CVEs published December 27, 2020
13 CVEs were published on December 27, 2020: 0 critical, 2 high.
- Published
- 13
- Critical
- 0
- High
- 2
- Medium
- 0
- Low
- 0
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Backblaze
- 2
- autobahn
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- com.xuxueli:xxl-job-core
- 1
- Jiransecurity Spamsniper
- 1
- woocommerce/woocommerce
- 1
High 2
- CVE-2020-35728FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wlcom.fasterxml.jackson.core:jackson-databind
- CVE-2020-7845Jiransecurity Spamsniper Stack-based Buffer Overflow VulnerabilityJiransecurity Spamsniper
Medium, low and unrated 11
- CVE-2020-35736GateOne 1.1 allows arbitrary file download without authentication via /downloads/..
- CVE-2020-29156The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter woocommerce/woocommerce
- CVE-2020-29250CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.
- CVE-2020-29249CXUUCMS V3 allows class="layui-input" XSS.
- CVE-2020-29299Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action.
- CVE-2020-29204XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/com.xuxueli:xxl-job-core
- CVE-2020-35729KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
- CVE-2020-35448An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1.
- CVE-2020-8290Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack Backblaze
- CVE-2020-8289Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` Backblaze
- CVE-2020-35678Autobahn|Python before 20.12.3 allows redirect header injection.autobahn