CVEs published December 31, 2020
133 CVEs were published on December 31, 2020: 1 critical, 12 high.
- Published
- 133
- Critical
- 1
- High
- 12
- Medium
- 0
- Low
- 0
- Unrated
- 120
- Now in CISA KEV
- 0
- Fix available
- 77
Most affected products
- rusqlite
- 8
- HGiga MailSherlock MSR45/SSR45
- 7
- CHANGING NHIServiSignAdapter
- 5
- lock_api
- 5
- OPPO Find X2
- 4
- arr
- 3
- flatbuffers
- 2
- futures-task
- 2
- futures-util
- 2
- net2 · socket2
- 2
Critical 1
High 12
- CVE-2020-35851HGiga MailSherlock - Command InjectionHGiga MailSherlock MSR45/SSR45
- CVE-2020-35743HGiga MailSherlock - SQL Injection -3HGiga MailSherlock MSR45/SSR45
- CVE-2020-35742HGiga MailSherlock - SQL Injection -1HGiga MailSherlock MSR45/SSR45
- CVE-2020-35741HGiga MailSherlock - XSS -2HGiga MailSherlock MSR45/SSR45
- CVE-2020-35740HGiga MailSherlock - XSS -1HGiga MailSherlock MSR45/SSR45
- CVE-2020-25850HGiga MailSherlock - Arbitrary File DownloadHGiga MailSherlock MSR45/SSR45
- CVE-2020-25846CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2CHANGING NHIServiSignAdapter
- CVE-2020-25845CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1CHANGING NHIServiSignAdapter
- CVE-2020-25844CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack OverflowCHANGING NHIServiSignAdapter
- CVE-2020-25843CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap OverflowCHANGING NHIServiSignAdapter
- CVE-2020-25842CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File AccessCHANGING NHIServiSignAdapter
- CVE-2020-13654XWiki Platform before 12.8 mishandles escaping in the property displayer.org.xwiki.platform:xwiki-platform-web
Medium, low and unrated 120
- CVE-2019-25012The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page.
- CVE-2018-25002uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024.
- CVE-2017-20001The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from decrypting data, aka SA-CONTRIB-2017-027.
- CVE-2016-20001The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033.
- CVE-2016-20002The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033.
- CVE-2016-20003The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033.
- CVE-2016-20004The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033.
- CVE-2016-20005The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033.
- CVE-2016-20006The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033.
- CVE-2016-20007The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033.
- CVE-2016-20008The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033.
- CVE-2020-26165qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class
- CVE-2020-35931An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and be
- CVE-2019-25011NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dc
- CVE-2020-35930Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI.
- CVE-2020-11835In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check the parameter buf in the function proc_work_OPPO Find X2
- CVE-2020-11834In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function proc_fastchg_fw_update_write in proc_fastchg_fw_update_write OPPO Find X2
- CVE-2020-11833In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function mp2650_data_log_write in mp2650_data_log_write dOPPO Find X2
- CVE-2020-11832In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_charger.c OPPO Find X2
- CVE-2020-25799LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page.
- CVE-2020-25797LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters).
- CVE-2018-19945Improper Limitation of a Pathname to a Restricted Directory in QTSQNAP Systems QTS
- CVE-2018-19944Cleartext Transmission of Sensitive Information in SNMPQNAP Systems QTS
- CVE-2018-19941Cleartext Storage of Sensitive Information in CookiesQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2018-25001An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust.libpulse-binding
- CVE-2019-25001An issue was discovered in the serde_cbor crate before 0.10.2 for Rust.serde_cbor
- CVE-2019-25002An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust.sodiumoxide
- CVE-2019-25003An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust.libsecp256k1
- CVE-2019-25004An issue was discovered in the flatbuffers crate before 0.6.1 for Rust.flatbuffers
- CVE-2019-25005An issue was discovered in the chacha20 crate before 0.2.3 for Rust.chacha20
- CVE-2019-25006An issue was discovered in the streebog crate before 0.8.0 for Rust.streebog
- CVE-2019-25007An issue was discovered in the streebog crate before 0.8.0 for Rust.streebog
- CVE-2019-25009An issue was discovered in the http crate before 0.1.20 for Rust.http
- CVE-2019-25010An issue was discovered in the failure crate through 2019-11-13 for Rust.failure
- CVE-2020-35858An issue was discovered in the prost crate before 0.6.1 for Rust.prost
- CVE-2020-35859An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust.lucet-runtime-internals
- CVE-2020-35860An issue was discovered in the cbox crate through 2020-03-19 for Rust.cbox
- CVE-2020-35861An issue was discovered in the bumpalo crate before 3.2.1 for Rust.bumpalo
- CVE-2020-35862An issue was discovered in the bitvec crate before 0.17.4 for Rust.bitvec
- CVE-2020-35863An issue was discovered in the hyper crate before 0.12.34 for Rust.hyper
- CVE-2020-35864An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust.flatbuffers
- CVE-2020-35865An issue was discovered in the os_str_bytes crate before 2.0.0 for Rust.os_str_bytes
- CVE-2020-35866An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35867An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35868An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35869An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35870An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35871An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35872An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35873An issue was discovered in the rusqlite crate before 0.23.0 for Rust.rusqlite
- CVE-2020-35874An issue was discovered in the internment crate through 2020-05-28 for Rust.internment
- CVE-2020-35875An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust.tokio-rustls
- CVE-2020-35876An issue was discovered in the rio crate through 2020-05-11 for Rust.rio
- CVE-2020-35877An issue was discovered in the ozone crate through 2020-07-04 for Rust.ozone
- CVE-2020-35878An issue was discovered in the ozone crate through 2020-07-04 for Rust.ozone
- CVE-2020-35879An issue was discovered in the rulinalg crate through 2020-02-11 for Rust.rulinalg
- CVE-2020-35880An issue was discovered in the bigint crate through 2020-05-07 for Rust.bigint
- CVE-2020-35881An issue was discovered in the traitobject crate through 2020-06-01 for Rust.traitobject
- CVE-2020-35882An issue was discovered in the rocket crate before 0.4.5 for Rust.rocket
- CVE-2020-35883An issue was discovered in the mozwire crate through 2020-08-18 for Rust.mozwire
- CVE-2020-35884An issue was discovered in the tiny_http crate through 2020-06-16 for Rust.tiny_http
- CVE-2020-35885An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust.alpm-rs
- CVE-2020-35886An issue was discovered in the arr crate through 2020-08-25 for Rust.arr
- CVE-2020-35887An issue was discovered in the arr crate through 2020-08-25 for Rust.arr
- CVE-2020-35888An issue was discovered in the arr crate through 2020-08-25 for Rust.arr
- CVE-2020-35889An issue was discovered in the crayon crate through 2020-08-31 for Rust.crayon
- CVE-2020-35890An issue was discovered in the ordnung crate through 2020-09-03 for Rust.ordnung
- CVE-2020-35891An issue was discovered in the ordnung crate through 2020-09-03 for Rust.ordnung
- CVE-2020-35892An issue was discovered in the simple-slab crate before 0.3.3 for Rust.simple-slab
- CVE-2020-35893An issue was discovered in the simple-slab crate before 0.3.3 for Rust.simple-slab
- CVE-2020-35894An issue was discovered in the obstack crate before 0.1.4 for Rust.obstack
- CVE-2020-35895An issue was discovered in the stack crate before 0.3.1 for Rust.stack
- CVE-2020-35896An issue was discovered in the ws crate through 2020-09-25 for Rust.ws
- CVE-2020-35897An issue was discovered in the atom crate before 0.3.6 for Rust.atom
- CVE-2020-35898An issue was discovered in the actix-utils crate before 2.0.0 for Rust.actix-utils
- CVE-2020-35899An issue was discovered in the actix-service crate before 1.0.6 for Rust.actix-service
- CVE-2020-35900An issue was discovered in the array-queue crate through 2020-09-26 for Rust.array-queue
- CVE-2020-35901An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust.actix-http
- CVE-2020-35902An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust.actix-codec
- CVE-2020-35903An issue was discovered in the dync crate before 0.5.0 for Rust.dync
- CVE-2020-35904An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust.crossbeam-channel
- CVE-2020-35905An issue was discovered in the futures-util crate before 0.3.7 for Rust.futures-util
- CVE-2020-35906An issue was discovered in the futures-task crate before 0.3.6 for Rust.futures-task
- CVE-2020-35907An issue was discovered in the futures-task crate before 0.3.5 for Rust.futures-task
- CVE-2020-35908An issue was discovered in the futures-util crate before 0.3.2 for Rust.futures-util
- CVE-2020-35909An issue was discovered in the multihash crate before 0.11.3 for Rust.multihash
- CVE-2020-35910An issue was discovered in the lock_api crate before 0.4.2 for Rust.lock_api
- CVE-2020-35911An issue was discovered in the lock_api crate before 0.4.2 for Rust.lock_api
- CVE-2020-35912An issue was discovered in the lock_api crate before 0.4.2 for Rust.lock_api
- CVE-2020-35913An issue was discovered in the lock_api crate before 0.4.2 for Rust.lock_api
- CVE-2020-35914An issue was discovered in the lock_api crate before 0.4.2 for Rust.lock_api
- CVE-2020-35915An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust.futures-intrusive
- CVE-2020-35916An issue was discovered in the image crate before 0.23.12 for Rust.image
- CVE-2020-35917An issue was discovered in the pyo3 crate before 0.12.4 for Rust.pyo3
- CVE-2020-35918An issue was discovered in the branca crate before 0.10.0 for Rust.branca
- CVE-2020-35919An issue was discovered in the net2 crate before 0.2.36 for Rust.net2 · socket2
- CVE-2020-35920An issue was discovered in the socket2 crate before 0.3.16 for Rust.net2 · socket2
- CVE-2020-35921An issue was discovered in the miow crate before 0.3.6 for Rust.miow
- CVE-2020-35922An issue was discovered in the mio crate before 0.7.6 for Rust.mio
- CVE-2020-35923An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust.ordered-float
- CVE-2020-35924An issue was discovered in the try-mutex crate before 0.3.0 for Rust.try-mutex
- CVE-2020-35925An issue was discovered in the magnetic crate before 2.0.1 for Rust.magnetic
- CVE-2020-35926An issue was discovered in the nanorand crate before 0.5.1 for Rust.nanorand
- CVE-2020-35927An issue was discovered in the thex crate through 2020-12-08 for Rust.thex
- CVE-2020-35928An issue was discovered in the concread crate before 0.2.6 for Rust.concread
- CVE-2019-7726modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referenukeviet/nukeviet
- CVE-2019-7725includes/core/is_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serializatnukeviet/nukeviet
- CVE-2018-16795OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/man
- CVE-2018-14067Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted pay
- CVE-2016-9023Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
- CVE-2016-9026Exponent CMS before 2.6.0 has improper input validation in fileController.php.
- CVE-2016-9025Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
- CVE-2016-9022Exponent CMS before 2.6.0 has improper input validation in usersController.php.
- CVE-2016-9021Exponent CMS before 2.6.0 has improper input validation in storeController.php.
- CVE-2020-19664DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi.
- CVE-2020-17363USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter
- CVE-2019-20808In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation.
- CVE-2020-12658gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c.
- CVE-2020-11947iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process mem
- CVE-2020-35857An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust.trust-dns-server