# CVEs published 2020-12-25

10 CVEs were published on December 25, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-35712](https://cve.now/CVE-2020-35712.md): Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations. (no CVSS)
- [CVE-2020-35711](https://cve.now/CVE-2020-35711.md): An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. (no CVSS, arc-swap)
- [CVE-2020-35710](https://cve.now/CVE-2020-35710.md): Parallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP address because submission of the login form (no CVSS)
- [CVE-2020-35709](https://cve.now/CVE-2020-35709.md): bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application/octet-stream") to ../media/images/ via the (no CVSS)
- [CVE-2020-35704](https://cve.now/CVE-2020-35704.md): Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen. (no CVSS)
- [CVE-2020-35705](https://cve.now/CVE-2020-35705.md): Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen. (no CVSS)
- [CVE-2020-35706](https://cve.now/CVE-2020-35706.md): Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen. (no CVSS)
- [CVE-2020-35707](https://cve.now/CVE-2020-35707.md): Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen. (no CVSS)
- [CVE-2020-35708](https://cve.now/CVE-2020-35708.md): phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. (no CVSS)
- [CVE-2020-35702](https://cve.now/CVE-2020-35702.md): DCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a crafted PDF document. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.