CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In December 2020

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
251 CVE-2020-35453 20 2020-12-17 2021-07-21
5.0
 None Remote Low Not required None Partial None
HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sibling namespaces. Fixed in 1.5.6 and 1.6.1.
252 CVE-2020-35450 476 2020-12-26 2020-12-29
5.0
 None Remote Low Not required None None Partial
Gobby 0.4.11 allows a NULL pointer dereference in the D-Bus handler for certain set_language calls.
253 CVE-2020-35448 125 2020-12-27 2022-04-26
4.3
 None Remote Medium Not required Partial None None
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.
254 CVE-2020-35437 79 XSS 2020-12-26 2021-01-05
4.3
 None Remote Medium Not required None Partial None
Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the /_core/profile/ URI.
255 CVE-2020-35416 79 XSS 2020-12-15 2020-12-18
4.3
 None Remote Medium Not required None Partial None
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.
256 CVE-2020-35396 79 XSS 2020-12-15 2020-12-16
4.3
 None Remote Medium Not required None Partial None
EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website.
257 CVE-2020-35395 79 XSS 2020-12-15 2020-12-16
4.3
 None Remote Medium Not required None Partial None
XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field
258 CVE-2020-35388 +Info 2020-12-26 2020-12-29
5.0
 None Remote Low Not required Partial None None
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true.
259 CVE-2020-35382 89 Sql 2020-12-14 2020-12-14
6.5
 None Remote Low ??? Partial Partial Partial
SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.
260 CVE-2020-35381 DoS 2020-12-15 2021-01-17
7.8
 None Remote Low Not required None None Complete
jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.
261 CVE-2020-35380 DoS 2020-12-15 2020-12-17
5.0
 None Remote Low Not required None None Partial
GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
262 CVE-2020-35378 89 Exec Code Sql Bypass 2020-12-14 2020-12-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands and bypass authentication via the username and password fields.
263 CVE-2020-35376 787 2020-12-26 2021-02-23
5.0
 None Remote Low Not required None None Partial
Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function.
264 CVE-2020-35370 94 Exec Code 2020-12-23 2021-07-21
9.3
 None Remote Medium Not required Complete Complete Complete
A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code execution(RCE) on the hosting server.
265 CVE-2020-35364 269 2020-12-26 2021-07-21
7.5
 None Remote Low Not required Partial Partial Partial
Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot.
266 CVE-2020-35362 22 Dir. Trav. 2020-12-26 2020-12-30
5.0
 None Remote Low Not required Partial None None
DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter (the attacker must provide the correct fileOrgName value).
267 CVE-2020-35359 770 2020-12-26 2020-12-29
5.0
 None Remote Low Not required None None Partial
Pure-FTPd 1.0.48 allows remote attackers to prevent legitimate server use by making enough connections to exceed the connection limit.
268 CVE-2020-35349 79 XSS 2020-12-26 2020-12-29
3.5
 None Remote Medium ??? None Partial None
Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).
269 CVE-2020-35347 352 CSRF 2020-12-26 2020-12-28
4.3
 None Remote Medium Not required None Partial None
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.
270 CVE-2020-35346 79 XSS 2020-12-26 2020-12-28
3.5
 None Remote Medium ??? None Partial None
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.
271 CVE-2020-35338 798 2020-12-14 2020-12-15
7.5
 None Remote Low Not required Partial Partial Partial
The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon."
272 CVE-2020-35284 22 Dir. Trav. 2020-12-26 2020-12-30
5.0
 None Remote Low Not required Partial None None
Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available.
273 CVE-2020-35276 89 Sql Bypass 2020-12-21 2020-12-23
7.5
 None Remote Low Not required Partial Partial Partial
EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user.
274 CVE-2020-35275 79 XSS 2020-12-21 2020-12-21
3.5
 None Remote Medium ??? None Partial None
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.
275 CVE-2020-35274 79 +Priv XSS 2020-12-21 2020-12-21
3.5
 None Remote Medium ??? None Partial None
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
276 CVE-2020-35273 352 +Priv CSRF 2020-12-21 2020-12-22
6.0
 None Remote Medium ??? Partial Partial Partial
EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account.
277 CVE-2020-35269 352 CSRF 2020-12-23 2021-03-02
6.8
 None Remote Medium Not required Partial Partial Partial
Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.
278 CVE-2020-35252 79 XSS 2020-12-23 2020-12-23
4.3
 None Remote Medium Not required None Partial None
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
279 CVE-2020-35245 89 Sql 2020-12-26 2020-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.
280 CVE-2020-35244 89 Sql 2020-12-26 2020-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.
281 CVE-2020-35243 89 Sql 2020-12-26 2020-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.
282 CVE-2020-35242 89 Sql 2020-12-26 2020-12-29
7.5
 None Remote Low Not required Partial Partial Partial
Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory.
283 CVE-2020-35241 79 XSS 2020-12-30 2021-01-04
3.5
 None Remote Medium ??? None Partial None
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
284 CVE-2020-35240 79 XSS 2020-12-30 2022-04-22
3.5
 None Remote Medium ??? None Partial None
FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
285 CVE-2020-35236 862 2020-12-14 2021-07-21
5.0
 None Remote Low Not required None Partial None
The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion.
286 CVE-2020-35235 Exec Code 2020-12-14 2020-12-15
6.5
 None Remote Low ??? Partial Partial Partial
** UNSUPPORTED WHEN ASSIGNED ** vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
287 CVE-2020-35234 532 2020-12-14 2020-12-15
5.0
 None Remote Low Not required Partial None None
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
288 CVE-2020-35208 287 Bypass 2020-12-12 2020-12-15
3.3
 None Local Medium Not required Partial Partial None
** DISPUTED ** An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The password authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary password. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.
289 CVE-2020-35207 287 Bypass 2020-12-12 2020-12-15
3.3
 None Local Medium Not required Partial Partial None
** DISPUTED ** An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. The PIN authentication for unlocking can be bypassed by forcing the authentication result to be true through runtime manipulation. In other words, an attacker could authenticate with an arbitrary PIN. NOTE: the vendor has indicated that this is not an attack of interest within the context of their threat model, which excludes jailbroken devices.
290 CVE-2020-35202 79 XSS 2020-12-12 2020-12-15
3.5
 None Remote Medium ??? None Partial None
Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.
291 CVE-2020-35201 79 XSS 2020-12-12 2020-12-15
3.5
 None Remote Medium ??? None Partial None
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.
292 CVE-2020-35200 79 XSS 2020-12-12 2020-12-14
4.3
 None Remote Medium Not required None Partial None
Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
293 CVE-2020-35199 79 XSS 2020-12-12 2020-12-15
3.5
 None Remote Medium ??? None Partial None
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.
294 CVE-2020-35197 306 2020-12-17 2020-12-22
10.0
 None Remote Low Not required Complete Complete Complete
The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. System using the memcached docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
295 CVE-2020-35196 306 2020-12-17 2020-12-22
10.0
 None Remote Low Not required Complete Complete Complete
The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password for a root user. System using the rabbitmq docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
296 CVE-2020-35195 306 2020-12-17 2020-12-21
10.0
 None Remote Low Not required Complete Complete Complete
The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. System using the haproxy docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
297 CVE-2020-35193 306 2020-12-16 2020-12-21
10.0
 None Remote Low Not required Complete Complete Complete
The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System using the sonarqube docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
298 CVE-2020-35192 306 2020-12-17 2020-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
299 CVE-2020-35191 306 2020-12-17 2020-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. System using the drupal docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
300 CVE-2020-35190 306 2020-12-17 2020-12-18
10.0
 None Remote Low Not required Complete Complete Complete
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.
Total number of vulnerabilities : 1530   Page : 1 2 3 4 5 6 (This Page)7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.