# CVEs published 2021-01-04

44 CVEs were published on January 4, 2021: 6 critical, 3 high. Days are UTC.

- [CVE-2020-5361](https://cve.now/CVE-2020-5361.md): Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customer (CVSS 5.1, Dell CPG BIOS)
- [CVE-2020-29498](https://cve.now/CVE-2020-29498.md): Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. (CVSS 6.1, Dell Wyse Management Suite)
- [CVE-2020-29497](https://cve.now/CVE-2020-29497.md): Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. (CVSS 5.4, Dell Wyse Management Suite)
- [CVE-2020-29496](https://cve.now/CVE-2020-29496.md): Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. (CVSS 4.8, Dell Wyse Management Suite)
- [CVE-2020-29492](https://cve.now/CVE-2020-29492.md): Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. (CVSS 10.0, Dell Wyse Proprietary OS)
- [CVE-2020-29491](https://cve.now/CVE-2020-29491.md): Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. (CVSS 10.0, Dell Wyse Proprietary OS)
- [CVE-2020-26297](https://cve.now/CVE-2020-26297.md): XSS in mdBook's search page (CVSS 8.2, rust-lang mdBook · mdBook)
- [CVE-2021-3014](https://cve.now/CVE-2021-3014.md): In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. (no CVSS)
- [CVE-2020-26294](https://cve.now/CVE-2020-26294.md): Exposure of server configuration (CVSS 7.4, go-vela compiler · github.com/go-vela/compiler)
- [CVE-2020-26293](https://cve.now/CVE-2020-26293.md): Possible XSS bypass if style tag is allowed (CVSS 6.1, mganss HtmlSanitizer · HtmlSanitizer)
- [CVE-2020-26292](https://cve.now/CVE-2020-26292.md): Potential Malware Discovered (Possible False Positive) (CVSS 3.1, chatter-social Creeper)
- [CVE-2020-35219](https://cve.now/CVE-2020-35219.md): The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authenti (no CVSS)
- [CVE-2020-36155](https://cve.now/CVE-2020-36155.md): An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. (CVSS 10.0)
- [CVE-2020-36156](https://cve.now/CVE-2020-36156.md): An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update (CVSS 9.9)
- [CVE-2020-36157](https://cve.now/CVE-2020-36157.md): An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. (CVSS 10.0)
- [CVE-2020-24386](https://cve.now/CVE-2020-24386.md): An issue was discovered in Dovecot before 2.3.13. (no CVSS)
- [CVE-2020-25275](https://cve.now/CVE-2020-25275.md): Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with (no CVSS)
- [CVE-2020-36154](https://cve.now/CVE-2020-36154.md): The Application Wrapper in Pearson VUE VTS Installer 2.3.1911 has Full Control permissions for Everyone in the "%SYSTEMDRIVE%\\Pearson VUE" d (no CVSS)
- [CVE-2020-36112](https://cve.now/CVE-2020-36112.md): CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in book (no CVSS)
- [CVE-2020-35507](https://cve.now/CVE-2020-35507.md): There's a flaw in bfd\_pef\_parse\_function\_stubs of bfd/pef.c in binutils in versions prior to 2.34 which could allow an attacker who is able (no CVSS, binutils)
- [CVE-2020-35496](https://cve.now/CVE-2020-35496.md): There's a flaw in bfd\_pef\_scan\_start\_address() of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file t (no CVSS, binutils)
- [CVE-2020-35495](https://cve.now/CVE-2020-35495.md): There's a flaw in binutils /bfd/pef.c. (no CVSS, binutils)
- [CVE-2020-35494](https://cve.now/CVE-2020-35494.md): There's a flaw in binutils /opcodes/tic4x-dis.c. (no CVSS, binutils)
- [CVE-2020-35493](https://cve.now/CVE-2020-35493.md): A flaw exists in binutils in bfd/pef.c. (no CVSS, binutils)
- [CVE-2020-22550](https://cve.now/CVE-2020-22550.md): Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2020-4942](https://cve.now/CVE-2020-4942.md): IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute ma (CVSS 6.5, IBM Curam SPM)
- [CVE-2020-4928](https://cve.now/CVE-2020-4928.md): IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. (CVSS 6.7, IBM Cloud Pak System)
- [CVE-2020-4919](https://cve.now/CVE-2020-4919.md): IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on (CVSS 4.7, IBM Cloud Pak System)
- [CVE-2020-4918](https://cve.now/CVE-2020-4918.md): IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in (CVSS 2.3, IBM Cloud Pak System)
- [CVE-2020-4917](https://cve.now/CVE-2020-4917.md): IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized act (CVSS 4.3, IBM Cloud Pak System)
- [CVE-2020-4916](https://cve.now/CVE-2020-4916.md): IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. (CVSS 5.5, IBM Cloud Pak System)
- [CVE-2020-4913](https://cve.now/CVE-2020-4913.md): IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. (CVSS 4.4, IBM Cloud Pak System)
- [CVE-2020-4912](https://cve.now/CVE-2020-4912.md): IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privi (CVSS 4.7, IBM Cloud Pak System)
- [CVE-2020-4910](https://cve.now/CVE-2020-4910.md): IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Cloud Pak System)
- [CVE-2020-4909](https://cve.now/CVE-2020-4909.md): IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Cloud Pak System)
- [CVE-2020-28464](https://cve.now/CVE-2020-28464.md): Remote Code Execution (RCE) (CVSS 9.8, djv)
- [CVE-2020-7771](https://cve.now/CVE-2020-7771.md): Prototype Pollution (CVSS 7.5, asciitable.js)
- [CVE-2019-16960](https://cve.now/CVE-2019-16960.md): SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. (no CVSS)
- [CVE-2019-16956](https://cve.now/CVE-2019-16956.md): SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. (no CVSS)
- [CVE-2021-3007](https://cve.now/CVE-2021-3007.md): Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execu (no CVSS, zendframework/zendframework · laminas/laminas-http)
- [CVE-2021-21495](https://cve.now/CVE-2021-21495.md): MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar\_central.php?acao=altsenha\_princ URI. (no CVSS)
- [CVE-2021-21494](https://cve.now/CVE-2021-21494.md): MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs\_ajax.php tipo parameter. (no CVSS)
- [CVE-2020-35965](https://cve.now/CVE-2020-35965.md): decode\_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero (no CVSS)
- [CVE-2019-25013](https://cve.now/CVE-2019-25013.md): The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR e (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.