CVEs published December 23, 2020
41 CVEs were published on December 23, 2020: 2 critical, 3 high.
- Published
- 41
- Critical
- 2
- High
- 3
- Medium
- 2
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- MOXA NPort IAW5000A-I/O
- 6
- dolibarr/dolibarr
- 1
- IBM DB2 for Linux- UNIX and Windows
- 1
- Opera for Android
- 1
Critical 2
High 3
Medium, low and unrated 36
- CVE-2020-35668RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as
- CVE-2020-35666Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.j
- CVE-2020-35598ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI.
- CVE-2020-35269Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting
- CVE-2020-35370A RCE vulnerability exists in Raysync below 3.3.3.8.
- CVE-2020-35252Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System
- CVE-2020-28074SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication sys
- CVE-2020-28073SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and imperso
- CVE-2020-28071SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php.
- CVE-2020-28070SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_even
- CVE-2020-27397Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to
- CVE-2020-13969CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter.
- CVE-2020-13968CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter.
- CVE-2018-1000893Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions.
- CVE-2018-1000892Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages.
- CVE-2018-1000891Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums.
- CVE-2020-4642IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a deniIBM DB2 for Linux- UNIX and Windows
- CVE-2020-11719An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below.
- CVE-2020-11720An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below.
- CVE-2020-11718An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below.
- CVE-2020-9439Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote at
- CVE-2020-29551An issue was discovered in URVE Build 24.03.2020.
- CVE-2020-35650Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inje
- CVE-2020-35587In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled.
- CVE-2020-29552An issue was discovered in URVE Build 24.03.2020.
- CVE-2020-6159URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacksOpera for Android
- CVE-2020-29550An issue was discovered in URVE Build 24.03.2020.
- CVE-2020-35586In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/in
- CVE-2020-35585In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Con
- CVE-2020-35584In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature.
- CVE-2020-35136Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution.dolibarr/dolibarr
- CVE-2020-25192MOXA NPort IAW5000A-I/O SeriesMOXA NPort IAW5000A-I/O
- CVE-2020-35658SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
- CVE-2020-35657Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP
- CVE-2020-35656Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&re
- CVE-2020-35665An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter