# CVEs published 2020-12-30 41 CVEs were published on December 30, 2020: 0 critical, 2 high. Days are UTC. - [CVE-2020-26291](https://cve.now/CVE-2020-26291.md): Hostname spoofing in URI.js (CVSS 6.5, medialize URI.js · urijs) - [CVE-2020-26296](https://cve.now/CVE-2020-26296.md): XSS in Vega (CVSS 8.7, vega) - [CVE-2020-27534](https://cve.now/CVE-2020-27534.md): util/binfmt\_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathna (no CVSS, github.com/moby/moby · github.com/docker/docker) - [CVE-2020-28413](https://cve.now/CVE-2020-28413.md): In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc\_project\_get\_users function through the API SOAP. (CVSS 5.3, mantisbt/mantisbt) - [CVE-2020-28095](https://cve.now/CVE-2020-28095.md): On Tenda AC1200 (Model AC6) 15.03.06.51\_multi devices, a large HTTP POST request sent to the change password API will trigger the router to (no CVSS) - [CVE-2020-11103](https://cve.now/CVE-2020-11103.md): JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution. (no CVSS) - [CVE-2019-16747](https://cve.now/CVE-2019-16747.md): In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and a daemon crash) via (no CVSS) - [CVE-2019-16281](https://cve.now/CVE-2019-16281.md): Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code block. (no CVSS) - [CVE-2019-15523](https://cve.now/CVE-2019-15523.md): An issue was discovered in LINBIT csync2 through 2.0. (no CVSS) - [CVE-2019-15080](https://cve.now/CVE-2019-15080.md): An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. (no CVSS) - [CVE-2019-15079](https://cve.now/CVE-2019-15079.md): A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. (no CVSS) - [CVE-2019-15078](https://cve.now/CVE-2019-15078.md): An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. (no CVSS) - [CVE-2020-35737](https://cve.now/CVE-2020-35737.md): In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information by manipulating the (no CVSS) - [CVE-2019-12953](https://cve.now/CVE-2019-12953.md): Dropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing valid usernames, a different issue than CVE-20 (no CVSS) - [CVE-2019-12768](https://cve.now/CVE-2019-12768.md): An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02\_J65H Hot Fix. (no CVSS) - [CVE-2020-26288](https://cve.now/CVE-2020-26288.md): Parse Server stores password in plain text (CVSS 7.7, parse-community parse-server · parse-server) - [CVE-2020-35173](https://cve.now/CVE-2020-35173.md): The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP server (aka services. (no CVSS) - [CVE-2020-28925](https://cve.now/CVE-2020-28925.md): Bolt before 3.7.2 does not restrict filter options in a Request in the Twig context, and is therefore inconsistent with the "How to Harden Y (no CVSS, bolt/bolt) - [CVE-2020-28736](https://cve.now/CVE-2020-28736.md): Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (there (no CVSS, plone · plone-app-event +3) - [CVE-2020-28735](https://cve.now/CVE-2020-28735.md): Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). (no CVSS, plone-app-dexterity · plone +3) - [CVE-2020-28734](https://cve.now/CVE-2020-28734.md): Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. (no CVSS, plone-app-theming · plone +3) - [CVE-2020-27848](https://cve.now/CVE-2020-27848.md): dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. (no CVSS) - [CVE-2020-29231](https://cve.now/CVE-2020-29231.md): EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Profile Page. (no CVSS) - [CVE-2020-29230](https://cve.now/CVE-2020-29230.md): EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting (XSS) in the Admin Panel - Manage (no CVSS) - [CVE-2020-28365](https://cve.now/CVE-2020-28365.md): Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS) vulnerability by inserting a payload within the X-Forwarded-For HTTP header during t (no CVSS) - [CVE-2020-29228](https://cve.now/CVE-2020-29228.md): EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Page. (no CVSS) - [CVE-2020-35849](https://cve.now/CVE-2020-35849.md): An issue was discovered in MantisBT before 2.24.4. (no CVSS, mantisbt/mantisbt) - [CVE-2020-5809](https://cve.now/CVE-2020-5809.md): A stored XSS vulnerability exists in Umbraco CMS \<= 8.9.1 or current. (no CVSS, Umbraco CMS · UmbracoCms.Core) - [CVE-2020-5810](https://cve.now/CVE-2020-5810.md): A stored XSS vulnerability exists in Umbraco CMS \<= 8.9.1 or current. (no CVSS, Umbraco CMS) - [CVE-2020-5811](https://cve.now/CVE-2020-5811.md): An authenticated path traversal vulnerability exists during package installation in Umbraco CMS \<= 8.9.1 or current, which could result in a (no CVSS, Umbraco CMS · UmbracoCms) - [CVE-2020-29233](https://cve.now/CVE-2020-29233.md): WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. (no CVSS) - [CVE-2020-29469](https://cve.now/CVE-2020-29469.md): WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. (no CVSS) - [CVE-2020-35241](https://cve.now/CVE-2020-35241.md): FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. (no CVSS) - [CVE-2020-35240](https://cve.now/CVE-2020-35240.md): FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. (no CVSS) - [CVE-2020-29477](https://cve.now/CVE-2020-29477.md): Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. (no CVSS) - [CVE-2020-29594](https://cve.now/CVE-2020-29594.md): Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML (no CVSS) - [CVE-2020-35850](https://cve.now/CVE-2020-35850.md): An SSRF issue was discovered in cockpit-project.org Cockpit 234. (no CVSS) - [CVE-2020-35846](https://cve.now/CVE-2020-35846.md): Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. (no CVSS) - [CVE-2020-35848](https://cve.now/CVE-2020-35848.md): Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. (no CVSS) - [CVE-2020-35847](https://cve.now/CVE-2020-35847.md): Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. (no CVSS) - [CVE-2020-26247](https://cve.now/CVE-2020-26247.md): XXE in Nokogiri (CVSS 2.6, sparklemotion nokogiri · nokogiri) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-30 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.