CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- hcl bigfix inventory, hcltech bigfix platform +1 moreTLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and...7.5 High
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint...8.8 High
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. The local database does not require...8.4 High
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by...7.8 High
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. The SSH component does not restrict...4.4 Medium
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect...8.8 High
- solarwinds n-centralAn issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint...8.8 High
- p11-kit project p11-kit, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreModerate: p11-kit security, bug fix, and enhancement update7.5 High
- p11-kit project p11-kit, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreModerate: p11-kit security, bug fix, and enhancement update5.3 Medium
- p11-kit project p11-kit, debian linux, oracle communications cloud native core policy +3 more +5 moreModerate: p11-kit security, bug fix, and enhancement update7.5 High
- datatables datatables.netPrototype Pollution7.3 High
- growi, inc. growiDirectory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions...7.5 High
- growi, inc. growiImproper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior...7.5 High
- linuxfoundation osquerysqlite ATTACH allows some filesystem access5.2 Medium
- x-stream xstream, apache struts, debian linux +1 more +3 moreServer-Side Forgery Request can be activated unmarshalling with XStream6.3 Medium
- x-stream xstream, apache struts, debian linux +1 more +3 moreXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling6.8 Medium
openthreadOSS-FuzzStack-buffer-overflow in ot::IsValidUtf8StringNo score- opentsdbOS Command Injection in OpenTSDB9.8 Critical
- sonarsource sonarqube docker imageThe official sonarqube docker images before alpine (Alpine specific) contain a blank password for...9.8 Critical
- softwareag terracotta server ossThe Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root...9.8 Critical
- appbase streamsThe Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems...9.8 Critical
- docker docsThe Docker Docs Docker image through 2020-12-14 contains a blank password for the root user....9.8 Critical
- blackfire docker imageThe Blackfire Docker image through 2020-12-14 contains a blank password for the root user....9.8 Critical
- weave cloud agentVersion 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user....9.8 Critical
- instana dynamic apmVersion 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user...9.8 Critical
- coscale agent project agentVersion 3.16.0 of the CoScale agent Docker image contains a blank password for the root user....9.8 Critical
- solarwinds database performance analyzerSolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS...5.4 Medium
- icingaSecurity update for icinga29.1 Critical
- keysight database connectorAn issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A...8.8 High
- keysight database connectorAn issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A...7.5 High
- onlineonly phpjabbers appointment schedulerMultiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3...6.1 Medium
- alumni management system project management systemA Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An...7.2 High
- pega platformPega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID...6.1 Medium
- jsonparser project jsonparser, fedoraproject fedora +1 moreDenial of Service in jsonparser7.5 High
- gjson project gjsonDenial of service in GJSON7.5 High
- hosteng h0-ecom100 firmware, h2-ecom100 firmware, h4-ecom100 firmware +2 moreThe length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules...7.5 High
- dlink dsr-1000 firmware, dsr-1000ac firmware, dsr-1000n firmware +7 more +9 moreAn issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified...8.8 High
- dlink dsr-1000 firmware, dsr-1000ac firmware, dsr-1000n firmware +7 more +9 moreAn issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration...8.8 High
- dlink dsr-1000 firmware, dsr-1000ac firmware, dsr-1000n firmware +7 more +9 moreA lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result...8.8 High
- keycloakA flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful...4.9 Medium
- tibco partnerexpressTIBCO PartnerExpress REST API6.5 Medium
- xen xapiAn issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback...7.5 High
- debian linux, linux kernel, xen +3 more +5 moreAn issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The...8.8 High
- debian linux, xen +1 moreAn issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are...6.5 Medium
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of...6.2 Medium
- google androidIn the nl80211_policy policy of nl80211.c, there is a possible out of bounds read due to a...9.8 Critical
- google androidIn the l2tp subsystem, there is a possible use after free due to a race condition. This could...6.4 Medium
- google androidIn xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to...6.7 Medium
- google androidIn getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission...3.3 Low
- google androidIn SELinux policies of mls, there is a missing permission check. This could lead to local...3.3 Low
- Show moreLoading…