# CVEs published 2021-01-05

48 CVEs were published on January 5, 2021: 4 critical, 11 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-7336](https://cve.now/CVE-2020-7336.md): Network Security Management (NSM) - Cross Site Request Forgery vulnerability (CVSS 6.6, McAfee Network Security Management)
- [CVE-2021-3026](https://cve.now/CVE-2021-3026.md): Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. (no CVSS)
- [CVE-2020-23249](https://cve.now/CVE-2020-23249.md): GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. (no CVSS)
- [CVE-2020-23250](https://cve.now/CVE-2020-23250.md): GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. (no CVSS)
- [CVE-2020-35170](https://cve.now/CVE-2020-35170.md): Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax (CVSS 6.3, Dell Unisphere for PowerMax)
- [CVE-2020-29502](https://cve.now/CVE-2020-29502.md): Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. (CVSS 7.5, Dell PowerStore)
- [CVE-2020-29501](https://cve.now/CVE-2020-29501.md): Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. (CVSS 6.4, Dell PowerStore)
- [CVE-2020-29500](https://cve.now/CVE-2020-29500.md): Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. (CVSS 7.5, Dell PowerStore)
- [CVE-2020-29490](https://cve.now/CVE-2020-29490.md): Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exp (CVSS 7.5, Dell Unity)
- [CVE-2020-29489](https://cve.now/CVE-2020-29489.md): Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. (CVSS 6.4, Dell Unity)
- [CVE-2020-26199](https://cve.now/CVE-2020-26199.md): Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. (CVSS 6.4, Dell Unity)
- [CVE-2020-26181](https://cve.now/CVE-2020-26181.md): Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a S (CVSS 7.0, Dell PowerScale OneFS)
- [CVE-2020-36051](https://cve.now/CVE-2020-36051.md): Directory traversal vulnerability in page\_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter. (no CVSS)
- [CVE-2020-36052](https://cve.now/CVE-2020-36052.md): Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the s (no CVSS)
- [CVE-2019-20484](https://cve.now/CVE-2019-20484.md): An issue was discovered in Viki Vera 4.9.1.26180. (no CVSS)
- [CVE-2019-20483](https://cve.now/CVE-2019-20483.md): An issue was discovered in Viki Vera 4.9.1.26180. (no CVSS)
- [CVE-2020-36066](https://cve.now/CVE-2020-36066.md): GJSON \<1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON. (CVSS 7.5, github.com/tidwall/gjson)
- [CVE-2020-36067](https://cve.now/CVE-2020-36067.md): GJSON \<=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call. (CVSS 7.5, github.com/tidwall/gjson)
- [CVE-2020-29437](https://cve.now/CVE-2020-29437.md): SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the or (no CVSS)
- [CVE-2020-36159](https://cve.now/CVE-2020-36159.md): Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did (CVSS 5.3)
- [CVE-2021-22492](https://cve.now/CVE-2021-22492.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) software. (no CVSS)
- [CVE-2021-22495](https://cve.now/CVE-2021-22495.md): An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. (no CVSS)
- [CVE-2021-22494](https://cve.now/CVE-2021-22494.md): An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. (no CVSS)
- [CVE-2020-27845](https://cve.now/CVE-2020-27845.md): There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. (no CVSS, openjpeg)
- [CVE-2020-27844](https://cve.now/CVE-2020-27844.md): A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. (no CVSS, openjpeg)
- [CVE-2021-3022](https://cve.now/CVE-2021-3022.md): An issue was discovered on LG mobile devices with Android OS 10 software. (no CVSS)
- [CVE-2021-21234](https://cve.now/CVE-2021-21234.md): Directory Traversal (CVSS 7.7, lukashinsch spring-boot-actuator-logview · eu.hinsch:spring…)
- [CVE-2020-29478](https://cve.now/CVE-2020-29478.md): CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker (no CVSS, CA Technologies, A Broadcom Company CA Service Catalog)
- [CVE-2020-27843](https://cve.now/CVE-2020-27843.md): A flaw was found in OpenJPEG in versions prior to 2.4.0. (no CVSS, openjpeg)
- [CVE-2020-27842](https://cve.now/CVE-2020-27842.md): There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. (no CVSS, openjpeg)
- [CVE-2020-27841](https://cve.now/CVE-2020-27841.md): There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. (no CVSS, openjpeg)
- [CVE-2021-3021](https://cve.now/CVE-2021-3021.md): ISPConfig before 3.2.2 allows SQL injection. (no CVSS)
- [CVE-2020-13541](https://cve.now/CVE-2020-13541.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory (CVSS 9.3, Win-911)
- [CVE-2020-13540](https://cve.now/CVE-2020-13540.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install dire (CVSS 9.3, Win-911)
- [CVE-2020-13539](https://cve.now/CVE-2020-13539.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install dire (CVSS 9.3, Win-911)
- [CVE-2020-4899](https://cve.now/CVE-2020-4899.md): IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmi (CVSS 7.4, IBM API Connect)
- [CVE-2020-4762](https://cve.now/CVE-2020-4762.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5\_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated us (CVSS 8.8, IBM Sterling B2B Integrator)
- [CVE-2020-4761](https://cve.now/CVE-2020-4761.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5\_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker t (CVSS 5.3, IBM Sterling B2B Integrator)
- [CVE-2019-4728](https://cve.now/CVE-2019-4728.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5\_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker t (CVSS 8.8, IBM Sterling B2B Integrator)
- [CVE-2020-26046](https://cve.now/CVE-2020-26046.md): FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. (no CVSS)
- [CVE-2020-26045](https://cve.now/CVE-2020-26045.md): FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. (no CVSS)
- [CVE-2020-7202](https://cve.now/CVE-2020-7202.md): A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. (no CVSS, HPE ProLiant Servers, Apollo Products, Converged Systems, a…)
- [CVE-2020-35488](https://cve.now/CVE-2020-35488.md): The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon cra (no CVSS)
- [CVE-2020-17519](https://cve.now/CVE-2020-17519.md): Apache Flink directory traversal attack: reading remote files through the REST API (CVSS 9.1, KEV, Apache Software Foundation Apache Flink · org.apache.fli… +1)
- [CVE-2020-17518](https://cve.now/CVE-2020-17518.md): Apache Flink directory traversal attack: remote file writing through the REST API (no CVSS, Apache Software Foundation Apache Flink · org.apache.flink:…)
- [CVE-2021-3018](https://cve.now/CVE-2021-3018.md): ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the (no CVSS)
- [CVE-2021-3019](https://cve.now/CVE-2021-3019.md): ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet. (no CVSS)
- [CVE-2020-36158](https://cve.now/CVE-2020-36158.md): mwifiex\_cmd\_802\_11\_ad\_hoc\_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attacke (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.