CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- shvl project shvlshvl vulnerable to prototype pollution9.8 Critical
- libnested project libnestedPrototype pollution vulnerability in 'libnested'9.8 Critical
- getobject project getobjectPrototype pollution in getobject9.8 Critical
- set-object-value project set-object-valuePrototype pollution in set-object-value9.8 Critical
- deep-set project deep-setPrototype pollution vulnerability in 'deep-set'9.8 Critical
- dset project dsetdset vulnerable to prototype pollution9.8 Critical
- opencartOpenCart Cross-site Scripting (XSS) in the Subject field of mail.4.8 Medium
- opencartOpenCart Stored Cross-Site Scripting4.8 Medium
- rockwellautomation factorytalk diagnosticsAn unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to...7.5 High
- rockwellautomation factorytalk linxAn attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that...7.5 High
- rockwellautomation factorytalk linxAn attacker-controlled memory allocation size can be passed to the C++ new operator in the...5.5 Medium
- rockwellautomation factorytalk linxAn attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr...7.5 High
- nopcommerce storenopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field...4.8 Medium
pngcheckMageiaUpdated pngcheck package fixes security vulnerabilityNo scorekdeconnect-kdeMageiaUpdated kdeconnect-kde packages improve securityNo score- uclouvain openjpeg, debian linux, fedoraproject fedora +1 more +3 moreThere's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is...5.5 Medium
- uclouvain openjpeg, debian linux, fedoraproject fedora +1 more +3 moreA flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide...5.5 Medium
- uclouvain openjpeg, debian linux, fedoraproject extra packages for enterprise linux +8 more +10 moreThere's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to...5.5 Medium
- uclouvain openjpeg, debian linux, fedoraproject fedora +1 more +3 moreThere's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker...5.5 Medium
- apache accumuloApache Accumulo Improper Handling of Insufficient Permissions8.1 High
- qnap qts, quts hero +1 moreCommand Injection Vulnerability in QTS and QuTS hero8.8 High
- webminminiserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the...9.8 Critical
libdatetime-timezone-perlDebianlibdatetime-timezone-perl - new upstream versionNo scoretzdataDebiantzdata - new upstream versionNo score- hedgedocStored XSS in mermaid diagrams8.7 High
- hedgedocArbitary file upload7.5 High
- nchsoftware express invoiceNCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.4.8 Medium
- nchsoftware express accountsIn NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted...6.5 Medium
- nchsoftware express accountsNCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by...5.5 Medium
- gdatasoftware g dataAn issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse...9.8 Critical
- linuxfoundation dexAuthentication Bypass in dex9.8 Critical
- joomla joomla\!, joomla! project cms +1 more[20201107] - Core - Write ACL violation in multiple core views7.5 High
- joomla joomla\!, joomla! project cms +1 more[20201106] - Core - CSRF in com_privacy emailexport feature6.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20201105] - Core - User Enumeration in backend login5.3 Medium
- joomla joomla\!, joomla! project cms +1 more[20201104] - Core - SQL injection in com_users list view9.8 Critical
- joomla joomla\!, joomla! project cms +1 more[20201103] - Core - Path traversal in mod_random_image7.5 High
- joomla joomla\!, joomla! project cms +1 more[20201102] - Core - Disclosure of secrets in Global Configuration page7.5 High
- joomla joomla\!, joomla! project cms +1 more[20201101] - Core - com_finder ignores access levels on autosuggest7.5 High
- 3ds teamwork cloudAn incorrect permission assignment (chmod 777) of /etc/environment during the installation script...7.8 High
- opendkimThe test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges...7.8 High
- dexidp dexCritical security issues in XML encoding in Dex9.3 Critical
- hcl dominoHCL Domino v10 and v11 is susceptible to a Denial of Service (DoS) vulnerability due to...7.5 High
- the gnome projectr gdm, gnome display manager +1 moreA flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of...6.4 Medium
- arista eosIn Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one...5.3 Medium
- arista eosAn issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of...7.4 High
- parse-community parse-serverParse Server stores password in plain text7.7 High
- arista eosIn EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP...5.9 Medium
- woocommerce gift cardsUltimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom...8.8 High
- zammadAn issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can...4.9 Medium
- zammadAn issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for...6.5 Medium
- Show moreLoading…