CVEs published December 25, 2020
10 CVEs were published on December 25, 2020: 0 critical, 0 high.
- Published
- 10
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 1
Most affected products
- arc-swap
- 1
Medium, low and unrated 10
- CVE-2020-35712Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.
- CVE-2020-35711An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust.arc-swap
- CVE-2020-35710Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form
- CVE-2020-35709bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the
- CVE-2020-35704Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
- CVE-2020-35705Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
- CVE-2020-35706Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
- CVE-2020-35707Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
- CVE-2020-35708phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
- CVE-2020-35702DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document.