CVEs published December 26, 2020
28 CVEs were published on December 26, 2020: 0 critical, 0 high.
- Published
- 28
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 0
Medium, low and unrated 28
- CVE-2020-35245Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.
- CVE-2020-35244Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.
- CVE-2020-35243Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.
- CVE-2020-35242Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.
- CVE-2020-29203struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT.
- CVE-2020-28759The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash.
- CVE-2020-35364Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting
- CVE-2020-35284Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfe
- CVE-2020-35362DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp.
- CVE-2020-35359Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.
- CVE-2020-35450Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls.
- CVE-2020-35437Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI
- CVE-2020-35349Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
- CVE-2020-35376Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::get
- CVE-2020-35347CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.
- CVE-2020-35346CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgu
- CVE-2020-35388rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool valu
- CVE-2020-35575A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to th
- CVE-2020-29385GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes.
- CVE-2020-29172A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setti
- CVE-2020-27515A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype
- CVE-2020-26766A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management
- CVE-2020-25917Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control.
- CVE-2020-35713Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metach
- CVE-2020-35714Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?comm
- CVE-2020-35715Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in
- CVE-2020-35716Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a l
- CVE-2020-20412lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a craft