# CVEs published 2020-12-27

13 CVEs were published on December 27, 2020: 0 critical, 2 high. Days are UTC.

- [CVE-2020-35736](https://cve.now/CVE-2020-35736.md): GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. (no CVSS)
- [CVE-2020-29156](https://cve.now/CVE-2020-29156.md): The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order\_id parameter (no CVSS, woocommerce/woocommerce)
- [CVE-2020-29250](https://cve.now/CVE-2020-29250.md): CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. (no CVSS)
- [CVE-2020-29249](https://cve.now/CVE-2020-29249.md): CXUUCMS V3 allows class="layui-input" XSS. (no CVSS)
- [CVE-2020-29299](https://cve.now/CVE-2020-29299.md): Certain Zyxel products allow command injection by an admin via an input string to chg\_exp\_pwd during a password-change action. (no CVSS)
- [CVE-2020-29204](https://cve.now/CVE-2020-29204.md): XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/ (no CVSS, com.xuxueli:xxl-job-core)
- [CVE-2020-35729](https://cve.now/CVE-2020-35729.md): KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter. (no CVSS)
- [CVE-2020-35728](https://cve.now/CVE-2020-35728.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wl (CVSS 8.1, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-35448](https://cve.now/CVE-2020-35448.md): An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. (no CVSS)
- [CVE-2020-7845](https://cve.now/CVE-2020-7845.md): Jiransecurity Spamsniper Stack-based Buffer Overflow Vulnerability (CVSS 8.1, Jiransecurity Spamsniper)
- [CVE-2020-8290](https://cve.now/CVE-2020-8290.md): Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in \`bztransmit\` helper due to lack (no CVSS, Backblaze)
- [CVE-2020-8289](https://cve.now/CVE-2020-8289.md): Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in \`bztransmit\` (no CVSS, Backblaze)
- [CVE-2020-35678](https://cve.now/CVE-2020-35678.md): Autobahn|Python before 20.12.3 allows redirect header injection. (no CVSS, autobahn)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.