CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- intelliants subrion cmsSubrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter...6.1 Medium
- techkshetrainfo savsoft quizSavsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the...4.8 Medium
- xpdfreader xpdf, fedoraproject fedora +1 moreXpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font...7.5 High
- cxuu cxuucmsCXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c...6.5 Medium
- cxuu cxuucmsCXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to...4.8 Medium
- rockoa xinhurainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a...7.5 High
- tp-link archer c5 firmware, archer c7 firmware, mr3420 firmware +24 more +26 moreA password-disclosure issue in the web interface on certain TP-Link devices allows a remote...9.8 Critical
- litespeedtech litespeed cacheA cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for...6.1 Medium
- techkshetrainfo savsoft quizA Cross Site Scripting (XSS) vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject...6.1 Medium
- user registration \& login and user management system with admin panel project registration \& login and user management system with admin panelA Cross Site Request Forgery (CSRF) vulnerability exists in the loginsystem page in PHPGurukul...8.8 High
- stratodesk notouch centerStratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low...8.8 High
- linksys re6500 firmwareBelkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary...9.8 Critical
- linksys re6500 firmwareBelkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute...8.8 High
- linksys re6500 firmwareBelkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute...8.8 High
- linksys re6500 firmwareBelkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to cause a persistent...7.5 High
python-aptDebianpython-apt - regression updateNo score- stepmania, xiph.org libvorbis +1 morelib/codebook.c in libvorbis before 1.3.6, as used in StepMania 5.0.12 and other products, has...6.5 Medium
- esri arcgis serverEsri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.9.8 Critical
- parallels remote application serverParallels Remote Application Server (RAS) 18 allows remote attackers to discover an intranet IP...5.3 Medium
- bloofox bloofoxcmsbloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files (with "Content-Type: application...4.9 Medium
- multiqueue project multiqueueData races in multiqueue8.1 High
- daybydaycrm daybydayDaybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.5.4 Medium
- daybydaycrm daybydayDaybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.5.4 Medium
- daybydaycrm daybydayDaybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.5.4 Medium
- daybydaycrm daybydayDaybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.5.4 Medium
- phplistphpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the ...7.2 High
- freedesktop popplerDCTStream::getChars in DCTStream.cc in Poppler 20.12.1 has a heap-based buffer overflow via a...7.8 High
pcapplusplusOSS-FuzzBad-cast to pcpp::Layer from invalid vptrNo score- date-and-time project date-and-timeRegular expression Denial of Service in date-and-time7.5 High
- browserup proxy, browserup-proxy +1 moreTemplate Injection in BrowserUp Proxy10.0 Critical
- hyperledger indy-nodeAuthorization bypass in Hyperledger Indy7.5 High
- mariadbWith MariaDB running on Windows, when local clients connect to the server over named pipes, it's...7.0 High
- egavilanmedia egm address bookEGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain...9.8 Critical
- egavilanmedia under construction page with cpanelEGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An...9.8 Critical
- wondercmsWonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Admin Panel. An attacker can...4.8 Medium
- google androidOn some Samsung phones and tablets running Android through 7.1.1, it is possible for an attacker...8.8 High
- arm compilerArm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot...7.8 High
- pi-holeThe DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the...6.1 Medium
- opensmtpd, fedoraproject fedora +1 moresmtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to...7.5 High
- opensmtpd, fedoraproject fedora +1 moresmtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote...7.5 High
- huawei cloudengine 1800vCloudEngine 1800V versions V100R019C10SPC500 has a resource management error vulnerability....7.5 High
- huawei mate 10 firmware, mate 30 firmware, mate 30 pro firmware +2 more +4 moreThere is a privilege escalation vulnerability on some Huawei smart phones due to design defects....6.2 Medium
- huawei cloudengine 12800 firmware, cloudengine 5800 firmware, cloudengine 6800 firmware +1 more +3 moreThere is a privilege escalation vulnerability in some versions of CloudEngine 12800,CloudEngine...6.7 Medium
- huawei nip6800 firmware, secospace usg6600 firmware, usg9500 firmware +2 moreThere is an out-of-bounds read vulnerability in some versions of NIP6800, Secospace USG6600 and...6.5 Medium
- huawei te mobileThere is an information disclosure vulnerability in TE Mobile software versions V600R006C10...4.4 Medium
- huawei imanager neteco 6000There has a CSV injection vulnerability in iManager NetEco 6000 versions V600R021C00. An attacker...7.8 High
- f5 big-ip advanced web application firewall, big-ip application security manager +1 moreOn BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under...7.5 High
- f5 big-ip apm, big-ip access policy manager +1 moreIn versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2,...6.1 Medium
- f5 big-ip, big-ip access policy manager, big-ip advanced firewall manager +12 more +14 moreOn BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS)...6.1 Medium
- f5 big-ip carrier-grade nat, big-ip local traffic manager +1 moreOn BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5,...7.5 High
- Show moreLoading…