# CVEs published 2020-12-31 133 CVEs were published on December 31, 2020: 1 critical, 12 high. Days are UTC. - [CVE-2019-25012](https://cve.now/CVE-2019-25012.md): The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. (no CVSS) - [CVE-2018-25002](https://cve.now/CVE-2018-25002.md): uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. (no CVSS) - [CVE-2017-20001](https://cve.now/CVE-2017-20001.md): The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from decrypting data, aka SA-CONTRIB-2017-027. (no CVSS) - [CVE-2016-20001](https://cve.now/CVE-2016-20001.md): The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20002](https://cve.now/CVE-2016-20002.md): The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20003](https://cve.now/CVE-2016-20003.md): The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20004](https://cve.now/CVE-2016-20004.md): The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20005](https://cve.now/CVE-2016-20005.md): The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20006](https://cve.now/CVE-2016-20006.md): The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20007](https://cve.now/CVE-2016-20007.md): The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2016-20008](https://cve.now/CVE-2016-20008.md): The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. (no CVSS) - [CVE-2020-26165](https://cve.now/CVE-2020-26165.md): qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps/qdPM/modules/timeReport/actions/actions.class (no CVSS) - [CVE-2020-35931](https://cve.now/CVE-2020-35931.md): An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF before 9.7.5 and 10.x before 10.1.1 (and be (no CVSS) - [CVE-2019-25011](https://cve.now/CVE-2019-25011.md): NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dc (no CVSS) - [CVE-2020-35930](https://cve.now/CVE-2020-35930.md): Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI. (no CVSS) - [CVE-2020-11835](https://cve.now/CVE-2020-11835.md): In /SM8250\_Q\_Master/android/vendor/oppo\_charger/oppo/charger\_ic/oppo\_da9313.c, failure to check the parameter buf in the function proc\_work\_ (no CVSS, OPPO Find X2) - [CVE-2020-11834](https://cve.now/CVE-2020-11834.md): In /SM8250\_Q\_Master/android/vendor/oppo\_charger/oppo/oppo\_vooc.c, the function proc\_fastchg\_fw\_update\_write in proc\_fastchg\_fw\_update\_write (no CVSS, OPPO Find X2) - [CVE-2020-11833](https://cve.now/CVE-2020-11833.md): In /SM8250\_Q\_Master/android/vendor/oppo\_charger/oppo/charger\_ic/oppo\_mp2650.c, the function mp2650\_data\_log\_write in mp2650\_data\_log\_write d (no CVSS, OPPO Find X2) - [CVE-2020-11832](https://cve.now/CVE-2020-11832.md): In functions charging\_limit\_current\_write and charging\_limit\_time\_write in /SM8250\_Q\_Master/android/vendor/oppo\_charger/oppo/oppo\_charger.c (no CVSS, OPPO Find X2) - [CVE-2020-25799](https://cve.now/CVE-2020-25799.md): LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey page. (no CVSS) - [CVE-2020-25797](https://cve.now/CVE-2020-25797.md): LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). (no CVSS) - [CVE-2018-19945](https://cve.now/CVE-2018-19945.md): Improper Limitation of a Pathname to a Restricted Directory in QTS (no CVSS, QNAP Systems QTS) - [CVE-2018-19944](https://cve.now/CVE-2018-19944.md): Cleartext Transmission of Sensitive Information in SNMP (no CVSS, QNAP Systems QTS) - [CVE-2018-19941](https://cve.now/CVE-2018-19941.md): Cleartext Storage of Sensitive Information in Cookies (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero +1) - [CVE-2018-25001](https://cve.now/CVE-2018-25001.md): An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. (no CVSS, libpulse-binding) - [CVE-2019-25001](https://cve.now/CVE-2019-25001.md): An issue was discovered in the serde\_cbor crate before 0.10.2 for Rust. (no CVSS, serde\_cbor) - [CVE-2019-25002](https://cve.now/CVE-2019-25002.md): An issue was discovered in the sodiumoxide crate before 0.2.5 for Rust. (no CVSS, sodiumoxide) - [CVE-2019-25003](https://cve.now/CVE-2019-25003.md): An issue was discovered in the libsecp256k1 crate before 0.3.1 for Rust. (no CVSS, libsecp256k1) - [CVE-2019-25004](https://cve.now/CVE-2019-25004.md): An issue was discovered in the flatbuffers crate before 0.6.1 for Rust. (no CVSS, flatbuffers) - [CVE-2019-25005](https://cve.now/CVE-2019-25005.md): An issue was discovered in the chacha20 crate before 0.2.3 for Rust. (no CVSS, chacha20) - [CVE-2019-25006](https://cve.now/CVE-2019-25006.md): An issue was discovered in the streebog crate before 0.8.0 for Rust. (no CVSS, streebog) - [CVE-2019-25007](https://cve.now/CVE-2019-25007.md): An issue was discovered in the streebog crate before 0.8.0 for Rust. (no CVSS, streebog) - [CVE-2019-25009](https://cve.now/CVE-2019-25009.md): An issue was discovered in the http crate before 0.1.20 for Rust. (no CVSS, http) - [CVE-2019-25010](https://cve.now/CVE-2019-25010.md): An issue was discovered in the failure crate through 2019-11-13 for Rust. (no CVSS, failure) - [CVE-2020-35858](https://cve.now/CVE-2020-35858.md): An issue was discovered in the prost crate before 0.6.1 for Rust. (no CVSS, prost) - [CVE-2020-35859](https://cve.now/CVE-2020-35859.md): An issue was discovered in the lucet-runtime-internals crate before 0.5.1 for Rust. (no CVSS, lucet-runtime-internals) - [CVE-2020-35860](https://cve.now/CVE-2020-35860.md): An issue was discovered in the cbox crate through 2020-03-19 for Rust. (no CVSS, cbox) - [CVE-2020-35861](https://cve.now/CVE-2020-35861.md): An issue was discovered in the bumpalo crate before 3.2.1 for Rust. (no CVSS, bumpalo) - [CVE-2020-35862](https://cve.now/CVE-2020-35862.md): An issue was discovered in the bitvec crate before 0.17.4 for Rust. (no CVSS, bitvec) - [CVE-2020-35863](https://cve.now/CVE-2020-35863.md): An issue was discovered in the hyper crate before 0.12.34 for Rust. (no CVSS, hyper) - [CVE-2020-35864](https://cve.now/CVE-2020-35864.md): An issue was discovered in the flatbuffers crate through 2020-04-11 for Rust. (no CVSS, flatbuffers) - [CVE-2020-35865](https://cve.now/CVE-2020-35865.md): An issue was discovered in the os\_str\_bytes crate before 2.0.0 for Rust. (no CVSS, os\_str\_bytes) - [CVE-2020-35866](https://cve.now/CVE-2020-35866.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35867](https://cve.now/CVE-2020-35867.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35868](https://cve.now/CVE-2020-35868.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35869](https://cve.now/CVE-2020-35869.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35870](https://cve.now/CVE-2020-35870.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35871](https://cve.now/CVE-2020-35871.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35872](https://cve.now/CVE-2020-35872.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35873](https://cve.now/CVE-2020-35873.md): An issue was discovered in the rusqlite crate before 0.23.0 for Rust. (no CVSS, rusqlite) - [CVE-2020-35874](https://cve.now/CVE-2020-35874.md): An issue was discovered in the internment crate through 2020-05-28 for Rust. (no CVSS, internment) - [CVE-2020-35875](https://cve.now/CVE-2020-35875.md): An issue was discovered in the tokio-rustls crate before 0.13.1 for Rust. (no CVSS, tokio-rustls) - [CVE-2020-35876](https://cve.now/CVE-2020-35876.md): An issue was discovered in the rio crate through 2020-05-11 for Rust. (no CVSS, rio) - [CVE-2020-35877](https://cve.now/CVE-2020-35877.md): An issue was discovered in the ozone crate through 2020-07-04 for Rust. (no CVSS, ozone) - [CVE-2020-35878](https://cve.now/CVE-2020-35878.md): An issue was discovered in the ozone crate through 2020-07-04 for Rust. (no CVSS, ozone) - [CVE-2020-35879](https://cve.now/CVE-2020-35879.md): An issue was discovered in the rulinalg crate through 2020-02-11 for Rust. (no CVSS, rulinalg) - [CVE-2020-35880](https://cve.now/CVE-2020-35880.md): An issue was discovered in the bigint crate through 2020-05-07 for Rust. (no CVSS, bigint) - [CVE-2020-35881](https://cve.now/CVE-2020-35881.md): An issue was discovered in the traitobject crate through 2020-06-01 for Rust. (no CVSS, traitobject) - [CVE-2020-35882](https://cve.now/CVE-2020-35882.md): An issue was discovered in the rocket crate before 0.4.5 for Rust. (no CVSS, rocket) - [CVE-2020-35883](https://cve.now/CVE-2020-35883.md): An issue was discovered in the mozwire crate through 2020-08-18 for Rust. (no CVSS, mozwire) - [CVE-2020-35884](https://cve.now/CVE-2020-35884.md): An issue was discovered in the tiny\_http crate through 2020-06-16 for Rust. (no CVSS, tiny\_http) - [CVE-2020-35885](https://cve.now/CVE-2020-35885.md): An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust. (no CVSS, alpm-rs) - [CVE-2020-35886](https://cve.now/CVE-2020-35886.md): An issue was discovered in the arr crate through 2020-08-25 for Rust. (no CVSS, arr) - [CVE-2020-35887](https://cve.now/CVE-2020-35887.md): An issue was discovered in the arr crate through 2020-08-25 for Rust. (no CVSS, arr) - [CVE-2020-35888](https://cve.now/CVE-2020-35888.md): An issue was discovered in the arr crate through 2020-08-25 for Rust. (no CVSS, arr) - [CVE-2020-35889](https://cve.now/CVE-2020-35889.md): An issue was discovered in the crayon crate through 2020-08-31 for Rust. (no CVSS, crayon) - [CVE-2020-35890](https://cve.now/CVE-2020-35890.md): An issue was discovered in the ordnung crate through 2020-09-03 for Rust. (no CVSS, ordnung) - [CVE-2020-35891](https://cve.now/CVE-2020-35891.md): An issue was discovered in the ordnung crate through 2020-09-03 for Rust. (no CVSS, ordnung) - [CVE-2020-35892](https://cve.now/CVE-2020-35892.md): An issue was discovered in the simple-slab crate before 0.3.3 for Rust. (no CVSS, simple-slab) - [CVE-2020-35893](https://cve.now/CVE-2020-35893.md): An issue was discovered in the simple-slab crate before 0.3.3 for Rust. (no CVSS, simple-slab) - [CVE-2020-35894](https://cve.now/CVE-2020-35894.md): An issue was discovered in the obstack crate before 0.1.4 for Rust. (no CVSS, obstack) - [CVE-2020-35895](https://cve.now/CVE-2020-35895.md): An issue was discovered in the stack crate before 0.3.1 for Rust. (no CVSS, stack) - [CVE-2020-35896](https://cve.now/CVE-2020-35896.md): An issue was discovered in the ws crate through 2020-09-25 for Rust. (no CVSS, ws) - [CVE-2020-35897](https://cve.now/CVE-2020-35897.md): An issue was discovered in the atom crate before 0.3.6 for Rust. (no CVSS, atom) - [CVE-2020-35898](https://cve.now/CVE-2020-35898.md): An issue was discovered in the actix-utils crate before 2.0.0 for Rust. (no CVSS, actix-utils) - [CVE-2020-35899](https://cve.now/CVE-2020-35899.md): An issue was discovered in the actix-service crate before 1.0.6 for Rust. (no CVSS, actix-service) - [CVE-2020-35900](https://cve.now/CVE-2020-35900.md): An issue was discovered in the array-queue crate through 2020-09-26 for Rust. (no CVSS, array-queue) - [CVE-2020-35901](https://cve.now/CVE-2020-35901.md): An issue was discovered in the actix-http crate before 2.0.0-alpha.1 for Rust. (no CVSS, actix-http) - [CVE-2020-35902](https://cve.now/CVE-2020-35902.md): An issue was discovered in the actix-codec crate before 0.3.0-beta.1 for Rust. (no CVSS, actix-codec) - [CVE-2020-35903](https://cve.now/CVE-2020-35903.md): An issue was discovered in the dync crate before 0.5.0 for Rust. (no CVSS, dync) - [CVE-2020-35904](https://cve.now/CVE-2020-35904.md): An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. (no CVSS, crossbeam-channel) - [CVE-2020-35905](https://cve.now/CVE-2020-35905.md): An issue was discovered in the futures-util crate before 0.3.7 for Rust. (no CVSS, futures-util) - [CVE-2020-35906](https://cve.now/CVE-2020-35906.md): An issue was discovered in the futures-task crate before 0.3.6 for Rust. (no CVSS, futures-task) - [CVE-2020-35907](https://cve.now/CVE-2020-35907.md): An issue was discovered in the futures-task crate before 0.3.5 for Rust. (no CVSS, futures-task) - [CVE-2020-35908](https://cve.now/CVE-2020-35908.md): An issue was discovered in the futures-util crate before 0.3.2 for Rust. (no CVSS, futures-util) - [CVE-2020-35909](https://cve.now/CVE-2020-35909.md): An issue was discovered in the multihash crate before 0.11.3 for Rust. (no CVSS, multihash) - [CVE-2020-35910](https://cve.now/CVE-2020-35910.md): An issue was discovered in the lock\_api crate before 0.4.2 for Rust. (no CVSS, lock\_api) - [CVE-2020-35911](https://cve.now/CVE-2020-35911.md): An issue was discovered in the lock\_api crate before 0.4.2 for Rust. (no CVSS, lock\_api) - [CVE-2020-35912](https://cve.now/CVE-2020-35912.md): An issue was discovered in the lock\_api crate before 0.4.2 for Rust. (no CVSS, lock\_api) - [CVE-2020-35913](https://cve.now/CVE-2020-35913.md): An issue was discovered in the lock\_api crate before 0.4.2 for Rust. (no CVSS, lock\_api) - [CVE-2020-35914](https://cve.now/CVE-2020-35914.md): An issue was discovered in the lock\_api crate before 0.4.2 for Rust. (no CVSS, lock\_api) - [CVE-2020-35915](https://cve.now/CVE-2020-35915.md): An issue was discovered in the futures-intrusive crate before 0.4.0 for Rust. (no CVSS, futures-intrusive) - [CVE-2020-35916](https://cve.now/CVE-2020-35916.md): An issue was discovered in the image crate before 0.23.12 for Rust. (no CVSS, image) - [CVE-2020-35917](https://cve.now/CVE-2020-35917.md): An issue was discovered in the pyo3 crate before 0.12.4 for Rust. (no CVSS, pyo3) - [CVE-2020-35918](https://cve.now/CVE-2020-35918.md): An issue was discovered in the branca crate before 0.10.0 for Rust. (no CVSS, branca) - [CVE-2020-35919](https://cve.now/CVE-2020-35919.md): An issue was discovered in the net2 crate before 0.2.36 for Rust. (no CVSS, net2 · socket2) - [CVE-2020-35920](https://cve.now/CVE-2020-35920.md): An issue was discovered in the socket2 crate before 0.3.16 for Rust. (no CVSS, net2 · socket2) - [CVE-2020-35921](https://cve.now/CVE-2020-35921.md): An issue was discovered in the miow crate before 0.3.6 for Rust. (no CVSS, miow) - [CVE-2020-35922](https://cve.now/CVE-2020-35922.md): An issue was discovered in the mio crate before 0.7.6 for Rust. (no CVSS, mio) - [CVE-2020-35923](https://cve.now/CVE-2020-35923.md): An issue was discovered in the ordered-float crate before 1.1.1 and 2.x before 2.0.1 for Rust. (no CVSS, ordered-float) - [CVE-2020-35924](https://cve.now/CVE-2020-35924.md): An issue was discovered in the try-mutex crate before 0.3.0 for Rust. (no CVSS, try-mutex) - [CVE-2020-35925](https://cve.now/CVE-2020-35925.md): An issue was discovered in the magnetic crate before 2.0.1 for Rust. (no CVSS, magnetic) - [CVE-2020-35926](https://cve.now/CVE-2020-35926.md): An issue was discovered in the nanorand crate before 0.5.1 for Rust. (no CVSS, nanorand) - [CVE-2020-35927](https://cve.now/CVE-2020-35927.md): An issue was discovered in the thex crate through 2020-12-08 for Rust. (no CVSS, thex) - [CVE-2020-35928](https://cve.now/CVE-2020-35928.md): An issue was discovered in the concread crate before 0.2.6 for Rust. (no CVSS, concread) - [CVE-2020-35851](https://cve.now/CVE-2020-35851.md): HGiga MailSherlock - Command Injection (CVSS 8.1, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-35743](https://cve.now/CVE-2020-35743.md): HGiga MailSherlock - SQL Injection -3 (CVSS 7.0, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-35742](https://cve.now/CVE-2020-35742.md): HGiga MailSherlock - SQL Injection -1 (CVSS 7.0, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-35741](https://cve.now/CVE-2020-35741.md): HGiga MailSherlock - XSS -2 (CVSS 7.0, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-35740](https://cve.now/CVE-2020-35740.md): HGiga MailSherlock - XSS -1 (CVSS 7.0, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-25850](https://cve.now/CVE-2020-25850.md): HGiga MailSherlock - Arbitrary File Download (CVSS 8.1, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-25848](https://cve.now/CVE-2020-25848.md): HGiga MailSherlock - Broken Authentication (CVSS 9.8, HGiga MailSherlock MSR45/SSR45) - [CVE-2020-25846](https://cve.now/CVE-2020-25846.md): CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2 (CVSS 7.5, CHANGING NHIServiSignAdapter) - [CVE-2020-25845](https://cve.now/CVE-2020-25845.md): CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1 (CVSS 7.5, CHANGING NHIServiSignAdapter) - [CVE-2020-25844](https://cve.now/CVE-2020-25844.md): CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow (CVSS 8.1, CHANGING NHIServiSignAdapter) - [CVE-2020-25843](https://cve.now/CVE-2020-25843.md): CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow (CVSS 8.1, CHANGING NHIServiSignAdapter) - [CVE-2020-25842](https://cve.now/CVE-2020-25842.md): CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access (CVSS 7.5, CHANGING NHIServiSignAdapter) - [CVE-2019-7726](https://cve.now/CVE-2019-7726.md): modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Refere (no CVSS, nukeviet/nukeviet) - [CVE-2019-7725](https://cve.now/CVE-2019-7725.md): includes/core/is\_user.php in NukeViet before 4.3.04 deserializes the untrusted nvloginhash cookie (i.e., the code relies on PHP's serializat (no CVSS, nukeviet/nukeviet) - [CVE-2018-16795](https://cve.now/CVE-2018-16795.md): OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/man (no CVSS) - [CVE-2018-14067](https://cve.now/CVE-2018-14067.md): Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted pay (no CVSS) - [CVE-2016-9023](https://cve.now/CVE-2016-9023.md): Exponent CMS before 2.6.0 has improper input validation in cron/find\_help.php. (no CVSS) - [CVE-2016-9026](https://cve.now/CVE-2016-9026.md): Exponent CMS before 2.6.0 has improper input validation in fileController.php. (no CVSS) - [CVE-2016-9025](https://cve.now/CVE-2016-9025.md): Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. (no CVSS) - [CVE-2016-9022](https://cve.now/CVE-2016-9022.md): Exponent CMS before 2.6.0 has improper input validation in usersController.php. (no CVSS) - [CVE-2016-9021](https://cve.now/CVE-2016-9021.md): Exponent CMS before 2.6.0 has improper input validation in storeController.php. (no CVSS) - [CVE-2020-19664](https://cve.now/CVE-2020-19664.md): DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi. (no CVSS) - [CVE-2020-17363](https://cve.now/CVE-2020-17363.md): USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number\_start or number\_end parameter (no CVSS) - [CVE-2019-20808](https://cve.now/CVE-2019-20808.md): In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. (no CVSS) - [CVE-2020-12658](https://cve.now/CVE-2020-12658.md): gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond\_mutex before pthread exit in gp\_worker\_main() in gp\_workers.c. (no CVSS) - [CVE-2020-11947](https://cve.now/CVE-2020-11947.md): iscsi\_aio\_ioctl\_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process mem (no CVSS) - [CVE-2020-13654](https://cve.now/CVE-2020-13654.md): XWiki Platform before 12.8 mishandles escaping in the property displayer. (CVSS 7.5, org.xwiki.platform:xwiki-platform-web) - [CVE-2020-35857](https://cve.now/CVE-2020-35857.md): An issue was discovered in the trust-dns-server crate before 0.18.1 for Rust. (no CVSS, trust-dns-server) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2020-12-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.