CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- zammadAn issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO...9.8 Critical
- zammadAn issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base...4.3 Medium
- zammadAn SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for...7.5 High
- zammadAn issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and...5.4 Medium
- zammadAn account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality...4.3 Medium
- zammadAn issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.5.4 Medium
- zammadAn issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can...4.3 Medium
- zammadAn issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users)...4.9 Medium
- zammadAn issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change...7.5 High
- tag project tagdhowden tag panic due to out-of-bounds read6.5 Medium
- tag project tagdhowden tag panic due to out-of-bounds read6.5 Medium
- tag project tagdhowden tag panic due to out-of-bounds read6.5 Medium
- tag project tagDenial of Service in dhowden/tag6.5 Medium
- panasonic wv-s2231l firmwarePanasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel ...7.5 High
- panasonic wv-s2231l firmwarePanasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which...6.8 Medium
- foscammall foscam x1 firmwareFOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc...6.8 Medium
- tendacn ac1200 firmwareOn Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed...7.5 High
- tendacn ac1200 firmwareOn Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a...7.2 High
- wavpack, debian linux, fedoraproject fedora +2 moreWavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an...6.1 Medium
- roundcube webmail, debian linux, fedoraproject fedora +2 morelinkref_addindex in rcube_string_replacer.php in Roundcube Webmail before 1.4.10 allows XSS via a...6.1 Medium
- liftoffsoftware gateoneGateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory...7.5 High
- woocommerceWooCommerce Incorrect Authorization5.3 Medium
- acc reader project reader`Read` on uninitialized buffer in `fill_buf()` and `read_up_to()`9.8 Critical
- acc reader project readerUse of Uninitialized Resource in acc_reader.9.8 Critical
- cxuu cxuucmsCXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.6.1 Medium
- cxuu cxuucmsCXUUCMS V3 allows class="layui-input" XSS.6.1 Medium
- zyxel vpn orchestrator, zld, nsg firmware +1 more +3 moreCertain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd...7.2 High
- xuxueli xxl-jobCross-site Scripting in XXL-JOB6.1 Medium
- klogserver klog serverKLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions...9.8 Critical
- fasterxml jackson-databind, debian linux, netapp service level manager +37 more +39 moreSerialization gadget exploit in jackson-databind8.1 High
- gnu binutils, netapp ontap select deploy administration utility +1 moreAn issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed...3.3 Low
- jiransecurity spamsniperJiransecurity Spamsniper Stack-based Buffer Overflow Vulnerability8.1 High
- backblazeBackblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege...7.8 High
- backblazeBackblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from...7.8 High
yaraOSS-FuzzHeap-buffer-overflow in dotnet_parse_tilde_2No score- crossbar autobahnOpen Redirect in autobahn6.1 Medium
python-aptDebianpython-apt - regression updateNo scorekdeconnect-kdeopenSUSESecurity update for kdeconnect-kdeNo score- flamingo project flamingoFlamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager:...9.8 Critical
- flamingo project flamingoFlamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager:...9.8 Critical
- flamingo project flamingoFlamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager:...9.8 Critical
- flamingo project flamingoFlamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager:...9.8 Critical
- struct2json project struct2jsonstruct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for...9.8 Critical
- tengine project tengine** DISPUTED ** The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash....5.5 Medium
- huorong internet securityBeijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by...9.8 Critical
kdeconnect-kdeopenSUSESecurity update for kdeconnect-kdeNo score- flamingoim project flamingoimFlamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only...7.5 High
- dext5 dext5uploadDEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler...7.5 High
- pureftpd pure-ftpdPure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough...7.5 High
- gobby project gobbyGobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls.7.5 High
- Show moreLoading…