Skip to content
OpenAdvisories

Archive

17 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /17 January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

62 results · Feed

  • Unscored —
    CVE-2020-35453

    HashiCorp Vault Enterprise’s Sentinel EGP policy feature incorrectly allowed requests to be processed in parent and sib…

  • Medium 6.5
    CVE-2020-35177

    Enumeration of users in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.

    github.com/hashicorp/vault vault Alpine Go
  • High 7.5
    CVE-2020-29652

    golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability

    A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go
  • Unscored —
    CVE-2020-27199 Public exploit

    The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the applicatio…

  • Unscored —
    CVE-2020-35123

    In Zimbra Collaboration Suite Network Edition versions < 9.0.0 P10 and 8.8.15 P17, there exists an XXE vulnerability in…

  • Unscored —
    CVE-2020-25011

    A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device S…

  • Unscored —
    CVE-2020-25010

    An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers …

  • Unscored —
    CVE-2020-25094

    LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program na…

  • Unscored —
    CVE-2020-25095

    LogRhythm Platform Manager (PM) 7.4.9 allows CSRF. The Web interface is vulnerable to Cross-site WebSocket Hijacking (C…

  • Unscored —
    CVE-2020-25096

    LogRhythm Platform Manager (PM) 7.4.9 has Incorrect Access Control. Users within LogRhythm can be delegated different r…

  • Unscored —
    CVE-2020-29436

    Sonatype Nexus Repository Manager 3.x before 3.29.0 allows a user with admin privileges to configure the system to gain…

  • Unscored —
    CVE-2020-35192

    The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker …

  • Unscored —
    CVE-2020-35190

    The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root …

  • Unscored —
    CVE-2020-35184

    The official composer docker images before 1.8.3 contain a blank password for a root user. System using the composer do…

  • Unscored —
    CVE-2020-35196

    The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password f…

  • Unscored —
    CVE-2020-35186

    The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the admi…

  • Unscored —
    CVE-2020-35195

    The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. Sys…

  • Unscored —
    CVE-2020-35191 Public exploit

    The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. …

  • Unscored —
    CVE-2020-35197

    The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. S…

  • Unscored —
    CVE-2020-35187

    The official telegraf docker images before 1.9.4-alpine (Alpine specific) contain a blank password for a root user. Sys…

  • Unscored —
    CVE-2020-35189

    The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System …

  • Unscored —
    CVE-2020-35185

    The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. Syste…