Skip to content
OpenAdvisories

Archive

8 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /8 January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.8
    CVE-2020-26234

    Disabled Hostname Verification in OpenCast

    Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid fo…

    opencast opencast org.opencastproject:opencast-kernel Maven
  • Medium 5.7
    CVE-2020-26256

    Denial of service in fast-csv

    Fast-csv is an npm package for parsing and formatting CSVs or any other delimited value file in node. In fast-cvs before version 4.3.6 there is a possible ReDoS vulnerability (Regular Expression Denial of Service) when using ignoreEmpty option when parsing. T…

    C2FO fast-csv @fast-csv/parse fast-csv npm
  • Medium 5.5
    CVE-2020-27950 Exploited Public exploit EPSS 17%

    A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watc…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Nov 3, 2021
  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2020-26255

    PHP Phar archives could be uploaded and executed in Kirby

    Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have …

    getkirby kirby getkirby/cms getkirby/panel Packagist
  • Medium 6.8
    CVE-2020-26253

    .dev domains treated as local in Kirby

    Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that …

    getkirby kirby getkirby/cms getkirby/panel Packagist
  • Medium 6.1
    CVE-2020-25628

    Cross site-scripting (XSS) moodle

    The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2020-25631

    Moodle Cross-site Scripting (XSS)

    A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.9
    CVE-2020-27822

    Wildfly has a memory leak vulnerability

    A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to…

    org.wildfly:wildfly-parent Maven