CVEs published December 28, 2020
45 CVEs were published on December 28, 2020: 1 critical, 3 high. 1 is now in CISA KEV.
- Published
- 45
- Critical
- 1
- High
- 3
- Medium
- 1
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- Joomla! Project Joomla! CMS
- 7
- github.com/dhowden/tag
- 4
- hedgedoc
- 2
- dexidp dex · github.com/dexidp/dex +1
- 1
- gdm
- 1
- HCL Domino
- 1
- knowledgecode date-and-time · date-and-time
- 1
Critical 1
High 3
Medium, low and unrated 41
- CVE-2020-13476NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.
- CVE-2020-13474In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functional
- CVE-2020-13473NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.
- CVE-2020-27172An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file restore mechanism to achi
- CVE-2020-35616[20201107] - Core - Write ACL violation in multiple core viewsJoomla! Project Joomla! CMS
- CVE-2020-35615[20201106] - Core - CSRF in com_privacy emailexport featureJoomla! Project Joomla! CMS
- CVE-2020-35614[20201105] - Core - User Enumeration in backend loginJoomla! Project Joomla! CMS
- CVE-2020-35613[20201104] - Core - SQL injection in com_users list viewJoomla! Project Joomla! CMS
- CVE-2020-35612[20201103] - Core - Path traversal in mod_random_imageJoomla! Project Joomla! CMS
- CVE-2020-35611[20201102] - Core - Disclosure of secrets in Global Configuration pageJoomla! Project Joomla! CMS
- CVE-2020-35610[20201101] - Core - com_finder ignores access levels on autosuggestJoomla! Project Joomla! CMS
- CVE-2020-35730An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10.
- CVE-2020-25507An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to ex
- CVE-2020-35766The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack against the /tmp/testkey
- CVE-2020-14273HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its public API.HCL Domino
- CVE-2020-27837A flaw was found in GDM in versions prior to 3.38.2.1.gdm
- CVE-2020-15898In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction.
- CVE-2020-24360An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issues that cause a kern
- CVE-2020-26569In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incor
- CVE-2020-35627Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that can remotely execute a
- CVE-2020-26028An issue was discovered in Zammad before 3.4.1.
- CVE-2020-26029An issue was discovered in Zammad before 3.4.1.
- CVE-2020-26030An issue was discovered in Zammad before 3.4.1.
- CVE-2020-26031An issue was discovered in Zammad before 3.4.1.
- CVE-2020-26032An SSRF issue was discovered in Zammad before 3.4.1.
- CVE-2020-26033An issue was discovered in Zammad before 3.4.1.
- CVE-2020-26034An account-enumeration issue was discovered in Zammad before 3.4.1.
- CVE-2020-26035An issue was discovered in Zammad before 3.4.1.
- CVE-2020-29158An issue was discovered in Zammad before 3.5.1.
- CVE-2020-29159An issue was discovered in Zammad before 3.5.1.
- CVE-2020-29160An issue was discovered in Zammad before 3.5.1.
- CVE-2020-29245dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.github.com/dhowden/tag
- CVE-2020-29244dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.github.com/dhowden/tag
- CVE-2020-29243dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.github.com/dhowden/tag
- CVE-2020-29242dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.github.com/dhowden/tag
- CVE-2020-29194Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a physical reset to resto
- CVE-2020-29193Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboard row in reverse or
- CVE-2020-28096FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.
- CVE-2020-28094On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to download malware name
- CVE-2020-28093On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.
- CVE-2020-35738WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a malloc argument.