CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0,...9.9 Critical
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier,...4.3 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (followers) in Odoo Community 13.0 and earlier and Odoo...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (notifications) in Odoo Community 14.0 and earlier and...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier,...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper input validation in portal component in Odoo Community 12.0 and earlier and Odoo...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise...8.1 High
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo...6.3 Medium
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo...7.1 High
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and...7.1 High
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo...7.1 High
- odoo, odoo community, enterprise +2 moreImproper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo...8.2 High
- multi-ini project multi-iniPrototype Pollution5.6 Medium
- multi-ini project multi-iniPrototype Pollution5.6 Medium
stderrcrates.iostderr is unmaintained; use eprintln insteadNo score- va-ts project va-tsData race in va-ts5.9 Medium
- conquer-once project conquer-onceData races in conquer-once7.8 High
webkit2gtkDebianwebkit2gtk - regression updateNo scoreopenjdk-8Debianopenjdk-8 - regression updateNo score- zyxel atp100 firmware, atp100w firmware, atp200 firmware +28 more +30 moreFirmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an...9.8 Critical
- gohugo hugoHugo can execute a binary from the current directory on Windows7.7 High
- mediawikiAn issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1....6.1 Medium
- mediawikiAn issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper...7.5 High
- mediawikiAn issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin...5.3 Medium
- mediawikiAn issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the...8.8 High
- mediawikiAn issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary...8.8 High
mbedtlsMageiaUpdated mbedtls packages fix security vulnerabilitiesNo score- miniweb http server project http serverMiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash)...7.5 High
- datacharmer dbdeployerArbitrary read/write in DBdeployer6.1 Medium
- bilancProgrami Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several...9.8 Critical
- bilancAn issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.9.8 Critical
- philips hue firmwarePhilips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will...7.5 High
- phpgurukul online marriage registration systemThe Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php...8.8 High
- webminArbitrary command execution can occur in Webmin through 1.962. Any user authorized for the...8.8 High
- kovidgoyal kitty, debian linux +1 moreThe Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to...9.8 Critical
- kronos web time and attendanceAn XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.9.8 Critical
- seacmsSQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to...9.8 Critical
- yunyecmsSQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.9.8 Critical
- ibm security secret serverIBM Security Secret Server 10.6 stores potentially sensitive information in config files that...6.3 Medium
- ibm security secret serverIBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information...2.7 Low
- ibm security secret serverIBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information,...5.9 Medium
- ibm security secret serverIBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using...7.4 High
shopware/corePackagist,shopware/platformPackagist +1 moreAuthenticated Server Side Request ForgeryNo scoreshopware/corePackagist,shopware/platformPackagist +1 moreInformation exposure via query strings in URLNo scoreshopware/corePackagist,shopware/platformPackagist +1 moreAuthenticated Privilege EscalationNo score- jupyter server, jupyter-server jupyter server +1 moreOpen redirect vulnerability6.1 Medium
- ibm mq, mq appliance +1 moreIBM MQ 9.2 CD and LTS are vulnerable to a denial of service attack caused by an error processing...5.9 Medium
- ibm automation workstream services, business automation workflow, business process manager +2 moreIBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0,...5.4 Medium
- ibm content navigatorIBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site...6.4 Medium
- Show moreLoading…