business Proces… +1) - [CVE-2020-4757](https://cve.now/CVE-2020-4757.md): IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Content Navigator) - [CVE-2020-4555](https://cve.now/CVE-2020-4555.md): IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenticated user to impers (CVSS 6.3, IBM Financial Transaction Manager) - [CVE-2020-4988](https://cve.now/CVE-2020-4988.md): Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and cause a denial of servic (CVSS 7.3, Loopback) - [CVE-2020-5808](https://cve.now/CVE-2020-5808.md): In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a parti (no CVSS, Tenable.sc) - [CVE-2020-25860](https://cve.now/CVE-2020-25860.md): The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signatu (no CVSS, Pengutronix RAUC) - [CVE-2020-6882](https://cve.now/CVE-2020-6882.md): ZTE E8810/E8820/E8822 series routers have an information leak vulnerability, which is caused by hard-coded MQTT service access credentials o (no CVSS, \) - [CVE-2020-6881](https://cve.now/CVE-2020-6881.md): ZTE E8810/E8820/E8822 series routers have an MQTT DoS vulnerability, which is caused by the failure of the device to verify the validity of (no CVSS, \) - [CVE-2020-26422](https://cve.now/CVE-2020-26422.md): Buffer overflow in QUIC dissector in Wireshark 3.4.0 to 3.4.1 allows denial of service via packet injection or crafted capture file (CVSS 3.7, The Wireshark Foundation Wireshark) - [CVE-2020-14225](https://cve.now/CVE-2020-14225.md): HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. (no CVSS, HCL iNotes) - [CVE-2020-27254](https://cve.now/CVE-2020-27254.md): Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to imp (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer) - [CVE-2020-26263](https://cve.now/CVE-2020-26263.md): RSA vulnerability in tslite-ng (CVSS 7.5, tlsfuzzer tlslite-ng · tlslite-ng) - [CVE-2020-17526](https://cve.now/CVE-2020-17526.md): Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on si (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2020-35497](https://cve.now/CVE-2020-35497.md): A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, (no CVSS, ovirt-engine) - [CVE-2020-27846](https://cve.now/CVE-2020-27846.md): A signature verification vulnerability exists in crewjam/saml. (no CVSS, crewjam/saml · github.com/crewjam/saml) - [CVE-2020-3999](https://cve.now/CVE-2020-3999.md): VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware Fusion (12.x prior t (no CVSS, VMware ESXi, VMware Workstation,VMware Fusion and VMware Cl…) - [CVE-2019-16959](https://cve.now/CVE-2019-16959.md): SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. (no CVSS) - [CVE-2020-35276](https://cve.now/CVE-2020-35276.md): EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. (no CVSS) - [CVE-2020-35275](https://cve.now/CVE-2020-35275.md): Coastercms v5.8.18 is affected by cross-site Scripting (XSS). (no CVSS) - [CVE-2020-35274](https://cve.now/CVE-2020-35274.md): DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. (no CVSS) - [CVE-2020-35273](https://cve.now/CVE-2020-35273.md): EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privil (no CVSS) - [CVE-2020-26049](https://cve.now/CVE-2020-26049.md): Nifty-PM CPE 2.3 is affected by stored HTML injection. (no CVSS) - [CVE-2020-35590](https://cve.now/CVE-2020-35590.md): LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limi (no CVSS) - [CVE-2020-35589](https://cve.now/CVE-2020-35589.md): The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. (no CVSS) - [CVE-2020-29447](https://cve.now/CVE-2020-29447.md): Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulner (no CVSS, Atlassian Crucible) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.