CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- eggheads eggdrop docker imageThe official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user....9.8 Critical
- hashicorp consul docker imageThe official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user....9.8 Critical
- docker elixir alpine docker imageThe official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password...9.8 Critical
- znc docker imageThe official znc docker images before 1.7.1-slim contain a blank password for a root user....9.8 Critical
- docker storm docker imageThe official storm Docker images before 1.2.1 contain a blank password for a root user. Systems...9.8 Critical
- irssi docker imageThe official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for...9.8 Critical
- docker notary docker imageThe official notary docker images before signer-0.6.1-1 contain a blank password for a root user....9.8 Critical
- docker spiped alpine docker imageThe official spiped docker images before 1.5-alpine contain a blank password for a root user....9.8 Critical
- express-gateway docker imageThe official Express Gateway Docker images before 1.14.0 contain a blank password for a root user...9.8 Critical
- matomo piwik fpm-alpine docker imageThe official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for...9.8 Critical
- getkirby kirby, panel +1 morePHP Phar archives could be uploaded and executed in Kirby6.8 Medium
- nhosoya omniauth-appleomniauth-apple allows attacker to fake their email address during authentication7.7 High
- student management system project in php project management system project in phpSourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a...5.4 Medium
- online bus booking system project bus booking systemOnline Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login...9.8 Critical
- systransoft pure neural serverA Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7...5.4 Medium
- systransoft pure neural serverAPI calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a...7.5 High
- async-coap project async-coapData races in async-coap8.1 High
- tiny future project futureData race in tiny_future8.1 High
- devolutions gfwxData races in gfwx7.0 High
- thex project thexData races in thex5.5 Medium
rpmlintopenSUSE,rpmlint-testsopenSUSE +1 moreSecurity update for rpmlintNo score- getkirby kirby, panel +1 more.dev domains treated as local in Kirby6.8 Medium
- moodleCross site-scripting (XSS) moodle6.1 Medium
- moodleMoodle incorrect access control8.8 High
- moodleMoodle Denial of Service7.5 High
- moodleMoodle Cross-site Scripting (XSS)6.1 Medium
- red hat wildflyWildfly has a memory leak vulnerability5.9 Medium
- ceph ceph-ansible, redhat ceph storage +1 moreCeph-ansible 4.0.34.1 creates /etc/ceph/iscsi-gateway.conf with insecure default permissions,...5.5 Medium
- gnome gdk-pixbuf, canonical ubuntu linux, fedoraproject fedora +2 moreGNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw...5.5 Medium
- imagemagick, debian linux +1 moreA flaw was found in ImageMagick in coders/txt.c. An attacker who submits a crafted file that is...3.3 Low
- imagemagick, debian linux +1 moreA floating point math calculation in ScaleAnyToQuantum() of /MagickCore/quantum-private.h could...3.3 Low
- imagemagickIn ParseMetaGeometry() of MagickCore/geometry.c, image height and width calculations can lead to...5.5 Medium
- imagemagick, debian linux +1 moreIn IntensityCompare() of /magick/quantize.c, there are calls to PixelPacketIntensity() which...3.3 Low
- imagemagick, debian linux +1 moreA flaw was found in ImageMagick in MagickCore/quantum-export.c. An attacker who submits a crafted...3.3 Low
- imagemagick, debian linux +1 moreA flaw was found in ImageMagick in MagickCore/colorspace-private.h and MagickCore/quantum.h. An...5.5 Medium
- canonical aptdaemon, ubuntu linux +1 moreaptdaemon performed policykit permissions checks too late5.5 Medium
- imagemagick, debian linux +1 moreIn CatromWeights(), MeshInterpolate(), InterpolatePixelChannel(), InterpolatePixelChannels(), and...5.5 Medium
- imagemagick, debian linux +1 moreIn the CropImage() and CropImageToTiles() routines of MagickCore/transform.c, rounding...3.3 Low
- imagemagick, debian linux +1 moreWriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an improper exit...5.5 Medium
- imagemagick, debian linux +1 moreThere are 4 places in HistogramCompare() in MagickCore/histogram.c where an integer overflow is...3.3 Low
- imagemagick, debian linux +1 moreThe PALM image coder at coders/palm.c makes an improper call to AcquireQuantumMemory() in routine...5.5 Medium
- openssl, debian linux, fedoraproject fedora +41 more +43 moreEDIPARTYNAME NULL pointer dereference5.9 Medium
- apache tapestryDeserialization flaw in EOL Tapestry 4.9.8 Critical
- canonical aptdaemon, ubuntu linux +1 moreAptdaemon error messages disclosed file existence to unprivileged users via dbus properties3.8 Low
- kubernetesSecret leaks in logs for vSphere Provider kube-controller-manager4.7 Medium
- kubernetesDocker config secrets leaked when file is malformed and loglevel >= 44.7 Medium
- kubernetesIncomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 94.7 Medium
- kubernetesCeph RBD adminSecrets exposed in logs when loglevel >= 44.7 Medium
- nlnet labs nsd, unbound, debian linux +1 more +3 moreLocal symlink attack in Unbound and NSD5.5 Medium
- awstats, debian linux, fedoraproject fedora +2 moreIn AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it...9.8 Critical
- Show moreLoading…