# CVEs published 2020-12-26

28 CVEs were published on December 26, 2020: 0 critical, 0 high. Days are UTC.

- [CVE-2020-35245](https://cve.now/CVE-2020-35245.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser. (no CVSS)
- [CVE-2020-35244](https://cve.now/CVE-2020-35244.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup. (no CVSS)
- [CVE-2020-35243](https://cve.now/CVE-2020-35243.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb. (no CVSS)
- [CVE-2020-35242](https://cve.now/CVE-2020-35242.md): Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory. (no CVSS)
- [CVE-2020-29203](https://cve.now/CVE-2020-29203.md): struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J\_STRUCT\_GET\_string\_ELEMENT. (no CVSS)
- [CVE-2020-28759](https://cve.now/CVE-2020-28759.md): The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. (no CVSS)
- [CVE-2020-35364](https://cve.now/CVE-2020-35364.md): Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting (no CVSS)
- [CVE-2020-35284](https://cve.now/CVE-2020-35284.md): Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfe (no CVSS)
- [CVE-2020-35362](https://cve.now/CVE-2020-35362.md): DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. (no CVSS)
- [CVE-2020-35359](https://cve.now/CVE-2020-35359.md): Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit. (no CVSS)
- [CVE-2020-35450](https://cve.now/CVE-2020-35450.md): Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set\_language calls. (no CVSS)
- [CVE-2020-35437](https://cve.now/CVE-2020-35437.md): Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar\[path\] parameter in a POST request to the /\_core/profile/ URI (no CVSS)
- [CVE-2020-35349](https://cve.now/CVE-2020-35349.md): Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field\_title (aka a title on the custom fields page). (no CVSS)
- [CVE-2020-35376](https://cve.now/CVE-2020-35376.md): Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::get (no CVSS)
- [CVE-2020-35347](https://cve.now/CVE-2020-35347.md): CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add. (no CVSS)
- [CVE-2020-35346](https://cve.now/CVE-2020-35346.md): CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgu (no CVSS)
- [CVE-2020-35388](https://cve.now/CVE-2020-35388.md): rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool valu (no CVSS)
- [CVE-2020-35575](https://cve.now/CVE-2020-35575.md): A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to th (no CVSS)
- [CVE-2020-29385](https://cve.now/CVE-2020-29385.md): GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write\_indexes. (no CVSS)
- [CVE-2020-29172](https://cve.now/CVE-2020-29172.md): A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setti (no CVSS)
- [CVE-2020-27515](https://cve.now/CVE-2020-27515.md): A Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype (no CVSS)
- [CVE-2020-26766](https://cve.now/CVE-2020-26766.md): A Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul User Registration & Login and User Management (no CVSS)
- [CVE-2020-25917](https://cve.now/CVE-2020-25917.md): Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. (no CVSS)
- [CVE-2020-35713](https://cve.now/CVE-2020-35713.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metach (no CVSS)
- [CVE-2020-35714](https://cve.now/CVE-2020-35714.md): Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?comm (no CVSS)
- [CVE-2020-35715](https://cve.now/CVE-2020-35715.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in (no CVSS)
- [CVE-2020-35716](https://cve.now/CVE-2020-35716.md): Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent denial of service (segmentation fault) via a l (no CVSS)
- [CVE-2020-20412](https://cve.now/CVE-2020-20412.md): lib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has insufficient array bounds checking via a craft (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.