CVEs published in December 2020
1,575 vulnerabilities, 262 critical, 9 exploited.
- usvnUSVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters...9.9 Critical
- qemuIn QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in...6.5 Medium
- gssproxy project gssproxy, debian linux +1 moregssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in...9.8 Critical
wolfsslOSS-FuzzHeap-buffer-overflow in ato16No scorendpiOSS-FuzzUNKNOWN READ in ndpi_freeNo score- google libwebp, debian linux, netapp ontap select deploy administration utility +1 more +3 moreA flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an...7.5 High
- google libwebp, apple ipados, iphone os +3 more +5 moreA flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function...9.1 Critical
- google libwebp, apple ipados, iphone os +3 more +5 moreA flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function...9.1 Critical
- google libwebp, apple ipados, iphone os +3 more +5 moreA flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread...9.8 Critical
- google libwebp, apple ipados, iphone os +3 more +5 moreA flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function...9.8 Critical
- libtiff, debian linux, fedoraproject fedora +2 more +4 moreA heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff...7.8 High
- libtiff, debian linux, netapp ontap select deploy administration utility +1 more +3 moreAn integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw...7.8 High
- linux kernel, netapp a700s firmware, aff a400 firmware +15 more +17 moreA flaw possibility of race condition and incorrect initialization of the process id was found in...4.5 Medium
- privoxyA flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered...7.5 High
- apple ipados, macos, tvos +5 more +7 more"Clear History and Website Data" did not clear the history. The issue was addressed with improved...3.3 Low
- apache spamassassin, debian linux, fedoraproject fedora +2 moreApache SpamAssassin has an OS Command Injection vulnerability9.8 Critical
- mozilla thunderbirdDuring the plaintext phase of the STARTTLS connection setup, protocol commands could have been...8.8 High
- xwikiImproper escaping in XWiki Platform7.5 High
- medialize uri.jsHostname spoofing in URI.js6.5 Medium
- vegaXSS in Vega8.7 High
- dockerPath Traversal in Moby builder5.3 Medium
- mantisbtMantisBT SQL Injection via mc_project_get_users function5.3 Medium
- tenda ac6 firmwareOn Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the...7.5 High
- webswingJsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.9.8 Critical
- matrixsslIn MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to...7.5 High
- ptarmigan project ptarmiganPtarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true...7.5 High
- linbit csync2, debian linux +1 moreAn issue was discovered in LINBIT csync2 through 2.0. It does not correctly check for the return...5.3 Medium
- morph project morphAn issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an...7.5 High
- eai project eaiA typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05,...7.5 High
- xbornidAn issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29,...7.5 High
- newgensoft egovIn Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other...7.5 High
- dropbear ssh project sshDropbear 2011.54 through 2018.76 has an inconsistent failure delay that may lead to revealing...5.3 Medium
- dlink dap-1650 firmwareAn issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix....9.8 Critical
- amaze file manager project file managerThe Amaze File Manager application before 3.4.2 for Android does not properly restrict intents...9.8 Critical
- boltcms boltOS Command injection in Bolt5.3 Medium
- ploneImproper Restriction of XML External Entity Reference in Plone8.8 High
- ploneSSRF attacks via tracebacks in Plone8.8 High
- ploneImproper Restriction of XML External Entity Reference in Plone8.8 High
- dotcmsdotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby...8.8 High
- egavilanmedia user registration and login system with admin panelEGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site...5.4 Medium
- egavilanmedia user registration and login system with admin panelEGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site...6.1 Medium
- sapplica sentrifugo** UNSUPPORTED WHEN ASSIGNED ** Sentrifugo 3.2 allows Stored Cross-Site Scripting (XSS)...6.1 Medium
- egavilanmedia user registration and login system with admin panelEGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL...7.5 High
- mantisbtMantisBT Incorrect Authorization for bug_revision_view_page.php check7.5 High
- umbraco cmsUmbraco CMS vulnerable to stored XSS5.4 Medium
- umbraco cmsA stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user...5.4 Medium
- umbraco cmsAuthenticated path traversal in Umbraco CMS6.5 Medium
- wondercmsWonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This...5.4 Medium
- wondercmsWonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This...5.4 Medium
- flatpressFlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This...4.8 Medium
- Show moreLoading…