Skip to content
OpenAdvisories

Archive

27 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /27 January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

13 results · Feed

  • Unscored —
    CVE-2020-35736 Scanner template EPSS 15%

    GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path…

  • Medium 5.3
    CVE-2020-29156

    WooCommerce Incorrect Authorization

    The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.

    woocommerce/woocommerce Packagist
  • Unscored —
    CVE-2020-29250

    CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.

  • Unscored —
    CVE-2020-29249

    CXUUCMS V3 allows class="layui-input" XSS.

  • Unscored —
    CVE-2020-29299

    Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change …

  • Medium 6.1
    CVE-2020-29204 Public exploit

    Cross-site Scripting in XXL-JOB

    XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

    com.xuxueli:xxl-job-core Maven
  • Unscored —
    CVE-2020-35729 Public exploit Scanner template EPSS 88%

    KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

  • High 8.1
    CVE-2020-35728 Public exploit EPSS 13%

    Serialization gadget exploit in jackson-databind

    FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Unscored —
    CVE-2020-35448

    An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1…

    binutils mingw-w64-binutils binutils-cross-embedded Debian Alpine
  • High 8.1
    CVE-2020-7845

    Jiransecurity Spamsniper Stack-based Buffer Overflow Vulnerability

    Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command. It leads remote attacker to execute arbitrary code via crafted packet.

    Jiransecurity Spamsniper
  • Unscored —
    CVE-2020-8290 Public exploit

    Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit…

  • Unscored —
    CVE-2020-8289 Public exploit

    Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate valida…

  • Medium 6.1
    CVE-2020-35678

    Open Redirect in autobahn

    Autobahn|Python before 20.12.3 allows redirect header injection.

    python-autobahn autobahn python-autobahn Debian Ubuntu PyPI