CVEs published December 24, 2020
52 CVEs were published on December 24, 2020: 2 critical, 1 high.
- Published
- 52
- Critical
- 2
- High
- 1
- Medium
- 2
- Low
- 1
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- BIG-IP APM
- 6
- QNAP Systems QES
- 4
- BIG-IP
- 3
- BIG-IP ASM & Advanced WAF
- 2
- BIG-IP AFM
- 1
- BIG-IP DNS
- 1
- BIG-IP DNS, GTM, and Link Controller
- 1
- BIG-IP GTM & DNS
- 1
- BIG-IP LTM/CGNAT
- 1
- browserup-proxy · com.browserup:browserup-proxy
- 1
Critical 2
High 1
Medium, low and unrated 49
- CVE-2020-28912With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an a
- CVE-2020-29474EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability.
- CVE-2020-29472EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability.
- CVE-2020-29247WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel.
- CVE-2020-35693On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) devic
- CVE-2020-24658Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays.
- CVE-2020-35659The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS.
- CVE-2020-35679smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak v
- CVE-2020-35680smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointe
- CVE-2020-9120CloudEngine 1800V versions V100R019C10SPC500 has a resource management error vulnerability.CloudEngine
- CVE-2020-9119There is a privilege escalation vulnerability on some Huawei smart phones due to design defects.HUAWEI Mate 10;HUAWEI Mate 30;HUAWEI Mate 30 Pro;HUAWEI P40…
- CVE-2020-9137There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2020-9201There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500.NIP6800;Secospace USG6600;USG9500
- CVE-2020-9202There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100.TE Mobile
- CVE-2020-9200There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00.iManager NetEco
- CVE-2020-27728On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, BIG-IP ASM & Advanced WAF
- CVE-2020-27729In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on tBIG-IP APM
- CVE-2020-27719On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of tBIG-IP
- CVE-2020-27720On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port BlBIG-IP LTM/CGNAT
- CVE-2020-27722In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe pluginBIG-IP APM
- CVE-2020-27717On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may BIG-IP DNS
- CVE-2020-27714On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 viBIG-IP AFM
- CVE-2020-27723In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the TraffBIG-IP APM
- CVE-2020-27715On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU BIG-IP
- CVE-2020-27716On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processeBIG-IP APM
- CVE-2020-27726In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vuBIG-IP APM
- CVE-2020-27727On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RBIG-IP
- CVE-2020-27725In version 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 of BIG-IP DNS, GTM, and Link Controller, zxBIG-IP DNS, GTM, and Link Controller
- CVE-2020-27724In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5BIG-IP APM
- CVE-2020-27718When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, BIG-IP ASM & Advanced WAF
- CVE-2020-27721In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LBIG-IP GTM & DNS
- CVE-2020-29189Incorrect Access Control vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated attackers to bypass read-only restriction an
- CVE-2020-28169The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a use
- CVE-2020-28190TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP).
- CVE-2020-28187Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read, edit or delete any f
- CVE-2020-28186Email Injection in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve
- CVE-2020-28184Cross-site scripting (XSS) vulnerability in TerraMaster TOS <= 4.2.06 allows remote authenticated users to inject arbitrary web script or HT
- CVE-2020-28185User Enumeration vulnerability in TerraMaster TOS <= 4.2.06 allows remote unauthenticated attackers to identify valid users within the syste
- CVE-2020-35674BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordReset.php (the endpoin
- CVE-2020-35675BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups.
- CVE-2020-35676BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration func
- CVE-2020-35677BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEdi
- CVE-2020-35669An issue was discovered in the http package through 0.12.2 for Dart.
- CVE-2020-2505Sensitive information via generation of error messages vulnerability in QESQNAP Systems QES
- CVE-2020-2504Absolute path traversal vulnerability in QESQNAP Systems QES
- CVE-2020-2499Hard-coded Password Vulnerability in QESQNAP Systems QES
- CVE-2020-5681Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynerSEIKO EPSON EpsonNet SetupManager and Offirio SynergyWare P…
- CVE-2020-5684iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificManagement software for NEC Storage disk array system
- CVE-2020-28188Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /