Archive

December 2020

Vulnerabilities first published in this month (UTC), newest first.

← November 2020 2020 / December January 2021 →

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

High 7.5

CVE-2020-13654 Public exploit

Improper escaping in XWiki Platform

XWiki Platform before 12.8 mishandles escaping in the property displayer.

org.xwiki.platform:xwiki-platform-web Maven

Dec 31, 2020
High 8.1

CVE-2020-17533 Public exploit

Apache Accumulo Improper Handling of Insufficient Permissions

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values o…

Apache Software Foundation Apache Accumulo org.apache.accumulo:accumulo-master Maven

Dec 29, 2020
High 8.1

CVE-2020-35728 Public exploit EPSS 13%

Serialization gadget exploit in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Dec 27, 2020
High 8.8

CVE-2020-13519 Public exploit

A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A…

Dec 18, 2020
High 8.1

CVE-2020-28052 Public exploit

Logic error in Legion of the Bouncy Castle BC Java

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…

bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on org.bouncycastle:bcprov-jdk15 Debian Maven

Dec 18, 2020
High 7.3

CVE-2020-28458 Public exploit

Prototype Pollution

All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

datatables.net npm

Dec 16, 2020
High 8.4

CVE-2020-17144 Exploited Public exploit EPSS 37%

Microsoft Exchange Remote Code Execution Vulnerability

Microsoft Exchange Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 31

Dec 9, 2020
KEV Nov 3, 2021
High 7.8

CVE-2020-17136 Public exploit EPSS 14%

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 9, 2020
High 7.0

CVE-2020-17103 Public exploit EPSS 30%

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 9, 2020
High 7.8

CVE-2020-27930 Exploited Public exploit EPSS 22%

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, wa…

Apple macOS iOS and iPadOS watchOS macOS iOS

Dec 8, 2020
KEV Nov 3, 2021
High 7.3

CVE-2020-26233 Public exploit

Remote Code Execution in Git Credential Manager Core

Git Credential Manager Core (GCM Core) is a secure Git credential helper built on .NET Core that runs on Windows and macOS. In Git Credential Manager Core before version 2.0.289, when recursively cloning a Git repository on Windows with submodules, Git will f…

Microsoft Git-Credential-Manager-Core

Dec 8, 2020
High 7.5

CVE-2020-17527 Public exploit EPSS 25%

Apache Tomcat: Request header mix-up between HTTP/2 streams

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated wi…

Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Dec 3, 2020
High 7.8

CVE-2020-14381 Public exploit

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

Dec 3, 2020