CVEs published December 29, 2020
105 CVEs were published on December 29, 2020: 5 critical, 17 high. 1 is now in CISA KEV.
- Published
- 105
- Critical
- 5
- High
- 17
- Medium
- 46
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- Huawei CloudEngine
- 3
- Rockwell FactoryTalk Linx
- 3
- opencart/opencart
- 2
- Apache Software Foundation Apache Accumulo · org.apache.acc…
- 1
- com.twitter:twitter-server_2.12
- 1
- deep-set
- 1
- dset
- 1
- flattenizer
- 1
- getobject
- 1
- HONOR 20 PRO · Princeton-AL10D +2
- 1
Critical 5
- CVE-2020-35797NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker.
- CVE-2020-35798Certain NETGEAR devices are affected by command injection by an unauthenticated attacker.
- CVE-2020-35795Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2020-35800Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-10148SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commandsSolarWinds Orion Platform
High 17
- CVE-2020-35777NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.
- CVE-2020-35779NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
- CVE-2020-35780NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
- CVE-2020-35781NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.
- CVE-2020-35782Certain NETGEAR devices are affected by lack of access control at the function level.
- CVE-2020-35785NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365).
- CVE-2020-35787Certain NETGEAR devices are affected by a buffer overflow by an authenticated user.
- CVE-2020-35788NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user.
- CVE-2020-35789NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user.
- CVE-2020-35792Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-35794Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-35799Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker.
- CVE-2020-35801Certain NETGEAR devices are affected by incorrect configuration of security settings.
- CVE-2020-35802Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-35804Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-35796Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker.
- CVE-2020-25847Command Injection Vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
Medium, low and unrated 83
- CVE-2020-10206Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx seri
- CVE-2020-10209Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, A
- CVE-2020-35778Certain NETGEAR devices are affected by CSRF.
- CVE-2020-10208Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series an
- CVE-2020-35783Certain NETGEAR devices are affected by lack of access control at the function level.
- CVE-2020-35784Certain NETGEAR devices are affected by lack of access control at the function level.
- CVE-2020-35786NETGEAR R7800 devices before 1.0.2.74 are affected by a buffer overflow by an authenticated user.
- CVE-2020-35790Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-35791Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-35793Certain NETGEAR devices are affected by command injection by an authenticated user.
- CVE-2020-35803Certain NETGEAR devices are affected by disclosure of sensitive information.
- CVE-2020-35805Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35806Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35807Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35808Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35809Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35810Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35811Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35812Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35813Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35814Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35815Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35816Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35817Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35818Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35819Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35820Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35821Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35822Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35823Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35824Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35825Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35826Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35827Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35828Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35829Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35830Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35831Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35832Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35833Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35834Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35835Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35836Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35837Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35838Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35839Certain NETGEAR devices are affected by Stored XSS.
- CVE-2020-35840Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35841Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-35842Certain NETGEAR devices are affected by stored XSS.
- CVE-2020-10207Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7
- CVE-2020-10210Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7
- CVE-2020-27645The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.
- CVE-2020-27644The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.
- CVE-2020-27643The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and m
- CVE-2020-16268The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the
- CVE-2020-35735Vidyo 02-09-/D allows clickjacking via the portal/ URI.
- CVE-2020-9223There is a denial of service vulnerability in some Huawei smartphones.HONOR 20 PRO · Princeton-AL10D +2
- CVE-2020-9207There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product.Huawei CloudEngine
- CVE-2020-1848There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1).Huawei Jackman-AL00D
- CVE-2020-35774server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS com.twitter:twitter-server_2.12
- CVE-2020-35773The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.
- CVE-2020-9094There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product.Huawei CloudEngine
- CVE-2020-9208There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00.Huawei iManager NetEco
- CVE-2020-9093There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1).Huawei Taurus-AL00A
- CVE-2020-9125There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2).HUAWEI Mate
- CVE-2020-9124There is a memory leak vulnerability in some versions of Huawei CloudEngine product.Huawei CloudEngine
- CVE-2020-28280Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead tpredefine
- CVE-2020-28279Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may leadflattenizer
- CVE-2020-28278Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remshvl
- CVE-2020-28283Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead tlibnested
- CVE-2020-28282Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code egetobject
- CVE-2020-28281Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and mayset-object-value
- CVE-2020-28276Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to redeep-set
- CVE-2020-28277Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remotedset
- CVE-2020-29470OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail.opencart/opencart
- CVE-2020-29471OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image.opencart/opencart
- CVE-2020-5807An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics evRockwell FactoryTalk Diagnostics
- CVE-2020-5801An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManaRockwell FactoryTalk Linx
- CVE-2020-5806An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequestRockwell FactoryTalk Linx
- CVE-2020-5802An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureRockwell FactoryTalk Linx
- CVE-2020-29475nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field.
- CVE-2020-17533Apache Accumulo Improper Handling of Insufficient PermissionsApache Software Foundation Apache Accumulo · org.apache.acc…
- CVE-2020-35769miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.