# CVEs published 2020-12-22

44 CVEs were published on December 22, 2020: 6 critical, 16 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-28641](https://cve.now/CVE-2020-28641.md): In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system. (no CVSS)
- [CVE-2020-14874](https://cve.now/CVE-2020-14874.md): Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. (CVSS 4.7, Oracle Cloud Infrastructure Identity and Access Management)
- [CVE-2020-24675](https://cve.now/CVE-2020-24675.md): Weak Authentication in Symphony Plus (CVSS 9.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24673](https://cve.now/CVE-2020-24673.md): SQL Injection in Symphony Plus (CVSS 9.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24674](https://cve.now/CVE-2020-24674.md): Improper Authorization in Symphony Plus (CVSS 8.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24683](https://cve.now/CVE-2020-24683.md): Authentication Bypass in Symphony Plus (CVSS 9.8, ABB Ability™ Symphony® Plus Operations)
- [CVE-2020-24680](https://cve.now/CVE-2020-24680.md): Improper Credential Storage in Symphony Plus (CVSS 7.0, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24679](https://cve.now/CVE-2020-24679.md): Denial of Service attack on Symphony Plus (CVSS 7.5, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24677](https://cve.now/CVE-2020-24677.md): Insecure Web Service in Symphony Plus (CVSS 8.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24676](https://cve.now/CVE-2020-24676.md): Insecure Windows Services in Symphony Plus (CVSS 7.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-24678](https://cve.now/CVE-2020-24678.md): Potential Privilege Escalation in Symphony Plus (CVSS 8.8, ABB Ability™ Symphony® Plus Operations · ABB Ability™ Symph…)
- [CVE-2020-27338](https://cve.now/CVE-2020-27338.md): An issue was discovered in Treck IPv6 before 6.0.1.68. (CVSS 5.9)
- [CVE-2020-27337](https://cve.now/CVE-2020-27337.md): An issue was discovered in Treck IPv6 before 6.0.1.68. (CVSS 7.3)
- [CVE-2020-27336](https://cve.now/CVE-2020-27336.md): An issue was discovered in Treck IPv6 before 6.0.1.68. (CVSS 3.7)
- [CVE-2020-25066](https://cve.now/CVE-2020-25066.md): A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/ (CVSS 10.0)
- [CVE-2020-14270](https://cve.now/CVE-2020-14270.md): HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handling of user input. (no CVSS, HCL Domino)
- [CVE-2020-14231](https://cve.now/CVE-2020-14231.md): A vulnerability in the input parameter handling of HCL Client Application Access v9 could potentially be exploited by an authenticated attac (no CVSS, HCL Client Application Access)
- [CVE-2020-35609](https://cve.now/CVE-2020-35609.md): A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. (no CVSS)
- [CVE-2020-35608](https://cve.now/CVE-2020-35608.md): A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07. (no CVSS)
- [CVE-2020-13547](https://cve.now/CVE-2020-13547.md): A type confusion vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. (CVSS 8.8, Foxit)
- [CVE-2020-24581](https://cve.now/CVE-2020-24581.md): An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU\_2.31\_V1.1.47ae55. (no CVSS)
- [CVE-2020-24580](https://cve.now/CVE-2020-24580.md): An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU\_2.31\_V1.1.47ae55. (no CVSS)
- [CVE-2020-24579](https://cve.now/CVE-2020-24579.md): An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU\_2.31\_V1.1.47ae55. (no CVSS)
- [CVE-2020-24578](https://cve.now/CVE-2020-24578.md): An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU\_2.31\_V1.1.47ae55. (no CVSS)
- [CVE-2020-13570](https://cve.now/CVE-2020-13570.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.0.37527. (CVSS 7.5, Foxit)
- [CVE-2020-13560](https://cve.now/CVE-2020-13560.md): A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. (CVSS 8.8, Foxit)
- [CVE-2020-13557](https://cve.now/CVE-2020-13557.md): A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. (CVSS 8.8, Foxit)
- [CVE-2020-25106](https://cve.now/CVE-2020-25106.md): Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then (no CVSS)
- [CVE-2020-29396](https://cve.now/CVE-2020-29396.md): A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0, when running with Python 3.6 or later, allows (CVSS 9.9, Odoo Community · Odoo Enterprise)
- [CVE-2019-11785](https://cve.now/CVE-2019-11785.md): Improper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote au (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2019-11786](https://cve.now/CVE-2019-11786.md): Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote authenticated users to modify (CVSS 4.3, Odoo Community · Odoo Enterprise)
- [CVE-2019-11784](https://cve.now/CVE-2019-11784.md): Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remot (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2019-11782](https://cve.now/CVE-2019-11782.md): Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authenticated users with acce (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2019-11783](https://cve.now/CVE-2019-11783.md): Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows re (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2018-15645](https://cve.now/CVE-2018-15645.md): Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticat (CVSS 8.1, Odoo Community · Odoo Enterprise)
- [CVE-2019-11781](https://cve.now/CVE-2019-11781.md): Improper input validation in portal component in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier, allows remote attacke (CVSS 6.5, Odoo Community · Odoo Enterprise)
- [CVE-2018-15641](https://cve.now/CVE-2018-15641.md): Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote auth (CVSS 6.3, Odoo Community · Odoo Enterprise)
- [CVE-2018-15634](https://cve.now/CVE-2018-15634.md): Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows re (CVSS 7.1, Odoo Community · Odoo Enterprise)
- [CVE-2018-15638](https://cve.now/CVE-2018-15638.md): Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attac (CVSS 7.1, Odoo Community · Odoo Enterprise)
- [CVE-2018-15633](https://cve.now/CVE-2018-15633.md): Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote (CVSS 7.1, Odoo Community · Odoo Enterprise)
- [CVE-2018-15632](https://cve.now/CVE-2018-15632.md): Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote (CVSS 8.2, Odoo Community · Odoo Enterprise)
- [CVE-2020-28448](https://cve.now/CVE-2020-28448.md): Prototype Pollution (CVSS 5.6, multi-ini)
- [CVE-2020-28460](https://cve.now/CVE-2020-28460.md): Prototype Pollution (CVSS 5.6, multi-ini)
- [CVE-2020-29583](https://cve.now/CVE-2020-29583.md): Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. (CVSS 9.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.