CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- webform report project report The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by... 7.5 High
- sunhater kcfinder uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles... 8.8 High
- aes encryption project encryption The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from... 7.5 High
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE... 9.8 Critical
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033.... 9.8 Critical
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE:... 7.5 High
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033.... 9.8 Critical
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033... 9.8 Critical
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033.... 7.5 High
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033.... 7.5 High
- rest\/json project rest\/json The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033.... 7.5 High
- qdpm qdPM through 9.1 allows PHP Object Injection via timeReportActions::executeExport in core/apps... 8.8 High
- foxitsoftware foxit reader, phantompdf +1 more An issue was discovered in Foxit Reader before 10.1.1 (and before 4.1.1 on macOS) and PhantomPDF... 7.8 High
- netbox NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a... 5.4 Medium
- seopanel seo panel Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated... 5.4 Medium
- oppo find x2 pro firmware, reno3 pro firmware +1 more In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_da9313.c, failure to check... 5.5 Medium
- oppo find x2 pro firmware, reno3 pro firmware +1 more In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/oppo_vooc.c, the function... 5.5 Medium
- oppo find x2 pro firmware, reno3 pro firmware +1 more In /SM8250_Q_Master/android/vendor/oppo_charger/oppo/charger_ic/oppo_mp2650.c, the function... 5.5 Medium
- oppo find x2 pro firmware, reno3 pro firmware +1 more In functions charging_limit_current_write and charging_limit_time_write in /SM8250_Q_Master... 5.5 Medium
- limesurvey LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Quota component of the Survey... 5.4 Medium
- limesurvey LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function ... 5.4 Medium
- qnap qts Improper Limitation of a Pathname to a Restricted Directory in QTS 9.1 Critical
- qnap qts Cleartext Transmission of Sensitive Information in SNMP 7.5 High
- qnap qts, quts hero, qutscloud +2 more Cleartext Storage of Sensitive Information in Cookies 7.5 High
- buffoon project buffoon InputStream::read_exact : `Read` on uninitialized buffer causes UB 9.8 Critical
- bite project bite `read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max) 7.5 High
- array-tools project array-tools Memory corruption in array-tools 9.8 Critical
- autorand project autorand Free of uninitialized memory in autorand 7.8 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-user, ssr45 isherlock-user +2 more HGiga MailSherlock - Command Injection 8.1 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-user +2 more +4 more HGiga MailSherlock - SQL Injection -3 7.0 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-user +2 more +4 more HGiga MailSherlock - SQL Injection -1 7.0 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-user +2 more +4 more HGiga MailSherlock - XSS -2 7.0 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-user +2 more +4 more HGiga MailSherlock - XSS -1 7.0 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-user, ssr45 isherlock-user +2 more HGiga MailSherlock - Arbitrary File Download 8.1 High
- hgiga mailsherlock msr45/ssr45, msr45 isherlock-antispam, msr45 isherlock-audit +8 more +10 more HGiga MailSherlock - Broken Authentication 9.8 Critical
- changing inc. nhiservisignadapter CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2 7.5 High
- changing inc. nhiservisignadapter CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1 7.5 High
- changing inc. nhiservisignadapter CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow 8.1 High
- changing inc. nhiservisignadapter CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow 8.1 High
- changing inc. nhiservisignadapter CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access 7.5 High
- nukeviet SQL Injection in NukeViet 9.8 Critical
- nukeviet Deserialization of Untrusted Data in NukeViet 9.8 Critical
- open-emr openemr OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as... 8.8 High
- greenpacket dv-360 firmware Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated... 9.8 Critical
- exponentcms exponent cms Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. 9.8 Critical
- exponentcms exponent cms Exponent CMS before 2.6.0 has improper input validation in fileController.php. 9.8 Critical
- exponentcms exponent cms Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. 9.8 Critical
- exponentcms exponent cms Exponent CMS before 2.6.0 has improper input validation in usersController.php. 9.8 Critical
- exponentcms exponent cms Exponent CMS before 2.6.0 has improper input validation in storeController.php. 9.8 Critical
- draytek vigor2960 firmware DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA... 8.8 High
- Show olderLoading…