CVEs published December 30, 2020
41 CVEs were published on December 30, 2020: 0 critical, 2 high.
- Published
- 41
- Critical
- 0
- High
- 2
- Medium
- 2
- Low
- 1
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- mantisbt/mantisbt
- 2
- bolt/bolt
- 1
- github.com/moby/moby · github.com/docker/docker
- 1
- medialize URI.js · urijs
- 1
- parse-community parse-server · parse-server
- 1
- plone · plone-app-event +3
- 1
- plone-app-dexterity · plone +3
- 1
- plone-app-theming · plone +3
- 1
- sparklemotion nokogiri · nokogiri
- 1
- Umbraco CMS
- 1
High 2
Medium, low and unrated 39
- CVE-2020-26291Hostname spoofing in URI.jsmedialize URI.js · urijs
- CVE-2020-27534util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathnagithub.com/moby/moby · github.com/docker/docker
- CVE-2020-28413In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.mantisbt/mantisbt
- CVE-2020-28095On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will trigger the router to
- CVE-2020-11103JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.
- CVE-2019-16747In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via
- CVE-2019-16281Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block.
- CVE-2019-15523An issue was discovered in LINBIT csync2 through 2.0.
- CVE-2019-15080An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token.
- CVE-2019-15079A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token.
- CVE-2019-15078An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token.
- CVE-2020-35737In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the
- CVE-2019-12953Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-20
- CVE-2019-12768An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix.
- CVE-2020-35173The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services.
- CVE-2020-28925Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Ybolt/bolt
- CVE-2020-28736Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (thereplone · plone-app-event +3
- CVE-2020-28735Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).plone-app-dexterity · plone +3
- CVE-2020-28734Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.plone-app-theming · plone +3
- CVE-2020-27848dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter.
- CVE-2020-29231EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page.
- CVE-2020-29230EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage
- CVE-2020-28365Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during t
- CVE-2020-29228EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page.
- CVE-2020-35849An issue was discovered in MantisBT before 2.24.4.mantisbt/mantisbt
- CVE-2020-5809A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.Umbraco CMS · UmbracoCms.Core
- CVE-2020-5810A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.Umbraco CMS
- CVE-2020-5811An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in aUmbraco CMS · UmbracoCms
- CVE-2020-29233WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component.
- CVE-2020-29469WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component.
- CVE-2020-35241FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component.
- CVE-2020-35240FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component.
- CVE-2020-29477Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field.
- CVE-2020-29594Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML
- CVE-2020-35850An SSRF issue was discovered in cockpit-project.org Cockpit 234.
- CVE-2020-35846Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.
- CVE-2020-35848Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
- CVE-2020-35847Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.
- CVE-2020-26247XXE in Nokogirisparklemotion nokogiri · nokogiri