Archive

27 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /27 January 2021 →

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

Medium 5.3

CVE-2020-29156

WooCommerce Incorrect Authorization

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.

woocommerce/woocommerce Packagist

Dec 27, 2020
Medium 6.1

CVE-2020-29204 Public exploit

Cross-site Scripting in XXL-JOB

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

com.xuxueli:xxl-job-core Maven

Dec 27, 2020
Medium 6.1

CVE-2020-35678

Open Redirect in autobahn

Autobahn|Python before 20.12.3 allows redirect header injection.

python-autobahn autobahn python-autobahn Debian Ubuntu PyPI

Dec 27, 2020