# CVEs published 2020-12-23 41 CVEs were published on December 23, 2020: 2 critical, 3 high. Days are UTC. - [CVE-2020-35668](https://cve.now/CVE-2020-35668.md): RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as (no CVSS) - [CVE-2020-35666](https://cve.now/CVE-2020-35666.md): Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos\_base.j (no CVSS) - [CVE-2020-35598](https://cve.now/CVE-2020-35598.md): ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced\_component\_system/index.php?ACS\_path=..%2f URI. (no CVSS) - [CVE-2020-35269](https://cve.now/CVE-2020-35269.md): Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting (no CVSS) - [CVE-2020-35370](https://cve.now/CVE-2020-35370.md): A RCE vulnerability exists in Raysync below 3.3.3.8. (no CVSS) - [CVE-2020-35252](https://cve.now/CVE-2020-35252.md): Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System (no CVSS) - [CVE-2020-28074](https://cve.now/CVE-2020-28074.md): SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication sys (no CVSS) - [CVE-2020-28073](https://cve.now/CVE-2020-28073.md): SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and imperso (no CVSS) - [CVE-2020-28071](https://cve.now/CVE-2020-28071.md): SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. (no CVSS) - [CVE-2020-28070](https://cve.now/CVE-2020-28070.md): SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view\_even (no CVSS) - [CVE-2020-27397](https://cve.now/CVE-2020-27397.md): Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to (no CVSS) - [CVE-2020-13969](https://cve.now/CVE-2020-13969.md): CRK Business Platform \<= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. (no CVSS) - [CVE-2020-13968](https://cve.now/CVE-2020-13968.md): CRK Business Platform \<= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter. (no CVSS) - [CVE-2018-1000893](https://cve.now/CVE-2018-1000893.md): Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions. (no CVSS) - [CVE-2018-1000892](https://cve.now/CVE-2018-1000892.md): Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages. (no CVSS) - [CVE-2018-1000891](https://cve.now/CVE-2018-1000891.md): Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums. (no CVSS) - [CVE-2020-4642](https://cve.now/CVE-2020-4642.md): IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a deni (CVSS 6.2, IBM DB2 for Linux- UNIX and Windows) - [CVE-2020-11719](https://cve.now/CVE-2020-11719.md): An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. (no CVSS) - [CVE-2020-11720](https://cve.now/CVE-2020-11720.md): An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. (no CVSS) - [CVE-2020-11718](https://cve.now/CVE-2020-11718.md): An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. (no CVSS) - [CVE-2020-9439](https://cve.now/CVE-2020-9439.md): Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote at (no CVSS) - [CVE-2020-29551](https://cve.now/CVE-2020-29551.md): An issue was discovered in URVE Build 24.03.2020. (no CVSS) - [CVE-2020-35650](https://cve.now/CVE-2020-35650.md): Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inje (no CVSS) - [CVE-2020-35587](https://cve.now/CVE-2020-35587.md): In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. (no CVSS) - [CVE-2020-29552](https://cve.now/CVE-2020-29552.md): An issue was discovered in URVE Build 24.03.2020. (no CVSS) - [CVE-2020-6159](https://cve.now/CVE-2020-6159.md): URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks (no CVSS, Opera for Android) - [CVE-2020-29550](https://cve.now/CVE-2020-29550.md): An issue was discovered in URVE Build 24.03.2020. (no CVSS) - [CVE-2020-35586](https://cve.now/CVE-2020-35586.md): In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/in (no CVSS) - [CVE-2020-35585](https://cve.now/CVE-2020-35585.md): In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Con (no CVSS) - [CVE-2020-35584](https://cve.now/CVE-2020-35584.md): In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. (no CVSS) - [CVE-2020-35136](https://cve.now/CVE-2020-35136.md): Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. (no CVSS, dolibarr/dolibarr) - [CVE-2020-25196](https://cve.now/CVE-2020-25196.md): MOXA NPort IAW5000A-I/O Series (CVSS 9.8, MOXA NPort IAW5000A-I/O) - [CVE-2020-25153](https://cve.now/CVE-2020-25153.md): MOXA NPort IAW5000A-I/O Series (CVSS 9.8, MOXA NPort IAW5000A-I/O) - [CVE-2020-25192](https://cve.now/CVE-2020-25192.md): MOXA NPort IAW5000A-I/O Series (CVSS 5.3, MOXA NPort IAW5000A-I/O) - [CVE-2020-25198](https://cve.now/CVE-2020-25198.md): MOXA NPort IAW5000A-I/O Series (CVSS 8.8, MOXA NPort IAW5000A-I/O) - [CVE-2020-25194](https://cve.now/CVE-2020-25194.md): MOXA NPort IAW5000A-I/O Series (CVSS 8.8, MOXA NPort IAW5000A-I/O) - [CVE-2020-25190](https://cve.now/CVE-2020-25190.md): MOXA NPort IAW5000A-I/O Series (CVSS 7.5, MOXA NPort IAW5000A-I/O) - [CVE-2020-35658](https://cve.now/CVE-2020-35658.md): SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted. (no CVSS) - [CVE-2020-35657](https://cve.now/CVE-2020-35657.md): Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP (no CVSS) - [CVE-2020-35656](https://cve.now/CVE-2020-35656.md): Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&re (no CVSS) - [CVE-2020-35665](https://cve.now/CVE-2020-35665.md): An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.