CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- weiphpSQL injection vulnerability in the wp_where function in WeiPHP 5.0.9.8 Critical
- weiphpWeiPHP 5.0 does not properly restrict access to pages, related to using POST.7.5 High
- thingsboardThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This...8.8 High
- openslidesXSS in OpenSlides8.9 High
- zzcmsThere is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer...5.4 Medium
- troglobit uftpdAn unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd...9.8 Critical
- troglobit uftpdThere are multiple unauthenticated directory traversal vulnerabilities in different FTP commands...9.8 Critical
- openzaak open zaak, open-zaak +1 moreCORS configuration is possibly vulnerable4.7 Medium
- ibm planning analyticsIBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an...4.3 Medium
- spiceworksHost Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that...6.1 Medium
- xinuos openserverA reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5...6.1 Medium
- xinuos openserverXinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via...9.8 Critical
- max7301 project max7301Data races in max73015.9 Medium
- kekbit project kekbitCommand injection in kekbit8.1 High
- v9 project v9Data race in v98.1 High
- nonpolynomial buttplugImproper synchronization in buttplug5.9 Medium
- rusb project rusbData races in rusb7.0 High
- tangro business workflowIn tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document...4.3 Medium
- tangro business workflowEvery login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows...4.2 Medium
- tangro business workflowAn incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an...3.1 Low
- tangro business workflowtangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and...8.8 High
- tangro business workflowIn tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in...6.5 Medium
- tangro business workflowAn issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control...4.3 Medium
- tangro business workflowIn tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed...4.3 Medium
- tangro business workflowIn tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download...5.3 Medium
- solarwinds webhelpdeskSolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.5.4 Medium
- solarwinds webhelpdeskSolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.5.4 Medium
- google androidAn issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a...5.5 Medium
- google androidAn issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any...5.5 Medium
- google androidAn issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0)...9.8 Critical
- google androidAn issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos...9.8 Critical
- google androidAn issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10...5.3 Medium
- google androidAn issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250...7.5 High
- google androidAn issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software....7.8 High
- google androidAn issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen...7.8 High
- mediawiki, fedoraproject fedora +1 moreMediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace...6.1 Medium
- mediawiki, fedoraproject fedora +1 moreIn MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS...6.1 Medium
- mitel mivoice 6930 firmware, mivoice 6940 firmware +1 moreThe Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3...8.1 High
- mitel 6873i sip firmware, 6930 sip firmware, 6940 sip firmware +2 moreThe Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1...8.1 High
- mitel businesscti enterpriseThe chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x...8.8 High
- mitel micollabThe SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials...7.2 High
- mitel micollabThe NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker...5.4 Medium
- mitel micollabThe online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to...6.1 Medium
- mitel micollabThe AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information...6.1 Medium
- mitel micollabThe AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference...6.1 Medium
- mitel micollabThe AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web...5.3 Medium
- mitel micollabThe NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated...4.9 Medium
- mitel micontact center businessThe Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker...3.3 Low
- apache karaf, bouncycastle bc-java, oracle banking corporate lending process management +17 more +19 moreLogic error in Legion of the Bouncy Castle BC Java8.1 High
- onstove stove, smilegate stove client +1 moreA arbitrary code execution vulnerability exists in the way that the Stove client improperly...8.8 High
- Show moreLoading…