CVEs published January 6, 2021
59 CVEs were published on January 6, 2021: 10 critical, 8 high.
- Published
- 59
- Critical
- 10
- High
- 8
- Medium
- 4
- Low
- 1
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- com.fasterxml.jackson.core:jackson-databind
- 11
- Crimson
- 3
- Citrix Secure Mail for Android
- 2
- Nextcloud Contacts
- 2
- NodeJS Node
- 2
- Softmaker
- 2
- Cisco Jabber
- 1
- clickhouse-driver
- 1
- https://github.com/rails/rails · actionpack
- 1
- IBM WebSphere eXtreme Scale
- 1
Critical 10
- CVE-2020-26085Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco Jabber
- CVE-2020-36160An issue was discovered in Veritas System Recovery before 21.2.
- CVE-2020-36162An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix.
- CVE-2020-36163An issue was discovered in Veritas NetBackup and OpsCenter through 8.3.0.1.
- CVE-2020-36164An issue was discovered in Veritas Enterprise Vault through 14.0.
- CVE-2020-36165An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4.
- CVE-2020-36166An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA
- CVE-2020-36167An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517.
- CVE-2020-36168An issue was discovered in Veritas Resiliency Platform 3.4 and 3.5.
- CVE-2020-36169An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1.
High 8
- CVE-2020-36179FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apaccom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36180FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.cocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36182FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36184FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36181FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-27279A NULL pointer deference vulnerability has been identified in the protocol converter.Crimson
- CVE-2020-13545An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker aSoftmaker
- CVE-2020-13544An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker applSoftmaker
Medium, low and unrated 41
- CVE-2020-36183FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.orcom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36185FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36186FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36187FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tocom.fasterxml.jackson.core:jackson-databind
- CVE-2020-36188FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.com.fasterxml.jackson.core:jackson-databind
- CVE-2020-36189FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.com.fasterxml.jackson.core:jackson-databind
- CVE-2020-25498Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in UR
- CVE-2020-35262Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword"
- CVE-2020-8264In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to shttps://github.com/rails/rails · actionpack
- CVE-2020-8265Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation.NodeJS Node
- CVE-2020-8280A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scriptiNextcloud Contacts
- CVE-2020-8274Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticCitrix Secure Mail for Android
- CVE-2020-8275Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar Citrix Secure Mail for Android
- CVE-2020-8281A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting Nextcloud Contacts
- CVE-2020-36178oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from t
- CVE-2020-29041A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitati
- CVE-2021-21236Regular Expression Denial of Service in CairoSVGKozea CairoSVG · cairosvg
- CVE-2019-16962Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report.
- CVE-2019-16954SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.
- CVE-2020-36177RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest s
- CVE-2020-27283An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locatiCrimson
- CVE-2020-27285The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database withoutCrimson
- CVE-2020-36176The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis
- CVE-2012-10001The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote
- CVE-2020-36173The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
- CVE-2020-36175The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- CVE-2020-36174The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
- CVE-2020-36172The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t
- CVE-2020-36171The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads.
- CVE-2020-8160MendixSSO <= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via MendixSSO
- CVE-2020-36170The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms.
- CVE-2020-8884rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated u
- CVE-2020-10658The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser
- CVE-2020-10657The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's I
- CVE-2020-10656The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser
- CVE-2020-10655The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser
- CVE-2020-4336IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters.IBM WebSphere eXtreme Scale
- CVE-2020-26759clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via clickhouse-driver
- CVE-2021-21235Infinite loop in parsing PNG files inkamadak exif-rs · kamadak-exif
- CVE-2020-36161An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3.
- CVE-2020-8287Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-ENodeJS Node