CVEs published January 26, 2021
53 CVEs were published on January 26, 2021: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 0
- High
- 5
- Medium
- 5
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- OPC UA Tunneller
- 4
- Nextcloud Server
- 2
- NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- 2
- Reolink RLC-4XX series · Reolink RLC-5XX series +1
- 2
- TPEditor
- 2
- Apache Hadoop · org.apache.hadoop:hadoop-common
- 1
- Apache Traffic Control · github.com/apache/trafficcontrol
- 1
- ckeditor4
- 1
- ckeditor4-dev
- 1
- DIYgod RSSHub · rsshub
- 1
High 5
- CVE-2021-1070NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in…NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- CVE-2021-21278Risk of code injection in RSSHubDIYgod RSSHub · rsshub
- CVE-2020-13582A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00.Micrium
- CVE-2020-4949IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML…IBM WebSphere Application Server
- CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root
Medium, low and unrated 48
- CVE-2013-2512The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command…ftpd
- CVE-2021-3165SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
- CVE-2021-3317KLog Server through 2.4.1 allows authenticated command injection.
- CVE-2021-1071NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains…NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- CVE-2020-23776A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on.
- CVE-2020-23774A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
- CVE-2021-21271Denial of service in TenderMint Coretendermint · github.com/tendermint/tendermint
- CVE-2021-21283XSS in Flarum Sticky extension.flarum sticky · flarum/sticky
- CVE-2021-26272It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into…ckeditor4
- CVE-2021-26271It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles…ckeditor4-dev
- CVE-2021-3309packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification…
- CVE-2021-3308An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x.
- CVE-2021-22159Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly…
- CVE-2020-27295The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on…OPC UA Tunneller
- CVE-2020-27297The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled…OPC UA Tunneller
- CVE-2020-27299The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information…OPC UA Tunneller
- CVE-2020-27274Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to…OPC UA Tunneller
- CVE-2021-23272TIBCO BPM Cross Site Scripting (XSS)TIBCO Software TIBCO BPM Enterprise
- CVE-2020-35263EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbitrary code…
- CVE-2020-23449newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java.
- CVE-2020-23448newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java.
- CVE-2020-23447newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle.
- CVE-2020-8295A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.Nextcloud Server
- CVE-2020-8293A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules…Nextcloud Server
- CVE-2020-4889IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development…IBM Spectrum Scale
Show all 48 entriesShow fewer entries
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header…Apache Hadoop · org.apache.hadoop:hadoop-common
- CVE-2020-27284TPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it processes project files, allowing an attacker…TPEditor
- CVE-2020-27280A use after free issue has been identified in the way ISPSoft(v3.12 and prior) processes project files, allowing an attacker to craft a…ISPSoft
- CVE-2020-27288An untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior) processes project files, allowing an attacker to…TPEditor
- CVE-2020-25169Reolink P2P CamerasReolink RLC-4XX series · Reolink RLC-5XX series +1
- CVE-2020-25173Reolink P2P CamerasReolink RLC-4XX series · Reolink RLC-5XX series +1
- CVE-2020-17522When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files…Apache Traffic Control · github.com/apache/trafficcontrol
- CVE-2021-21615Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a…Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-3297On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.
- CVE-2021-25864node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to…node-red-contrib-huemagic
- CVE-2021-25863Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.
- CVE-2020-36011A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject…
- CVE-2021-3291Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page)…zencart/zencart
- CVE-2021-3304Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.
- CVE-2021-3223Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.node-red-dashboard
- CVE-2021-26266cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
- CVE-2021-26267cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
- CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the…stdlib
- CVE-2021-3115Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get"…toolchain
- CVE-2020-29001An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury…
- CVE-2020-29000An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices.
- CVE-2020-28999An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices.
- CVE-2020-28998An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices.