CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
lxmlDebianlxml - regression updateNo score- mediawiki, debian linux, fedoraproject fedora +2 moreAn issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and...5.3 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreMediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry...6.1 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreMediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one...5.3 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreIn MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can...7.5 High
- ceph, fedoraproject fedora, redhat ceph storage +2 more +4 moreUser credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila,...7.1 High
- apache dolphinschedulerRemote code execution in DolphinScheduler9.8 Critical
- hcl notesA vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by...8.8 High
- linux-pam, suse pam +1 moreA flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for...9.8 Critical
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406144...6.5 Medium
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104...6.5 Medium
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084...6.5 Medium
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs...6.5 Medium
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs...6.5 Medium
- nzxt camAn information disclosure vulnerability exists in the WinRing0x64 Driver Privileged I/O Read IRPs...6.5 Medium
- apache tomeeRemote code execution in Apache TomEE9.8 Critical
- lantronix xport edge firmwareAn information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of...3.1 Low
- lantronix sgx firmware, xport edge firmware +1 moreAn authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort...4.8 Medium
- innominate mguard rs4000 4tx/3g/tx vpn, mguard rs4000 4tx/tx, mguard rs4000 4tx/tx vpn +15 more +17 morePhoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration5.4 Medium
- phoenix contact axc f 1152 (1151412), axc f 2152 (2404267), axc f 2152 starterkit (1046568) +4 more +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: A specially crafted LLDP packet may lead to a high system load in the PROFINET stack.6.5 Medium
- phoenix contact axc f 1152 (1151412), axc f 2152 (2404267), axc f 2152 starterkit (1046568) +4 more +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use this vulnerability i.e. to open a reverse shell with root privileges.8.8 High
- phoenix contact axc f 1152 (1151412), axc f 2152 (2404267), axc f 2152 starterkit (1046568) +4 more +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An attacker can use the knowledge gained by reading the insufficiently protected sensitive information to plan further attacks.5.5 Medium
- phoenix contact axc f 1152 (1151412), axc f 2152 (2404267), axc f 2152 starterkit (1046568) +4 more +6 morePhoenix Contact PLCnext Control Devices versions before 2021.0 LTS: An authenticated low privileged user could embed malicious Javascript code to gain admin rights when the admin user visits the vulne…8.8 High
- wago series pfc 100 (750-81xx/xxx-xxx), series pfc 200 (750-82xx/xxx-xxx), series wago touch panel 600 advanced line (762-5xxx) +7 more +9 moreCommand Injection Vulnerability in I/O-Check Service of WAGO PFC100, PFC200 and Touch Panel 600 Series with firmware versions <=FW1010.0 Critical
- cmsmadesimple cms made simpleCross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple ...6.1 Medium
- flexmonster pivot table \& chartsCross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in...6.1 Medium
- flexmonster pivot table \& chartsCross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in...6.1 Medium
- flexmonster pivot table \& chartsCross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu...6.1 Medium
- flexmonster pivot table \& chartsCross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in...6.1 Medium
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2...9.8 Critical
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an...9.8 Critical
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an...7.5 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an...7.5 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual...4.8 Medium
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6...8.8 High
- trend micro interscan web security virtual appliance, trend micro, inc. micro interscan web security virtual appliance +1 moreA cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual...4.8 Medium
- spotweb project spotwebTime-based SQL injection exists in Spotweb 1.4.9 via the query string.9.8 Critical
- fleetdm fleetSAML authentication vulnerability in Fleet10.0 Critical
- fasterxml jackson-databind, debian linux, netapp service level manager +22 more +24 moreSerialization gadgets exploit in jackson-databind8.1 High
- fasterxml jackson-databind, debian linux, netapp service level manager +23 more +25 moreSerialization gadgets exploit in jackson-databind8.1 High
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain...2.7 Low
- ibm security key lifecycle managerIBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This...5.4 Medium
- rocklobster contact form 7The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted...10.0 Critical
- bitdefender hypervisor introspectionMemory corruption in Bitdefender Hypervisor Introspection (VA-9336)6.1 Medium
- bitdefender hypervisor introspectionCompiler Optimization Removal or Modification of Security-Critical Code vulnerability in Bitdefender Hypervisor Introspection (VA-9339)7.8 High
- bitdefender hypervisor introspectionLack of validation on data read from guest memory in Bitdefender HVI (VA-9333)5.5 Medium
- jsonpickle project jsonpicklejsonpickle unsafe deserialization9.8 Critical
- disrustor project disrustorData race in disrustor5.9 Medium
- rust-lang async-h1Async-h1 request smuggling possible with long unread bodies6.1 Medium
- http-rs async-h1request smuggling in async-h16.8 Medium
- Show moreLoading…