# CVEs published 2021-01-14

29 CVEs were published on January 14, 2021: 2 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-27220](https://cve.now/CVE-2020-27220.md): The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command &… (no CVSS, The Eclipse Foundation Eclipse Hono)
- [CVE-2020-27219](https://cve.now/CVE-2020-27219.md): In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain… (no CVSS, The Eclipse Foundation Eclipse Hawkbit · org.eclipse.hawkbi…)
- [CVE-2020-29495](https://cve.now/CVE-2020-29495.md): DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. (CVSS 10.0, Dell Avamar)
- [CVE-2020-29494](https://cve.now/CVE-2020-29494.md): Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM. (CVSS 8.7, Dell Avamar)
- [CVE-2020-29493](https://cve.now/CVE-2020-29493.md): DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. (CVSS 10.0, Dell Avamar)
- [CVE-2020-16046](https://cve.now/CVE-2020-16046.md): Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a… (no CVSS, Google Chrome)
- [CVE-2020-6572](https://cve.now/CVE-2020-6572.md): Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, KEV, Google Chrome)
- [CVE-2020-16045](https://cve.now/CVE-2020-16045.md): Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer… (no CVSS, Google Chrome)
- [CVE-2021-21261](https://cve.now/CVE-2021-21261.md): Flatpak sandbox escape via spawn portal (CVSS 7.3, flatpak)
- [CVE-2021-22132](https://cve.now/CVE-2021-22132.md): Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2020-29015](https://cve.now/CVE-2020-29015.md): A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote… (no CVSS, Fortinet FortiWeb)
- [CVE-2020-29018](https://cve.now/CVE-2020-29018.md): A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory… (no CVSS, Fortinet FortiWeb)
- [CVE-2020-29016](https://cve.now/CVE-2020-29016.md): A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote… (no CVSS, Fortinet FortiWeb)
- [CVE-2020-29017](https://cve.now/CVE-2020-29017.md): An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary… (no CVSS, Fortinet FortiDeceptor)
- [CVE-2020-29019](https://cve.now/CVE-2020-29019.md): A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated… (no CVSS, Fortinet FortiWeb)
- [CVE-2021-21722](https://cve.now/CVE-2021-21722.md): A ZTE Smart STB is impacted by an information leak vulnerability. (no CVSS, ZXV10 B860A)
- [CVE-2020-27368](https://cve.now/CVE-2020-27368.md): Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories… (no CVSS)
- [CVE-2020-26733](https://cve.now/CVE-2020-26733.md): Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows… (no CVSS)
- [CVE-2020-6777](https://cve.now/CVE-2020-6777.md): Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 4.8, Bosch PRAESIDEO · Bosch PRAESENSA)
- [CVE-2020-6776](https://cve.now/CVE-2020-6776.md): CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 8.8, Bosch PRAESIDEO · Bosch PRAESENSA)
- [CVE-2020-29587](https://cve.now/CVE-2020-29587.md): SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. (no CVSS)
- [CVE-2021-23926](https://cve.now/CVE-2021-23926.md): XMLBeans XML Entity Expansion (no CVSS, Apache Software Foundation Apache XMLBeans · org.apache.xml…)
- [CVE-2021-24122](https://cve.now/CVE-2021-24122.md): Apache Tomcat information disclosure (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2020-28470](https://cve.now/CVE-2020-28470.md): Cross-site Scripting (XSS) (CVSS 7.3, @scullyio/scully · @scullyio/ng-lib)
- [CVE-2021-20618](https://cve.now/CVE-2021-20618.md): Privilege chaining vulnerability in acmailer ver. (no CVSS, Seeds Co. acmailer and acmailer DB)
- [CVE-2021-20617](https://cve.now/CVE-2021-20617.md): Improper access control vulnerability in acmailer ver. (no CVSS, Seeds Co. acmailer and acmailer DB)
- [CVE-2021-3138](https://cve.now/CVE-2021-3138.md): In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. (no CVSS)
- [CVE-2020-16119](https://cve.now/CVE-2020-16119.md): DCCP CCID structure use-after-free (CVSS 6.3, Canonical Linux kernel)
- [CVE-2020-26732](https://cve.now/CVE-2020-26732.md): SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.