CVEs published January 4, 2021
44 CVEs were published on January 4, 2021: 6 critical, 3 high.
- Published
- 44
- Critical
- 6
- High
- 3
- Medium
- 15
- Low
- 2
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- IBM Cloud Pak System
- 9
- binutils
- 5
- Dell Wyse Management Suite
- 3
- Dell Wyse Proprietary OS
- 2
- asciitable.js
- 1
- chatter-social Creeper
- 1
- Dell CPG BIOS
- 1
- djv
- 1
- go-vela compiler · github.com/go-vela/compiler
- 1
- IBM Curam SPM
- 1
Critical 6
- CVE-2020-29492Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability.Dell Wyse Proprietary OS
- CVE-2020-29491Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability.Dell Wyse Proprietary OS
- CVE-2020-36155An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta.
- CVE-2020-36156An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update
- CVE-2020-36157An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles.
- CVE-2020-28464Remote Code Execution (RCE)djv
High 3
Medium, low and unrated 35
- CVE-2020-5361Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customerDell CPG BIOS
- CVE-2020-29498Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability.Dell Wyse Management Suite
- CVE-2020-29497Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability.Dell Wyse Management Suite
- CVE-2020-29496Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability.Dell Wyse Management Suite
- CVE-2021-3014In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.
- CVE-2020-26293Possible XSS bypass if style tag is allowedmganss HtmlSanitizer · HtmlSanitizer
- CVE-2020-26292Potential Malware Discovered (Possible False Positive)chatter-social Creeper
- CVE-2020-35219The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authenti
- CVE-2020-24386An issue was discovered in Dovecot before 2.3.13.
- CVE-2020-25275Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with
- CVE-2020-36154The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\Pearson VUE" d
- CVE-2020-36112CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in book
- CVE-2020-35507There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able binutils
- CVE-2020-35496There's a flaw in bfd_pef_scan_start_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file tbinutils
- CVE-2020-35495There's a flaw in binutils /bfd/pef.c.binutils
- CVE-2020-35494There's a flaw in binutils /opcodes/tic4x-dis.c.binutils
- CVE-2020-35493A flaw exists in binutils in bfd/pef.c.binutils
- CVE-2020-22550Veno File Manager 3.5.6 is affected by a directory traversal vulnerability.
- CVE-2020-4942IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute maIBM Curam SPM
- CVE-2020-4928IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files.IBM Cloud Pak System
- CVE-2020-4919IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on IBM Cloud Pak System
- CVE-2020-4918IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference inIBM Cloud Pak System
- CVE-2020-4917IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actIBM Cloud Pak System
- CVE-2020-4916IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2020-4913IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user.IBM Cloud Pak System
- CVE-2020-4912IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a priviIBM Cloud Pak System
- CVE-2020-4910IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2020-4909IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting.IBM Cloud Pak System
- CVE-2019-16960SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
- CVE-2019-16956SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
- CVE-2021-3007Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execuzendframework/zendframework · laminas/laminas-http
- CVE-2021-21495MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI.
- CVE-2021-21494MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter.
- CVE-2020-35965decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero
- CVE-2019-25013The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR e