CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- schneider-electric easergy t300 firmwareA CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy...6.5 Medium
- schneider-electric easergy t300 firmwareA CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2...7.5 High
- schneider-electric easergy t300 firmwareA CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2...7.5 High
- schneider-electric easergy t300 firmwareA CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older),...9.8 Critical
- schneider-electric modicon m221 firmwareA CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 ...5.5 Medium
- schneider-electric bmxnoe0100 firmware, bmxnoe0110 firmware, bmxnor0200h firmware +7 more +9 moreA CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon...7.5 High
- getgrav gravGrav - Cross-Site Scripting in Admin Plugin Page Editor5.1 Medium
- ibm aix, vios +1 moreIBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu...8.4 High
- ibm sterling b2b integratorIBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 and 6.0.0.0 through 6.0.3.1...4.3 Medium
- google guava, netapp active iq unified manager, oracle commerce guided search +10 more +12 moreTemp directory permission issue in Guava3.3 Low
- google tensorflowHeap out of bounds read in filesystem glob matching in TensorFlow7.5 High
- ubillingUbilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command...9.8 Critical
- processmakerSQL injection vulnerability exists in the handling of sort parameters in ProcessMaker 3.4.11. A...6.4 Medium
- notableNotable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because...9.6 Critical
- fastadminThe member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side...8.8 High
- idreamsoft icmsiCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX...9.8 Critical
- idreamsoft icmsiCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME...9.8 Critical
- askey ap5100w firmwareAskey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating...9.8 Critical
- google tensorflowHeap out of bounds access in MakeEdge in TensorFlow4.4 Medium
- google tensorflowCHECK-fail in LSTM with zero-length input in TensorFlow4.4 Medium
- google tensorflowWrite to immutable memory region in TensorFlow4.4 Medium
- google tensorflowLack of validation in data format attributes in TensorFlow4.4 Medium
- google tensorflowUninitialized memory access in Eigen types in TensorFlow4.4 Medium
- ini project ini, debian linux +1 morePrototype Pollution7.3 High
- cgc project cgcNon-atomic writes in cgc5.9 Medium
- cgc project cgcMultiple soundness issues in cgc5.9 Medium
- cgc project cgcData races in cgc5.9 Medium
- noise search project searchData races in noise_search8.1 High
- aovec project aovecData races in aovec7.0 High
- xcb project xcbMemory handling issues in xcb5.5 Medium
- arc-swap project arc-swapDangling reference in `access::Map` with Constant7.5 High
- gerritOveroptimization leads to private information leak in Gerrit3.5 Low
- gerritInformation leakage in Gerrit3.5 Low
- lanatmservice m3 atm monitoring systemIn Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie...9.8 Critical
- lanatmservice m3 atm monitoring systemIn Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a...5.3 Medium
- sympa, debian linux, fedoraproject fedora +2 moreSympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any...3.7 Low
- adobe experience manager, experience manager forms add-on +1 moreBlind SSRF in Forms add-on for AEM5.8 Medium
- adobe experience manager, experience manager cloud service +1 moreCross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM)9.0 Critical
- broadcom symantec messaging gatewayAn information disclosure flaw allows a malicious, authenticated, privileged web UI user to...4.9 Medium
- broadcom symantec messaging gatewayA privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate...7.2 High
- gitlab, gitlab ce/ee +1 moreA XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6...5.5 Medium
- qnap qts, quts hero +1 moreCross-site scripting vulnerability in QTS and QuTS hero6.1 Medium
- qnap qts, quts hero +1 moreCross-site scripting vulnerability in QTS and QuTS hero6.1 Medium
- qnap qts, quts hero +1 moreCross-site scripting vulnerability in QTS and QuTS hero6.1 Medium
- qnap qts, quts hero +1 moreCross-site scripting vulnerability in QTS and QuTS hero6.1 Medium
- qnap music stationCross-site Scripting Vulnerability in Music Station6.1 Medium
- qnap multimedia consoleCross-site Scripting Vulnerability in Multimedia Console6.1 Medium
- qnap qts, quts hero +1 moreCommand Injection Vulnerability in QTS and QuTS hero9.8 Critical
- qnap photo stationCross-site Scripting Vulnerability in Photo Station6.1 Medium
- wago 750-352, 750-331/xxx-xxx, 750-331 firmware +17 more +19 moreWAGO: PLC families 750-88x and 750-352 prone to DoS attack7.5 High
- Show moreLoading…