# CVEs published 2021-01-07 57 CVEs were published on January 7, 2021: 0 critical, 1 high. Days are UTC. - [CVE-2020-36048](https://cve.now/CVE-2020-36048.md): Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport (no CVSS, engine.io) - [CVE-2020-36049](https://cve.now/CVE-2020-36049.md): socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation (no CVSS, socket.io-parser) - [CVE-2020-13449](https://cve.now/CVE-2020-13449.md): A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files. (no CVSS) - [CVE-2020-13450](https://cve.now/CVE-2020-13450.md): A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writab (no CVSS) - [CVE-2020-13451](https://cve.now/CVE-2020-13451.md): An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice co (no CVSS) - [CVE-2020-13452](https://cve.now/CVE-2020-13452.md): In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, (no CVSS) - [CVE-2020-17500](https://cve.now/CVE-2020-17500.md): Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). (no CVSS) - [CVE-2019-18642](https://cve.now/CVE-2019-18642.md): Rock RMS version before 8.6 is vulnerable to account takeover by tampering with the user ID parameter in the profile update feature. (no CVSS) - [CVE-2019-18643](https://cve.now/CVE-2019-18643.md): Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. (no CVSS) - [CVE-2020-35745](https://cve.now/CVE-2020-35745.md): PHPGURUKUL Hospital Management System V 4.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all d (no CVSS) - [CVE-2021-23241](https://cve.now/CVE-2021-23241.md): MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication b (no CVSS) - [CVE-2021-23242](https://cve.now/CVE-2021-23242.md): MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ to the UPnP server, as demonstrated by the /../../conf/template/uhttpd (no CVSS) - [CVE-2018-18689](https://cve.now/CVE-2018-18689.md): The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat (no CVSS) - [CVE-2020-4898](https://cve.now/CVE-2020-4898.md): IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h (CVSS 5.9, IBM Emptoris Strategic Supply Management) - [CVE-2020-4897](https://cve.now/CVE-2020-4897.md): IBM Emptoris Contract Management and IBM Emptoris Spend Analysis 10.1.0, 10.1.1, and 10.1.3 could allow a remote attacker to obtain sensitiv (CVSS 5.3, IBM Emptoris Contract Management · IBM Emptoris Spend Analy…) - [CVE-2020-4896](https://cve.now/CVE-2020-4896.md): IBM Emptoris Sourcing 10.1.0, 10.1.1, and 10.1.3 is vulnerable to web cache poisoning, caused by improper input validation by modifying HTTP (CVSS 6.5, IBM Emptoris Sourcing) - [CVE-2020-4895](https://cve.now/CVE-2020-4895.md): IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Emptoris Sourcing) - [CVE-2020-4893](https://cve.now/CVE-2020-4893.md): IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. (CVSS 5.9, IBM Emptoris Strategic Supply Management) - [CVE-2020-4892](https://cve.now/CVE-2020-4892.md): IBM Emptoris Contract Management 10.1.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Emptoris Contract Management) - [CVE-2018-18688](https://cve.now/CVE-2018-18688.md): The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signat (no CVSS) - [CVE-2020-25680](https://cve.now/CVE-2020-25680.md): A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknow (no CVSS, JBCS httpd) - [CVE-2020-13573](https://cve.now/CVE-2020-13573.md): A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3 (CVSS 7.5, Rockwell Automation) - [CVE-2020-27835](https://cve.now/CVE-2020-27835.md): A use after free in the Linux kernel infiniband hfi1 driver in versions prior to 5.10-rc6 was found in the way user calls Ioctl after open d (no CVSS, kernel) - [CVE-2020-6656](https://cve.now/CVE-2020-6656.md): File parsing Type Confusion Remote code execution vulerability (CVSS 5.8, Eaton easySoft Software) - [CVE-2020-6655](https://cve.now/CVE-2020-6655.md): File parsing Out-Of-Bounds read remote code execution (CVSS 5.8, Eaton easySoft Software) - [CVE-2018-20316](https://cve.now/CVE-2018-20316.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu (no CVSS) - [CVE-2018-20315](https://cve.now/CVE-2018-20315.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow (no CVSS) - [CVE-2018-20314](https://cve.now/CVE-2018-20314.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-base (no CVSS) - [CVE-2018-20313](https://cve.now/CVE-2018-20313.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-bas (no CVSS) - [CVE-2018-20312](https://cve.now/CVE-2018-20312.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu (no CVSS) - [CVE-2018-20311](https://cve.now/CVE-2018-20311.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based (no CVSS) - [CVE-2018-20310](https://cve.now/CVE-2018-20310.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based bu (no CVSS) - [CVE-2018-20309](https://cve.now/CVE-2018-20309.md): Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-bas (no CVSS) - [CVE-2018-19418](https://cve.now/CVE-2018-19418.md): Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control. (no CVSS) - [CVE-2020-25476](https://cve.now/CVE-2020-25476.md): Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Ca (no CVSS, com.liferay.portal:release.portal.bom) - [CVE-2021-3011](https://cve.now/CVE-2021-3011.md): An electromagnetic-wave side-channel issue was discovered on NXP SmartMX / P5x security microcontrollers and A7x secure authentication micro (no CVSS) - [CVE-2020-28672](https://cve.now/CVE-2020-28672.md): MonoCMS Blog 1.0 is affected by incorrect access control that can lead to remote arbitrary code execution. (no CVSS) - [CVE-2020-26773](https://cve.now/CVE-2020-26773.md): Restaurant Reservation System 1.0 suffers from an authenticated SQL injection vulnerability, which allows a remote, authenticated attacker t (no CVSS) - [CVE-2021-3029](https://cve.now/CVE-2021-3029.md): EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipula (no CVSS) - [CVE-2020-26971](https://cve.now/CVE-2020-26971.md): Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers. (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-26972](https://cve.now/CVE-2020-26972.md): The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting t (no CVSS, Mozilla Firefox) - [CVE-2020-26973](https://cve.now/CVE-2020-26973.md): Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-26974](https://cve.now/CVE-2020-26974.md): When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-26975](https://cve.now/CVE-2020-26975.md): When a malicious application installed on the user's device broadcast an Intent to Firefox for Android, arbitrary headers could have been sp (no CVSS, Mozilla Firefox) - [CVE-2020-26976](https://cve.now/CVE-2020-26976.md): When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have inte (no CVSS, Mozilla Firefox) - [CVE-2020-26977](https://cve.now/CVE-2020-26977.md): By attempting to connect a website using an unresponsive port, an attacker could have controlled the content of a tab while the URL bar disp (no CVSS, Mozilla Firefox) - [CVE-2020-26978](https://cve.now/CVE-2020-26978.md): Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as s (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-26979](https://cve.now/CVE-2020-26979.md): When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and (no CVSS, Mozilla Firefox) - [CVE-2020-35111](https://cve.now/CVE-2020-35111.md): When an extension with the proxy permission registered to receive \, the proxy.onRequest callback was not triggered for view-source (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-35112](https://cve.now/CVE-2020-35112.md): If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-35113](https://cve.now/CVE-2020-35113.md): Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. (no CVSS, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2020-35114](https://cve.now/CVE-2020-35114.md): Mozilla developers reported memory safety bugs present in Firefox 83. (no CVSS, Mozilla Firefox) - [CVE-2020-24903](https://cve.now/CVE-2020-24903.md): Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. (no CVSS) - [CVE-2020-24902](https://cve.now/CVE-2020-24902.md): Quixplorer \<=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. (CVSS 4.7) - [CVE-2020-24901](https://cve.now/CVE-2020-24901.md): The default installation of Krpano Panorama Viewer version \<=1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file vi (CVSS 6.1) - [CVE-2020-24900](https://cve.now/CVE-2020-24900.md): The default installation of Krpano Panorama Viewer version \<=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpan (no CVSS) - [CVE-2020-26768](https://cve.now/CVE-2020-26768.md): Formstone \<=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied inpu (no CVSS, formstone) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-01-07 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.