CVEs published January 5, 2021
48 CVEs were published on January 5, 2021: 4 critical, 11 high. 1 is now in CISA KEV.
- Published
- 48
- Critical
- 4
- High
- 11
- Medium
- 7
- Low
- 0
- Unrated
- 26
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- openjpeg
- 5
- Dell PowerStore
- 3
- Dell Unity
- 3
- IBM Sterling B2B Integrator
- 3
- Win-911
- 3
- github.com/tidwall/gjson
- 2
- Apache Software Foundation Apache Flink · org.apache.fli… +1
- 1
- Apache Software Foundation Apache Flink · org.apache.flink:…
- 1
- CA Technologies, A Broadcom Company CA Service Catalog
- 1
- Dell PowerScale OneFS
- 1
Critical 4
- CVE-2020-13541An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directoryWin-911
- CVE-2020-13540An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install direWin-911
- CVE-2020-13539An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install direWin-911
- CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST APIApache Software Foundation Apache Flink · org.apache.fli… +1
High 11
- CVE-2020-29502Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments.Dell PowerStore
- CVE-2020-29500Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments.Dell PowerStore
- CVE-2020-29490Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS expDell Unity
- CVE-2020-26181Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SDell PowerScale OneFS
- CVE-2020-36066GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.github.com/tidwall/gjson
- CVE-2020-36067GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.github.com/tidwall/gjson
- CVE-2021-21234Directory Traversallukashinsch spring-boot-actuator-logview · eu.hinsch:spring…
- CVE-2020-4899IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmiIBM API Connect
- CVE-2020-4762IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated usIBM Sterling B2B Integrator
- CVE-2019-4728IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker tIBM Sterling B2B Integrator
- CVE-2020-36158mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attacke
Medium, low and unrated 33
- CVE-2020-7336Network Security Management (NSM) - Cross Site Request Forgery vulnerabilityMcAfee Network Security Management
- CVE-2021-3026Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
- CVE-2020-23249GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
- CVE-2020-23250GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.
- CVE-2020-35170Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMaxDell Unisphere for PowerMax
- CVE-2020-29501Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments.Dell PowerStore
- CVE-2020-29489Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability.Dell Unity
- CVE-2020-26199Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability.Dell Unity
- CVE-2020-36051Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
- CVE-2020-36052Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the s
- CVE-2019-20484An issue was discovered in Viki Vera 4.9.1.26180.
- CVE-2019-20483An issue was discovered in Viki Vera 4.9.1.26180.
- CVE-2020-29437SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the or
- CVE-2020-36159Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did
- CVE-2021-22492An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) software.
- CVE-2021-22495An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software.
- CVE-2021-22494An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software.
- CVE-2020-27845There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0.openjpeg
- CVE-2020-27844A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0.openjpeg
- CVE-2021-3022An issue was discovered on LG mobile devices with Android OS 10 software.
- CVE-2020-29478CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker CA Technologies, A Broadcom Company CA Service Catalog
- CVE-2020-27843A flaw was found in OpenJPEG in versions prior to 2.4.0.openjpeg
- CVE-2020-27842There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0.openjpeg
- CVE-2020-27841There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c.openjpeg
- CVE-2021-3021ISPConfig before 3.2.2 allows SQL injection.
- CVE-2020-4761IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker tIBM Sterling B2B Integrator
- CVE-2020-26046FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables.
- CVE-2020-26045FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/.
- CVE-2020-7202A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware.HPE ProLiant Servers, Apollo Products, Converged Systems, a…
- CVE-2020-35488The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon cra
- CVE-2020-17518Apache Flink directory traversal attack: remote file writing through the REST APIApache Software Foundation Apache Flink · org.apache.flink:…
- CVE-2021-3018ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the
- CVE-2021-3019ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet.