# CVEs published 2021-01-06

59 CVEs were published on January 6, 2021: 10 critical, 8 high. Days are UTC.

- [CVE-2020-26085](https://cve.now/CVE-2020-26085.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2020-36179](https://cve.now/CVE-2020-36179.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36180](https://cve.now/CVE-2020-36180.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.co (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36182](https://cve.now/CVE-2020-36182.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36183](https://cve.now/CVE-2020-36183.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.or (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36184](https://cve.now/CVE-2020-36184.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36185](https://cve.now/CVE-2020-36185.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36186](https://cve.now/CVE-2020-36186.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36187](https://cve.now/CVE-2020-36187.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36188](https://cve.now/CVE-2020-36188.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36189](https://cve.now/CVE-2020-36189.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic. (no CVSS, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-36181](https://cve.now/CVE-2020-36181.md): FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.to (CVSS 8.8, com.fasterxml.jackson.core:jackson-databind)
- [CVE-2020-25498](https://cve.now/CVE-2020-25498.md): Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in UR (no CVSS)
- [CVE-2020-35262](https://cve.now/CVE-2020-35262.md): Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" (no CVSS)
- [CVE-2020-8264](https://cve.now/CVE-2020-8264.md): In actionpack gem \>= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to s (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2020-8265](https://cve.now/CVE-2020-8265.md): Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. (no CVSS, NodeJS Node)
- [CVE-2020-8280](https://cve.now/CVE-2020-8280.md): A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripti (no CVSS, Nextcloud Contacts)
- [CVE-2020-8274](https://cve.now/CVE-2020-8274.md): Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthentic (no CVSS, Citrix Secure Mail for Android)
- [CVE-2020-8275](https://cve.now/CVE-2020-8275.md): Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar (no CVSS, Citrix Secure Mail for Android)
- [CVE-2020-8281](https://cve.now/CVE-2020-8281.md): A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (no CVSS, Nextcloud Contacts)
- [CVE-2020-36178](https://cve.now/CVE-2020-36178.md): oal\_ipt\_addBridgeIsolationRules on TP-Link TL-WR840N 6\_EU\_0.9.1\_4.16 devices allows OS command injection because a raw string entered from t (no CVSS)
- [CVE-2020-29041](https://cve.now/CVE-2020-29041.md): A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitati (no CVSS)
- [CVE-2021-21236](https://cve.now/CVE-2021-21236.md): Regular Expression Denial of Service in CairoSVG (CVSS 5.7, Kozea CairoSVG · cairosvg)
- [CVE-2019-16962](https://cve.now/CVE-2019-16962.md): Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. (no CVSS)
- [CVE-2019-16954](https://cve.now/CVE-2019-16954.md): SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. (no CVSS)
- [CVE-2020-36177](https://cve.now/CVE-2020-36177.md): RsaPad\_PSS in wolfcrypt/src/rsa.c in wolfSSL before 4.6.0 has an out-of-bounds write for certain relationships between key size and digest s (no CVSS)
- [CVE-2020-27283](https://cve.now/CVE-2020-27283.md): An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locati (CVSS 5.3, Crimson)
- [CVE-2020-27279](https://cve.now/CVE-2020-27279.md): A NULL pointer deference vulnerability has been identified in the protocol converter. (CVSS 7.5, Crimson)
- [CVE-2020-27285](https://cve.now/CVE-2020-27285.md): The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without (CVSS 6.5, Crimson)
- [CVE-2020-13545](https://cve.now/CVE-2020-13545.md): An exploitable signed conversion vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker a (CVSS 8.8, Softmaker)
- [CVE-2020-13544](https://cve.now/CVE-2020-13544.md): An exploitable sign extension vulnerability exists in the TextMaker document parsing functionality of SoftMaker Office 2021’s TextMaker appl (CVSS 8.8, Softmaker)
- [CVE-2020-36176](https://cve.now/CVE-2020-36176.md): The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an exis (no CVSS)
- [CVE-2012-10001](https://cve.now/CVE-2012-10001.md): The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote (no CVSS)
- [CVE-2020-36173](https://cve.now/CVE-2020-36173.md): The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. (no CVSS)
- [CVE-2020-36175](https://cve.now/CVE-2020-36175.md): The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. (no CVSS)
- [CVE-2020-36174](https://cve.now/CVE-2020-36174.md): The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. (no CVSS)
- [CVE-2020-36172](https://cve.now/CVE-2020-36172.md): The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading t (no CVSS)
- [CVE-2020-36171](https://cve.now/CVE-2020-36171.md): The Elementor Website Builder plugin before 3.0.14 for WordPress does not properly restrict SVG uploads. (no CVSS)
- [CVE-2020-8160](https://cve.now/CVE-2020-8160.md): MendixSSO \<= 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via (no CVSS, MendixSSO)
- [CVE-2020-36170](https://cve.now/CVE-2020-36170.md): The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. (no CVSS)
- [CVE-2020-8884](https://cve.now/CVE-2020-8884.md): rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated u (no CVSS)
- [CVE-2020-10658](https://cve.now/CVE-2020-10658.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser (no CVSS)
- [CVE-2020-10657](https://cve.now/CVE-2020-10657.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's I (no CVSS)
- [CVE-2020-10656](https://cve.now/CVE-2020-10656.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser (no CVSS)
- [CVE-2020-10655](https://cve.now/CVE-2020-10655.md): The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application ser (no CVSS)
- [CVE-2020-4336](https://cve.now/CVE-2020-4336.md): IBM WebSphere eXtreme Scale 8.6.1 stores sensitive information in URL parameters. (CVSS 3.7, IBM WebSphere eXtreme Scale)
- [CVE-2020-26759](https://cve.now/CVE-2020-26759.md): clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via (no CVSS, clickhouse-driver)
- [CVE-2021-21235](https://cve.now/CVE-2021-21235.md): Infinite loop in parsing PNG files in (CVSS 5.7, kamadak exif-rs · kamadak-exif)
- [CVE-2020-36160](https://cve.now/CVE-2020-36160.md): An issue was discovered in Veritas System Recovery before 21.2. (CVSS 9.3)
- [CVE-2020-36161](https://cve.now/CVE-2020-36161.md): An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3. (no CVSS)
- [CVE-2020-36162](https://cve.now/CVE-2020-36162.md): An issue was discovered in Veritas CloudPoint before 8.3.0.1+hotfix. (CVSS 9.3)
- [CVE-2020-36163](https://cve.now/CVE-2020-36163.md): An issue was discovered in Veritas NetBackup and OpsCenter through 8.3.0.1. (CVSS 9.3)
- [CVE-2020-36164](https://cve.now/CVE-2020-36164.md): An issue was discovered in Veritas Enterprise Vault through 14.0. (CVSS 9.3)
- [CVE-2020-36165](https://cve.now/CVE-2020-36165.md): An issue was discovered in Veritas Desktop and Laptop Option (DLO) before 9.4. (CVSS 9.3)
- [CVE-2020-36166](https://cve.now/CVE-2020-36166.md): An issue was discovered in Veritas InfoScale 7.x through 7.4.2 on Windows, Storage Foundation through 6.1 on Windows, Storage Foundation HA (CVSS 9.3)
- [CVE-2020-36167](https://cve.now/CVE-2020-36167.md): An issue was discovered in the server in Veritas Backup Exec through 16.2, 20.6 before hotfix 298543, and 21.1 before hotfix 657517. (CVSS 9.3)
- [CVE-2020-36168](https://cve.now/CVE-2020-36168.md): An issue was discovered in Veritas Resiliency Platform 3.4 and 3.5. (CVSS 9.3)
- [CVE-2020-36169](https://cve.now/CVE-2020-36169.md): An issue was discovered in Veritas NetBackup through 8.3.0.1 and OpsCenter through 8.3.0.1. (CVSS 9.3)
- [CVE-2020-8287](https://cve.now/CVE-2020-8287.md): Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-E (no CVSS, NodeJS Node)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.