CVE-2020-28072 - A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE.
Published: December 15, 2020; 4:15:15 PM -0500

V3.1: 7.2 HIGH
V2.0: 6.5 MEDIUM

CVE-2020-35381 - jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.
Published: December 15, 2020; 4:15:15 PM -0500

V3.1: 7.5 HIGH
V2.0: 7.8 HIGH

CVE-2020-35380 - GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.
Published: December 15, 2020; 4:15:15 PM -0500

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-35416 - Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.
Published: December 15, 2020; 4:15:15 PM -0500

V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2019-14477 - AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted.
Published: December 16, 2020; 11:15:13 AM -0500

V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

CVE-2019-14479 - AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software.
Published: December 16, 2020; 12:15:13 PM -0500

V3.1: 8.8 HIGH
V2.0: 9.0 HIGH

CVE-2020-4845 - IBM Security Key Lifecycle Manager 3.0.1 and 4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials di... read CVE-2020-4845
Published: December 17, 2020; 2:15:15 PM -0500

V3.1: 5.4 MEDIUM
V2.0: 3.5 LOW

CVE-2020-4846 - IBM Security Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system... read CVE-2020-4846
Published: December 17, 2020; 2:15:15 PM -0500

V3.1: 2.7 LOW
V2.0: 4.0 MEDIUM

CVE-2020-35476 - A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script... read CVE-2020-35476
Published: December 16, 2020; 3:15:13 AM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-35468 - The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams container may allow a remote attacker to achieve root access with a blank password.
Published: December 15, 2020; 7:15:14 PM -0500

V3.1: 9.8 CRITICAL
V2.0: 10.0 HIGH

CVE-2020-17470 - An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set sufficiently random transaction IDs (they are always set to 1 in _fnet_dns_poll in fnet_dns.c). This significantly simplifies ... read CVE-2020-17470
Published: December 11, 2020; 6:15:13 PM -0500

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2020-25622 - An issue was discovered in SolarWinds N-Central 12.3.0.670. The AdvancedScripts HTTP endpoint allows CSRF.
Published: December 16, 2020; 10:15:12 AM -0500

V3.1: 8.8 HIGH
V2.0: 6.8 MEDIUM

CVE-2020-17469 - An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment starting from a network incoming fragment that still doesn't have a reference to the previous one (which supposedly resides in... read CVE-2020-17469
Published: December 11, 2020; 6:15:13 PM -0500

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-17468 - An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension headers) doesn't check for a valid length of an extension header, and therefore an out-of-bounds read can occur in _fnet_ip6_ext_he... read CVE-2020-17468
Published: December 11, 2020; 6:15:13 PM -0500

V3.1: 7.5 HIGH
V2.0: 5.0 MEDIUM

CVE-2020-4657 - IBM Sterling B2B Integrator 5.2.0.0 through 6.0.3.2 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadi... read CVE-2020-4657
Published: December 16, 2020; 4:15:13 PM -0500

V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-4658 - IBM Sterling File Gateway 2.2.0.0 through 6.0.3.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials d... read CVE-2020-4658
Published: December 16, 2020; 4:15:13 PM -0500

V3.1: 6.1 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-8941 - An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_inet_pton using an attacker controlled klinux_addr_buffer parameter. The parameter size is unchecked allowing the att... read CVE-2020-8941
Published: December 15, 2020; 10:15:13 AM -0500

V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW

CVE-2020-27147 - The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authenticated login URL for the affected system via a REST API. Af... read CVE-2020-27147
Published: December 15, 2020; 1:15:14 PM -0500

V3.1: 6.5 MEDIUM
V2.0: 6.4 MEDIUM

CVE-2020-8283 - An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR ... read CVE-2020-8283
Published: December 14, 2020; 3:15:13 PM -0500

V3.1: 8.8 HIGH
V2.0: 9.0 HIGH

CVE-2020-8942 - An arbitrary memory read vulnerability in Asylo versions up to 0.6.0 allows an untrusted attacker to make a call to enc_untrusted_read whose return size was not validated against the requrested size. The parameter size is unchecked allowing the at... read CVE-2020-8942
Published: December 15, 2020; 10:15:13 AM -0500

V3.1: 5.5 MEDIUM
V2.0: 2.1 LOW