CVEs published December 22, 2020
44 CVEs were published on December 22, 2020: 6 critical, 16 high. 1 is now in CISA KEV.
- Published
- 44
- Critical
- 6
- High
- 16
- Medium
- 11
- Low
- 1
- Unrated
- 10
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- Odoo Community · Odoo Enterprise
- 13
- ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- 8
- Foxit
- 4
- multi-ini
- 2
- ABB Ability™ Symphony® Plus Operations
- 1
- HCL Client Application Access
- 1
- HCL Domino
- 1
- Oracle Cloud Infrastructure Identity and Access Management
- 1
Critical 6
- CVE-2020-24675Weak Authentication in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24673SQL Injection in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24683Authentication Bypass in Symphony PlusABB Ability™ Symphony® Plus Operations
- CVE-2020-25066A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/
- CVE-2020-29396A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows Odoo Community · Odoo Enterprise
- CVE-2020-29583Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password.
High 16
- CVE-2020-24674Improper Authorization in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24680Improper Credential Storage in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24679Denial of Service attack on Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24677Insecure Web Service in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24676Insecure Windows Services in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-24678Potential Privilege Escalation in Symphony PlusABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…
- CVE-2020-27337An issue was discovered in Treck IPv6 before 6.0.1.68.
- CVE-2020-13547A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.Foxit
- CVE-2020-13570A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527.Foxit
- CVE-2020-13560A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.Foxit
- CVE-2020-13557A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.Foxit
- CVE-2018-15645Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticatOdoo Community · Odoo Enterprise
- CVE-2018-15634Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows reOdoo Community · Odoo Enterprise
- CVE-2018-15638Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attacOdoo Community · Odoo Enterprise
- CVE-2018-15633Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remoteOdoo Community · Odoo Enterprise
- CVE-2018-15632Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote Odoo Community · Odoo Enterprise
Medium, low and unrated 22
- CVE-2020-28641In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.
- CVE-2020-14874Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services.Oracle Cloud Infrastructure Identity and Access Management
- CVE-2020-27338An issue was discovered in Treck IPv6 before 6.0.1.68.
- CVE-2020-27336An issue was discovered in Treck IPv6 before 6.0.1.68.
- CVE-2020-14270HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input.HCL Domino
- CVE-2020-14231A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attacHCL Client Application Access
- CVE-2020-35609A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05.
- CVE-2020-35608A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07.
- CVE-2020-24581An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
- CVE-2020-24580An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
- CVE-2020-24579An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
- CVE-2020-24578An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
- CVE-2020-25106Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then
- CVE-2019-11785Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote auOdoo Community · Odoo Enterprise
- CVE-2019-11786Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modifyOdoo Community · Odoo Enterprise
- CVE-2019-11784Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remotOdoo Community · Odoo Enterprise
- CVE-2019-11782Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with acceOdoo Community · Odoo Enterprise
- CVE-2019-11783Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows reOdoo Community · Odoo Enterprise
- CVE-2019-11781Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attackeOdoo Community · Odoo Enterprise
- CVE-2018-15641Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authOdoo Community · Odoo Enterprise
- CVE-2020-28448Prototype Pollutionmulti-ini
- CVE-2020-28460Prototype Pollutionmulti-ini