Skip to content
OpenAdvisories

Archive

24 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /24 January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

52 results · Feed

  • Unscored —
    CVE-2020-35674

    BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordR…

  • Unscored —
    CVE-2020-35675

    BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of m…

  • Unscored —
    CVE-2020-35676

    BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the s…

  • Unscored —
    CVE-2020-35677

    BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrato…

  • Medium 6.1
    CVE-2020-35669 Public exploit

    http before 0.13.3 vulnerable to header injection

    An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.

    http Pub
  • Low 2.3
    CVE-2020-2505

    Sensitive information via generation of error messages vulnerability in QES

    If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

    QNAP Systems QES
  • Medium 5.8
    CVE-2020-2504

    Absolute path traversal vulnerability in QES

    If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

    QNAP Systems QES
  • Critical 9.0
    CVE-2020-2503

    Stored cross-site scripting vulnerability in QES

    If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.

    QNAP Systems QES
  • Medium 6.3
    CVE-2020-2499

    Hard-coded Password Vulnerability in QES

    A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.

    QNAP Systems QES
  • Unscored —
    CVE-2020-5681

    Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earli…

    Seiko Epson EpsonNet SetupManager and Offirio SynergyWare PrintDirector
  • Unscored —
    CVE-2020-5684

    iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not ver…

    NEC Management software for NEC Storage disk array system
  • Unscored —
    CVE-2020-28188 Public exploit Scanner template EPSS 96%

    Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inj…