# CVEs published 2020-12-24

52 CVEs were published on December 24, 2020: 2 critical, 1 high. Days are UTC.

- [CVE-2020-26282](https://cve.now/CVE-2020-26282.md): Template Injection in BrowserUp Proxy (CVSS 10.0, browserup-proxy · com.browserup:browserup-proxy)
- [CVE-2020-11093](https://cve.now/CVE-2020-11093.md): Authorization bypass in Hyperledger Indy (CVSS 7.5, hyperledger indy-node · indy-node)
- [CVE-2020-28912](https://cve.now/CVE-2020-28912.md): With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an a (no CVSS)
- [CVE-2020-29474](https://cve.now/CVE-2020-29474.md): EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. (no CVSS)
- [CVE-2020-29472](https://cve.now/CVE-2020-29472.md): EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. (no CVSS)
- [CVE-2020-29247](https://cve.now/CVE-2020-29247.md): WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. (no CVSS)
- [CVE-2020-35693](https://cve.now/CVE-2020-35693.md): On some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker-controlled Bluetooth Low Energy (BLE) devic (no CVSS)
- [CVE-2020-24658](https://cve.now/CVE-2020-24658.md): Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. (no CVSS)
- [CVE-2020-35659](https://cve.now/CVE-2020-35659.md): The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. (no CVSS)
- [CVE-2020-35679](https://cve.now/CVE-2020-35679.md): smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak v (no CVSS)
- [CVE-2020-35680](https://cve.now/CVE-2020-35680.md): smtpd/lka\_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointe (no CVSS)
- [CVE-2020-9120](https://cve.now/CVE-2020-9120.md): CloudEngine 1800V versions V100R019C10SPC500 has a resource management error vulnerability. (no CVSS, CloudEngine)
- [CVE-2020-9119](https://cve.now/CVE-2020-9119.md): There is a privilege escalation vulnerability on some Huawei smart phones due to design defects. (no CVSS, HUAWEI Mate 10;HUAWEI Mate 30;HUAWEI Mate 30 Pro;HUAWEI P40…)
- [CVE-2020-9137](https://cve.now/CVE-2020-9137.md): There is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine 5800,CloudEngine 6800 and CloudEngine 7800. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2020-9201](https://cve.now/CVE-2020-9201.md): There is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and USG9500. (no CVSS, NIP6800;Secospace USG6600;USG9500)
- [CVE-2020-9202](https://cve.now/CVE-2020-9202.md): There is an information disclosure vulnerability in TE Mobile software versions V600R006C10,V600R006C10SPC100. (no CVSS, TE Mobile)
- [CVE-2020-9200](https://cve.now/CVE-2020-9200.md): There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. (no CVSS, iManager NetEco)
- [CVE-2020-27728](https://cve.now/CVE-2020-27728.md): On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, (no CVSS, BIG-IP ASM & Advanced WAF)
- [CVE-2020-27729](https://cve.now/CVE-2020-27729.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on t (no CVSS, BIG-IP APM)
- [CVE-2020-27719](https://cve.now/CVE-2020-27719.md): On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of t (no CVSS, BIG-IP)
- [CVE-2020-27720](https://cve.now/CVE-2020-27720.md): On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Bl (no CVSS, BIG-IP LTM/CGNAT)
- [CVE-2020-27722](https://cve.now/CVE-2020-27722.md): In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin (no CVSS, BIG-IP APM)
- [CVE-2020-27717](https://cve.now/CVE-2020-27717.md): On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may (no CVSS, BIG-IP DNS)
- [CVE-2020-27714](https://cve.now/CVE-2020-27714.md): On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 vi (no CVSS, BIG-IP AFM)
- [CVE-2020-27723](https://cve.now/CVE-2020-27723.md): In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traff (no CVSS, BIG-IP APM)
- [CVE-2020-27715](https://cve.now/CVE-2020-27715.md): On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU (no CVSS, BIG-IP)
- [CVE-2020-27716](https://cve.now/CVE-2020-27716.md): On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processe (no CVSS, BIG-IP APM)
- [CVE-2020-27726](https://cve.now/CVE-2020-27726.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vu (no CVSS, BIG-IP APM)
- [CVE-2020-27727](https://cve.now/CVE-2020-27727.md): On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs R (no CVSS, BIG-IP)
- [CVE-2020-27725](https://cve.now/CVE-2020-27725.md): In version 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 of BIG-IP DNS, GTM, and Link Controller, zx (no CVSS, BIG-IP DNS, GTM, and Link Controller)
- [CVE-2020-27724](https://cve.now/CVE-2020-27724.md): In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5 (no CVSS, BIG-IP APM)
- [CVE-2020-27718](https://cve.now/CVE-2020-27718.md): When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, (no CVSS, BIG-IP ASM & Advanced WAF)
- [CVE-2020-27721](https://cve.now/CVE-2020-27721.md): In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP L (no CVSS, BIG-IP GTM & DNS)
- [CVE-2020-29189](https://cve.now/CVE-2020-29189.md): Incorrect Access Control vulnerability in TerraMaster TOS \<= 4.2.06 allows remote authenticated attackers to bypass read-only restriction an (no CVSS)
- [CVE-2020-28169](https://cve.now/CVE-2020-28169.md): The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a use (no CVSS)
- [CVE-2020-28190](https://cve.now/CVE-2020-28190.md): TerraMaster TOS \<= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). (no CVSS)
- [CVE-2020-28187](https://cve.now/CVE-2020-28187.md): Multiple directory traversal vulnerabilities in TerraMaster TOS \<= 4.2.06 allow remote authenticated attackers to read, edit or delete any f (no CVSS)
- [CVE-2020-28186](https://cve.now/CVE-2020-28186.md): Email Injection in TerraMaster TOS \<= 4.2.06 allows remote unauthenticated attackers to abuse the forget password functionality and achieve (no CVSS)
- [CVE-2020-28184](https://cve.now/CVE-2020-28184.md): Cross-site scripting (XSS) vulnerability in TerraMaster TOS \<= 4.2.06 allows remote authenticated users to inject arbitrary web script or HT (no CVSS)
- [CVE-2020-28185](https://cve.now/CVE-2020-28185.md): User Enumeration vulnerability in TerraMaster TOS \<= 4.2.06 allows remote unauthenticated attackers to identify valid users within the syste (no CVSS)
- [CVE-2020-35674](https://cve.now/CVE-2020-35674.md): BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership\_passwordReset.php (the endpoin (no CVSS)
- [CVE-2020-35675](https://cve.now/CVE-2020-35675.md): BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of members across groups. (no CVSS)
- [CVE-2020-35676](https://cve.now/CVE-2020-35676.md): BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration func (no CVSS)
- [CVE-2020-35677](https://cve.now/CVE-2020-35677.md): BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEdi (no CVSS)
- [CVE-2020-35669](https://cve.now/CVE-2020-35669.md): An issue was discovered in the http package through 0.12.2 for Dart. (no CVSS)
- [CVE-2020-2505](https://cve.now/CVE-2020-2505.md): Sensitive information via generation of error messages vulnerability in QES (CVSS 2.3, QNAP Systems QES)
- [CVE-2020-2504](https://cve.now/CVE-2020-2504.md): Absolute path traversal vulnerability in QES (CVSS 5.8, QNAP Systems QES)
- [CVE-2020-2503](https://cve.now/CVE-2020-2503.md): Stored cross-site scripting vulnerability in QES (CVSS 9.0, QNAP Systems QES)
- [CVE-2020-2499](https://cve.now/CVE-2020-2499.md): Hard-coded Password Vulnerability in QES (CVSS 6.3, QNAP Systems QES)
- [CVE-2020-5681](https://cve.now/CVE-2020-5681.md): Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio Syner (no CVSS, SEIKO EPSON EpsonNet SetupManager and Offirio SynergyWare P…)
- [CVE-2020-5684](https://cve.now/CVE-2020-5684.md): iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certific (no CVSS, Management software for NEC Storage disk array system)
- [CVE-2020-28188](https://cve.now/CVE-2020-28188.md): Remote Command Execution (RCE) vulnerability in TerraMaster TOS \<= 4.2.06 allow remote unauthenticated attackers to inject OS commands via / (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.