# CVEs published 2020-12-29

105 CVEs were published on December 29, 2020: 5 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-10206](https://cve.now/CVE-2020-10206.md): Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx seri (no CVSS)
- [CVE-2020-10209](https://cve.now/CVE-2020-10209.md): Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx series, AK65x series, A (no CVSS)
- [CVE-2020-35777](https://cve.now/CVE-2020-35777.md): NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection. (CVSS 8.4)
- [CVE-2020-35778](https://cve.now/CVE-2020-35778.md): Certain NETGEAR devices are affected by CSRF. (CVSS 4.3)
- [CVE-2020-35779](https://cve.now/CVE-2020-35779.md): NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service. (CVSS 7.5)
- [CVE-2020-35780](https://cve.now/CVE-2020-35780.md): NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service. (CVSS 7.1)
- [CVE-2020-35781](https://cve.now/CVE-2020-35781.md): NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service. (CVSS 8.3)
- [CVE-2020-10208](https://cve.now/CVE-2020-10208.md): Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series an (no CVSS)
- [CVE-2020-35782](https://cve.now/CVE-2020-35782.md): Certain NETGEAR devices are affected by lack of access control at the function level. (CVSS 8.1)
- [CVE-2020-35783](https://cve.now/CVE-2020-35783.md): Certain NETGEAR devices are affected by lack of access control at the function level. (CVSS 6.5)
- [CVE-2020-35784](https://cve.now/CVE-2020-35784.md): Certain NETGEAR devices are affected by lack of access control at the function level. (CVSS 6.2)
- [CVE-2020-35785](https://cve.now/CVE-2020-35785.md): NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-2020-0365). (CVSS 8.3)
- [CVE-2020-35786](https://cve.now/CVE-2020-35786.md): NETGEAR R7800 devices before 1.0.2.74 are affected by a buffer overflow by an authenticated user. (CVSS 4.5)
- [CVE-2020-35787](https://cve.now/CVE-2020-35787.md): Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. (CVSS 8.0)
- [CVE-2020-35788](https://cve.now/CVE-2020-35788.md): NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user. (CVSS 7.6)
- [CVE-2020-35789](https://cve.now/CVE-2020-35789.md): NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user. (CVSS 8.8)
- [CVE-2020-35790](https://cve.now/CVE-2020-35790.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.4)
- [CVE-2020-35791](https://cve.now/CVE-2020-35791.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.4)
- [CVE-2020-35792](https://cve.now/CVE-2020-35792.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.3)
- [CVE-2020-35793](https://cve.now/CVE-2020-35793.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 6.1)
- [CVE-2020-35794](https://cve.now/CVE-2020-35794.md): Certain NETGEAR devices are affected by command injection by an authenticated user. (CVSS 8.4)
- [CVE-2020-35797](https://cve.now/CVE-2020-35797.md): NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker. (CVSS 9.8)
- [CVE-2020-35798](https://cve.now/CVE-2020-35798.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. (CVSS 9.3)
- [CVE-2020-35799](https://cve.now/CVE-2020-35799.md): Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-35801](https://cve.now/CVE-2020-35801.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 8.3)
- [CVE-2020-35802](https://cve.now/CVE-2020-35802.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 7.5)
- [CVE-2020-35803](https://cve.now/CVE-2020-35803.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 4.4)
- [CVE-2020-35804](https://cve.now/CVE-2020-35804.md): Certain NETGEAR devices are affected by disclosure of sensitive information. (CVSS 7.6)
- [CVE-2020-35805](https://cve.now/CVE-2020-35805.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35806](https://cve.now/CVE-2020-35806.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.0)
- [CVE-2020-35807](https://cve.now/CVE-2020-35807.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.0)
- [CVE-2020-35808](https://cve.now/CVE-2020-35808.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.8)
- [CVE-2020-35809](https://cve.now/CVE-2020-35809.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35810](https://cve.now/CVE-2020-35810.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35811](https://cve.now/CVE-2020-35811.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35812](https://cve.now/CVE-2020-35812.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35813](https://cve.now/CVE-2020-35813.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35814](https://cve.now/CVE-2020-35814.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35815](https://cve.now/CVE-2020-35815.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35816](https://cve.now/CVE-2020-35816.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35817](https://cve.now/CVE-2020-35817.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35818](https://cve.now/CVE-2020-35818.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35819](https://cve.now/CVE-2020-35819.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35820](https://cve.now/CVE-2020-35820.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35821](https://cve.now/CVE-2020-35821.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35822](https://cve.now/CVE-2020-35822.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35823](https://cve.now/CVE-2020-35823.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35824](https://cve.now/CVE-2020-35824.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35825](https://cve.now/CVE-2020-35825.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35826](https://cve.now/CVE-2020-35826.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35827](https://cve.now/CVE-2020-35827.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35828](https://cve.now/CVE-2020-35828.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35829](https://cve.now/CVE-2020-35829.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35830](https://cve.now/CVE-2020-35830.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35831](https://cve.now/CVE-2020-35831.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35832](https://cve.now/CVE-2020-35832.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35833](https://cve.now/CVE-2020-35833.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35834](https://cve.now/CVE-2020-35834.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35835](https://cve.now/CVE-2020-35835.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35836](https://cve.now/CVE-2020-35836.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35837](https://cve.now/CVE-2020-35837.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35838](https://cve.now/CVE-2020-35838.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.1)
- [CVE-2020-35839](https://cve.now/CVE-2020-35839.md): Certain NETGEAR devices are affected by Stored XSS. (CVSS 6.1)
- [CVE-2020-35840](https://cve.now/CVE-2020-35840.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.9)
- [CVE-2020-35841](https://cve.now/CVE-2020-35841.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.9)
- [CVE-2020-35842](https://cve.now/CVE-2020-35842.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.9)
- [CVE-2020-35795](https://cve.now/CVE-2020-35795.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 9.8)
- [CVE-2020-35796](https://cve.now/CVE-2020-35796.md): Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. (CVSS 8.8)
- [CVE-2020-35800](https://cve.now/CVE-2020-35800.md): Certain NETGEAR devices are affected by incorrect configuration of security settings. (CVSS 9.4)
- [CVE-2020-10207](https://cve.now/CVE-2020-10207.md): Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 (no CVSS)
- [CVE-2020-10210](https://cve.now/CVE-2020-10210.md): Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7 (no CVSS)
- [CVE-2020-10148](https://cve.now/CVE-2020-10148.md): SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands (CVSS 9.8, KEV, SolarWinds Orion Platform)
- [CVE-2020-27645](https://cve.now/CVE-2020-27645.md): The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\\1E\\Client\\Tachyon.Performance. (no CVSS)
- [CVE-2020-27644](https://cve.now/CVE-2020-27644.md): The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\\1E\\Client\\Tachyon.Performance. (no CVSS)
- [CVE-2020-27643](https://cve.now/CVE-2020-27643.md): The %PROGRAMDATA%\\1E\\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and m (no CVSS)
- [CVE-2020-16268](https://cve.now/CVE-2020-16268.md): The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the (no CVSS)
- [CVE-2020-35735](https://cve.now/CVE-2020-35735.md): Vidyo 02-09-/D allows clickjacking via the portal/ URI. (no CVSS)
- [CVE-2020-9223](https://cve.now/CVE-2020-9223.md): There is a denial of service vulnerability in some Huawei smartphones. (no CVSS, HONOR 20 PRO · Princeton-AL10D +2)
- [CVE-2020-9207](https://cve.now/CVE-2020-9207.md): There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. (no CVSS, Huawei CloudEngine)
- [CVE-2020-1848](https://cve.now/CVE-2020-1848.md): There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1). (no CVSS, Huawei Jackman-AL00D)
- [CVE-2020-35774](https://cve.now/CVE-2020-35774.md): server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS (no CVSS, com.twitter:twitter-server\_2.12)
- [CVE-2020-35773](https://cve.now/CVE-2020-35773.md): The site-offline plugin before 1.4.4 for WordPress lacks certain wp\_create\_nonce and wp\_verify\_nonce calls, aka CSRF. (no CVSS)
- [CVE-2020-9094](https://cve.now/CVE-2020-9094.md): There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. (no CVSS, Huawei CloudEngine)
- [CVE-2020-9208](https://cve.now/CVE-2020-9208.md): There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. (no CVSS, Huawei iManager NetEco)
- [CVE-2020-9093](https://cve.now/CVE-2020-9093.md): There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). (no CVSS, Huawei Taurus-AL00A)
- [CVE-2020-9125](https://cve.now/CVE-2020-9125.md): There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2). (no CVSS, HUAWEI Mate)
- [CVE-2020-9124](https://cve.now/CVE-2020-9124.md): There is a memory leak vulnerability in some versions of Huawei CloudEngine product. (no CVSS, Huawei CloudEngine)
- [CVE-2020-28280](https://cve.now/CVE-2020-28280.md): Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead t (no CVSS, predefine)
- [CVE-2020-28279](https://cve.now/CVE-2020-28279.md): Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead (no CVSS, flattenizer)
- [CVE-2020-28278](https://cve.now/CVE-2020-28278.md): Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to rem (no CVSS, shvl)
- [CVE-2020-28283](https://cve.now/CVE-2020-28283.md): Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead t (no CVSS, libnested)
- [CVE-2020-28282](https://cve.now/CVE-2020-28282.md): Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code e (no CVSS, getobject)
- [CVE-2020-28281](https://cve.now/CVE-2020-28281.md): Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may (no CVSS, set-object-value)
- [CVE-2020-28276](https://cve.now/CVE-2020-28276.md): Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to re (no CVSS, deep-set)
- [CVE-2020-28277](https://cve.now/CVE-2020-28277.md): Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote (no CVSS, dset)
- [CVE-2020-29470](https://cve.now/CVE-2020-29470.md): OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. (no CVSS, opencart/opencart)
- [CVE-2020-29471](https://cve.now/CVE-2020-29471.md): OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. (no CVSS, opencart/opencart)
- [CVE-2020-5807](https://cve.now/CVE-2020-5807.md): An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics ev (no CVSS, Rockwell FactoryTalk Diagnostics)
- [CVE-2020-5801](https://cve.now/CVE-2020-5801.md): An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDMana (no CVSS, Rockwell FactoryTalk Linx)
- [CVE-2020-5806](https://cve.now/CVE-2020-5806.md): An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest (no CVSS, Rockwell FactoryTalk Linx)
- [CVE-2020-5802](https://cve.now/CVE-2020-5802.md): An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted Configure (no CVSS, Rockwell FactoryTalk Linx)
- [CVE-2020-29475](https://cve.now/CVE-2020-29475.md): nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. (no CVSS)
- [CVE-2020-17533](https://cve.now/CVE-2020-17533.md): Apache Accumulo Improper Handling of Insufficient Permissions (no CVSS, Apache Software Foundation Apache Accumulo · org.apache.acc…)
- [CVE-2020-25847](https://cve.now/CVE-2020-25847.md): Command Injection Vulnerability in QTS and QuTS hero (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2020-35769](https://cve.now/CVE-2020-35769.md): miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.