CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- silver peak systems, inc. ecos, arubanetworks edgeconnect enterprise +1 moreOS Command Injection - Management File Upload6.8 Medium
- askey ap5100w firmwareNetwork Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows...9.8 Critical
- frappeIn two-factor authentication, the system also sending 2fa secret key in response, which enables...7.5 High
- tiki tikiwiki cms\/groupwareTikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an...8.8 High
- docker registryVersions of the Official registry Docker images through 2.7.0 contain a blank password for the...9.8 Critical
- ibm resilient, resilient security orchestration automation and response +1 moreIBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system,...6.8 Medium
- opencartOpenCart Cross-Site Request Forgery (CSRF)3.5 Low
- apache airflowApache Airflow cross-site scripting due to incomplete fix for CVE-2020-139446.1 Medium
- ua-parser-js project ua-parser-js, siemens sinec ins +1 moreRegular Expression Denial of Service (ReDoS)7.5 High
- moutjs moutPrototype Pollution7.5 High
- spatie browsershotArbitrary File Read5.3 Medium
- node-notifier project node-notifierCommand Injection5.6 Medium
- infolific ultimate category excluderThe ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder...8.8 High
- phpldapadmin project phpldapadmin, fedoraproject fedora +1 moreAn XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store...5.4 Medium
- gitlabA potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13...4.3 Medium
- igniterealtime openfireIgnite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.5.4 Medium
- linux kernel, netapp cloud backup, solidfire baseboard management controller +3 more +5 moreA flaw was found in the Linux kernels implementation of MIDI (kernel 5.7-rc6), where an attacker...7.8 High
- gitlab, gitlab ce/ee +1 moreA limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >...5.3 Medium
- typesettercms typesetter** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS...4.8 Medium
- gitlab, gitlab ce/ee +1 moreAn issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >=...4.3 Medium
- gitlab, gitlab ee +1 moreRemoved group members were able to use the To-Do functionality to retrieve updated information on...3.1 Low
- gitlab, gitlab ce/ee +1 moreAn issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13...5.3 Medium
- gitlab, gitlab ce/ee +1 moreInformation disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and...5.3 Medium
- gitlab, gitlab ee +1 moreInformation disclosure in Advanced Search component of GitLab EE starting from 8.4 results in...4.0 Medium
- gitlabInformation about the starred projects for private user profiles was exposed via the GraphQL API...4.3 Medium
- pixar openusd, apple macos +1 moreAn out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05...8.8 High
- opener project openerA denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack...7.5 High
- opener project openerAn out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack...9.8 Critical
- jasper project jasper, fedoraproject fedora +1 moreThere's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to...7.8 High
- adobe preludeUncontrolled Search Path Element in Adobe Prelude for Windows7.0 High
- adobe lightroomUncontrolled Search Path Element vulnerability in Lightroom Classic 10.07.0 High
- linuxfoundation spinnakerNolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all...8.8 High
- ni compactrio firmwareIncorrect permissions are set by default for an API entry-point of a specific service, allowing a...7.5 High
- microfocus filrUnauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product....6.5 Medium
- arubanetworks arubaos, sd-wan +1 moreTwo vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot....7.2 High
- arubanetworks arubaos, sd-wan +1 moreThere are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code...9.8 Critical
- arubanetworks arubaos, sd-wan +1 moreAn attacker is able to remotely inject arbitrary commands by sending especially crafted packets...9.8 Critical
- gitlab, gitlab ce/ee +1 moreA DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that...4.3 Medium
- apache struts, oracle business intelligence, communications diameter intelligence hub +5 more +7 moreRemote code execution in Apache Struts9.8 Critical
- schneider-electric unity pro, ecostruxure control expert +1 moreA CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all...8.6 High
- schneider-electric 140cpu65150 firmware, 140noc78000 firmware, 140noc78100 firmware +16 more +18 moreA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web...5.3 Medium
- schneider-electric modicon m340 bmxp341000 firmware, modicon m340 bmxp342000 firmware, modicon m340 bmxp3420102 firmware +13 more +15 moreA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon...7.5 High
- schneider-electric 140cpu65150 firmware, modicon m340 bmxp341000 firmware, modicon m340 bmxp342000 firmware +17 more +19 moreA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon...7.5 High
- schneider-electric 140cpu65150 firmware, 140noc77101 firmware, 140noc78000 firmware +17 more +19 moreA CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon...5.3 Medium
- schneider-electric 140cpu65150 firmware, 140cpu65160 firmware, 140noc77101 firmware +20 more +22 moreA CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on...9.8 Critical
- schneider-electric 140cpu65150 firmware, 140noc77101 firmware, 140noc78000 firmware +17 more +19 moreA CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web...7.5 High
- schneider-electric modicon m340 bmxp341000 firmware, modicon m340 bmxp342000 firmware, modicon m340 bmxp3420102 firmware +16 more +18 moreA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon...7.5 High
- schneider-electric 140cpu65150 firmware, 140cpu65160 firmware, 140noc77101 firmware +18 more +20 moreA CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'...7.5 High
- schneider-electric modicon m258 firmware, somachine, somachine motion +2 moreA CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability...6.8 Medium
- schneider-electric ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +1 moreA CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA...7.8 High
- Show moreLoading…