CVEs published January 7, 2021
57 CVEs were published on January 7, 2021: 0 critical, 1 high.
- Published
- 57
- Critical
- 0
- High
- 1
- Medium
- 10
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 7
- Mozilla Firefox
- 6
- Eaton easySoft Software
- 2
- IBM Emptoris Sourcing
- 2
- IBM Emptoris Strategic Supply Management
- 2
- com.liferay.portal:release.portal.bom
- 1
- engine.io
- 1
- formstone
- 1
- IBM Emptoris Contract Management
- 1
- IBM Emptoris Contract Management · IBM Emptoris Spend Analy…
- 1
High 1
Medium, low and unrated 56
- CVE-2020-36048Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transportengine.io
- CVE-2020-36049socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation socket.io-parser
- CVE-2020-13449A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files.
- CVE-2020-13450A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writab
- CVE-2020-13451An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice co
- CVE-2020-13452In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file,
- CVE-2020-17500Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4).
- CVE-2019-18642Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature.
- CVE-2019-18643Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application.
- CVE-2020-35745PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all d
- CVE-2021-23241MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication b
- CVE-2021-23242MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd
- CVE-2018-18689The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat
- CVE-2020-4898IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hIBM Emptoris Strategic Supply Management
- CVE-2020-4897IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitivIBM Emptoris Contract Management · IBM Emptoris Spend Analy…
- CVE-2020-4896IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTPIBM Emptoris Sourcing
- CVE-2020-4895IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting.IBM Emptoris Sourcing
- CVE-2020-4893IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters.IBM Emptoris Strategic Supply Management
- CVE-2020-4892IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting.IBM Emptoris Contract Management
- CVE-2018-18688The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat
- CVE-2020-25680A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknowJBCS httpd
- CVE-2020-27835A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open dkernel
- CVE-2020-6656File parsing Type Confusion Remote code execution vulerabilityEaton easySoft Software
- CVE-2020-6655File parsing Out-Of-Bounds read remote code executionEaton easySoft Software
- CVE-2018-20316Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu
- CVE-2018-20315Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow
- CVE-2018-20314Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-base
- CVE-2018-20313Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-bas
- CVE-2018-20312Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu
- CVE-2018-20311Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based
- CVE-2018-20310Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu
- CVE-2018-20309Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-bas
- CVE-2018-19418Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control.
- CVE-2020-25476Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Cacom.liferay.portal:release.portal.bom
- CVE-2021-3011An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication micro
- CVE-2020-28672MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution.
- CVE-2020-26773Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker t
- CVE-2021-3029EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipula
- CVE-2020-26971Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-26972The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting tMozilla Firefox
- CVE-2020-26973Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-26974When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-26975When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been spMozilla Firefox
- CVE-2020-26976When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have inteMozilla Firefox
- CVE-2020-26977By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar dispMozilla Firefox
- CVE-2020-26978Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as sMozilla Firefox · Mozilla Thunderbird
- CVE-2020-26979When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event andMozilla Firefox
- CVE-2020-35111When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-sourceMozilla Firefox · Mozilla Thunderbird
- CVE-2020-35112If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable fileMozilla Firefox · Mozilla Thunderbird
- CVE-2020-35113Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5.Mozilla Firefox · Mozilla Thunderbird
- CVE-2020-35114Mozilla developers reported memory safety bugs present in Firefox 83.Mozilla Firefox
- CVE-2020-24903Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input.
- CVE-2020-24902Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input.
- CVE-2020-24901The default installation of Krpano Panorama Viewer version <=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file vi
- CVE-2020-24900The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpan
- CVE-2020-26768Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied inpuformstone