CVEs published January 8, 2021
95 CVEs were published on January 8, 2021: 3 critical, 3 high. 2 are now in CISA KEV.
- Published
- 95
- Critical
- 3
- High
- 3
- Medium
- 15
- Low
- 2
- Unrated
- 72
- Now in CISA KEV
- 2
- Fix available
- 45
Most affected products
- Google Chrome
- 41
- NVIDIA Virtual GPU Manager
- 8
- IBM Spectrum Protect Plus
- 6
- NVIDIA GPU Display Driver
- 6
- IBM Engineering Requirements Quality Assistant
- 4
- Google Chrome · CefSharp.Common +3
- 2
- Marvell QConvergeConsole GUI
- 2
- NVIDIA Virtual GPU Software
- 2
- BIGCOMPANYSOFT SOFTWARE PRODUCT
- 1
- buns
- 1
Critical 3
High 3
- CVE-2020-16013Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption Google Chrome · CefSharp.Common +3
- CVE-2020-28468Improper Control of Generation of Code ('Code Injection')pwntools
- CVE-2021-1051NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a NVIDIA GPU Display Driver
Medium, low and unrated 89
- CVE-2020-4733IBM Jazz Foundation products are vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management · IBM En… +8
- CVE-2020-4697IBM Jazz Foundation products are vulnerable to cross-site scripting.IBM Rational Team Concert · IBM Rational Rhapsody Design… +8
- CVE-2020-4691IBM Jazz Foundation Products are vulnerable to cross-site scripting.IBM Rational Rhapsody Design Manager · IBM Rational Rhap… +8
- CVE-2020-4544IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnIBM Engineering Workflow Management · IBM Rational Colla… +8
- CVE-2020-4487IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnIBM Engineering Lifecycle Optimization · IBM Rational DO… +8
- CVE-2020-5022IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attacIBM Spectrum Protect Plus
- CVE-2020-5021IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to impersoIBM Spectrum Protect Plus
- CVE-2020-5020IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim.IBM Spectrum Protect Plus
- CVE-2020-5019IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST hIBM Spectrum Protect Plus
- CVE-2020-5018IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being IBM Spectrum Protect Plus
- CVE-2020-5017IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permisIBM Spectrum Protect Plus
- CVE-2020-26186Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability.Dell CPG BIOS
- CVE-2020-25678A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text.ceph
- CVE-2021-21116Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-21115User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2021-21107Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2021-21108Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2021-21109Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2021-21110Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape viGoogle Chrome
- CVE-2021-21111Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2021-21112Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21113Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-21114Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-21106Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2020-16043Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access Google Chrome
- CVE-2020-16038Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2020-16039Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2020-16040Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2020-16041Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2020-16042Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from prGoogle Chrome
- CVE-2020-16037Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-16033Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HGoogle Chrome
- CVE-2020-16034Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a cGoogle Chrome
- CVE-2020-16035Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised Google Chrome
- CVE-2020-16036Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via aGoogle Chrome
- CVE-2020-16030Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML (Google Chrome
- CVE-2020-16031Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URGoogle Chrome
- CVE-2020-16032Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the OmniboGoogle Chrome
- CVE-2020-16026Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2020-16027Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2020-16028Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2020-16029Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions viGoogle Chrome
- CVE-2020-16024Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2020-16025Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2020-16023Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2020-16022Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewalGoogle Chrome
- CVE-2020-16021Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process toGoogle Chrome
- CVE-2020-16020Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised Google Chrome
- CVE-2020-16019Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised Google Chrome
- CVE-2020-16018Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2020-16016Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2020-16015Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2020-16014Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2020-16012Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2020-26664A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via
- CVE-2020-28208An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
- CVE-2020-17504The NDN-210 has a web administration panel which is made available over https.
- CVE-2020-17503The NDN-210 has a web administration panel which is made available over https.
- CVE-2020-17502Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4).
- CVE-2020-35131Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/M
- CVE-2020-8584Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perforElement OS
- CVE-2020-27260Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that aBIGCOMPANYSOFT SOFTWARE PRODUCT
- CVE-2020-27262Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affectedInnokas Yhtymä Oy Vital Signs Monitor VC150
- CVE-2020-5805In Marvell QConvergeConsole GUI <= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml.Marvell QConvergeConsole GUI
- CVE-2020-5804Marvell QConvergeConsole GUI <= 5.5.0.74 is affected by a path traversal vulnerability.Marvell QConvergeConsole GUI
- CVE-2021-1066NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumptNVIDIA Virtual GPU Manager
- CVE-2021-1064NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value tNVIDIA Virtual GPU Manager
- CVE-2021-1065NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data oNVIDIA Virtual GPU Manager
- CVE-2021-1063NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overrNVIDIA Virtual GPU Manager
- CVE-2021-1061NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a preNVIDIA Virtual GPU Manager
- CVE-2021-1062NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tamperingNVIDIA Virtual GPU Manager
- CVE-2021-1060NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, whiNVIDIA Virtual GPU Software
- CVE-2021-1058NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated,NVIDIA Virtual GPU Software
- CVE-2021-1059NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overfloNVIDIA Virtual GPU Manager
- CVE-2021-1057NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resourNVIDIA Virtual GPU Manager
- CVE-2020-4667IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improperIBM Engineering Requirements Quality Assistant
- CVE-2020-4666IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.IBM Engineering Requirements Quality Assistant
- CVE-2020-4664IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.IBM Engineering Requirements Quality Assistant
- CVE-2020-4663IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting.IBM Engineering Requirements Quality Assistant
- CVE-2020-4606IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Security Verify Privilege Manager
- CVE-2021-3111The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express
- CVE-2020-25950Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additio
- CVE-2020-24577An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55.
- CVE-2021-3025Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=pop
- CVE-2021-1055NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscNVIDIA GPU Display Driver
- CVE-2021-1054NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscNVIDIA GPU Display Driver
- CVE-2021-1052NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for NVIDIA GPU Display Driver
- CVE-2021-1053NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for NVIDIA GPU Display Driver
- CVE-2021-1056NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not compleNVIDIA GPU Display Driver