Skip to content
OpenAdvisories

Archive

December 2020

Vulnerabilities first published in this month (UTC), newest first.

← November 2020 2020 / December January 2021 →
  1. 129
  2. 246
  3. 355
  4. 427
  5. 52
  6. 6 
  7. 723
  8. 8116
  9. 9130
  10. 1037
  11. 11120
  12. 126
  13. 13 
  14. 1490
  15. 15129
  16. 1645
  17. 1762
  18. 1866
  19. 19 
  20. 203
  21. 2152
  22. 2245
  23. 2341
  24. 2452
  25. 2510
  26. 2628
  27. 2713
  28. 2845
  29. 29105
  30. 3041
  31. 31133
All Critical High Medium Low Exploited only Public exploit

95 results · Clear filters · Feed

  • Unscored —
    CVE-2020-27904 Public exploit

    A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is …

    Apple macOS macOS
  • High 7.3
    CVE-2020-26233 Public exploit

    Remote Code Execution in Git Credential Manager Core

    Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will f…

    Microsoft Git-Credential-Manager-Core
  • Unscored —
    CVE-2020-9922 Public exploit

    A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6, Security Upd…

    Apple macOS macOS
  • Medium 5.9
    CVE-2020-1971 Public exploit

    EDIPARTYNAME NULL pointer dereference

    The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equa…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-27818 Public exploit

    A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be …

    pngcheck pngcheck Debian Ubuntu
  • Critical 9.8
    CVE-2020-17531 Public exploit

    Deserialization flaw in EOL Tapestry 4.

    A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached e…

    Apache Software Foundation Apache Tapestry org.apache.tapestry:tapestry-project Maven
  • Unscored —
    CVE-2020-29597 Public exploit Scanner template EPSS 71%

    IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows u…

  • Unscored —
    CVE-2020-13945 Public exploit Scanner template EPSS 74%

    In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the…

    Apache Software Foundation Apache APISIX
  • Unscored —
    CVE-2020-29599 Public exploit

    ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a passw…

    imagemagick imagemagick imagemagick imagemagick6 Debian Ubuntu Alpine
  • High 7.5
    CVE-2020-17527 Public exploit EPSS 25%

    Apache Tomcat: Request header mix-up between HTTP/2 streams

    While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Azure Linux Maven
  • High 7.8
    CVE-2020-14381 Public exploit

    A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • Unscored —
    CVE-2020-29240 Public exploit

    Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of …

  • Unscored —
    CVE-2020-25265 Public exploit

    AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by provi…

    libappimage libappimage Debian Ubuntu
  • Unscored —
    CVE-2020-11990 Public exploit

    We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications.…

  • Medium 5.2
    CVE-2020-15257 Public exploit

    containerd-shim API Exposed to Host Network Containers

    containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s AP…

    containerd containerd ctop docker.io Debian Ubuntu Alpine Wolfi Go