Skip to content
OpenAdvisories

Archive

30 December 2020

Vulnerabilities first published on this day (UTC), newest first.

← November 2020 2020 / December /30 January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.7
    CVE-2020-26296

    XSS in Vega

    Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Veg…

    vega vega vega npm
  • High 7.7
    CVE-2020-26288

    Parse Server stores password in plain text

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is …

    parse-community parse-server parse-server npm
  • High 8.8
    CVE-2020-28736

    Improper Restriction of XML External Entity Reference in Plone

    Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

    plone plone-app-event plone-app-dexterity plone-app-theming PyPI
  • High 8.8
    CVE-2020-28735

    SSRF attacks via tracebacks in Plone

    Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

    plone plone-app-event plone-app-dexterity plone-app-theming PyPI
  • High 8.8
    CVE-2020-28734

    Improper Restriction of XML External Entity Reference in Plone

    Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

    plone plone-app-event plone-app-dexterity plone-app-theming PyPI
  • High 7.5
    CVE-2020-35849

    MantisBT Incorrect Authorization for bug_revision_view_page.php check

    An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential i…

    mantisbt/mantisbt Packagist