CVEs published in December 2020
18 tracked CVEs from 2 vendors had their first vendor advisory published in December 2020: 3 critical, 2 high. Newest first.
- Added
CVE-2018-19945Critical
QTS: vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6.
QNAP · 1 advisory - Added
CVE-2018-19944High
QTS: cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices.
QNAP · 1 advisory - Added
CVE-2018-19941High
QTS: vulnerability has been reported to affect QNAP NAS.
QNAP · 1 advisory - Added
If exploited, this vulnerability could allow attackers to gain sensitive information via generation of error messages.
QNAP · 1 advisory - Added
CVE-2020-2504Medium
If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station.
QNAP · 1 advisory - Added
CVE-2020-2503Critical
If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
QNAP · 1 advisory - Added
CVE-2020-2499Medium
hard-coded password vulnerability has been reported to affect earlier versions of QES.
QNAP · 1 advisory - Added
CVE-2020-2498Medium
QTS: If exploited, this cross-site scripting vulnerability could
QNAP · 1 advisory - Added
CVE-2020-2497Medium
QTS: If exploited, this cross-site scripting vulnerability could
QNAP · 1 advisory - Added
CVE-2020-2496Medium
QTS: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
QNAP · 1 advisory - Added
CVE-2020-2495Medium
QTS: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station
QNAP · 1 advisory - Added
CVE-2020-2494Medium
QTS: This cross-site scripting vulnerability in Music Station allows remote attackers to inject malicious code.
QNAP · 1 advisory - Added
CVE-2020-2493Medium
Multimedia Console: This cross-site scripting vulnerability in Multimedia Console allows remote attackers to inject malicious code.
QNAP · 1 advisory - Added
CVE-2020-2491Medium
QTS: This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code.
QNAP · 1 advisory - Added
CVE-2019-7198Critical
QTS: This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application.
QNAP · 1 advisory - Added
CVE-2020-17521Unrated
Apache Groovy provides extension methods to aid with creating temporary directories
Apache · 1 advisory - Added
CVE-2020-17527Unrated
Apache Tomcat: Request header mix-up between HTTP/2 streams
Apache · 1 advisory - Added
CVE-2020-13956Unrated
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution
Apache · 1 advisory