# CVEs published 2021-01-08

95 CVEs were published on January 8, 2021: 3 critical, 3 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-4733](https://cve.now/CVE-2020-4733.md): IBM Jazz Foundation products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM En… +8)
- [CVE-2020-4697](https://cve.now/CVE-2020-4697.md): IBM Jazz Foundation products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Rational Rhapsody Design… +8)
- [CVE-2020-4691](https://cve.now/CVE-2020-4691.md): IBM Jazz Foundation Products are vulnerable to cross-site scripting. (CVSS 4.6, IBM Rational Rhapsody Design Manager · IBM Rational Rhap… +8)
- [CVE-2020-4544](https://cve.now/CVE-2020-4544.md): IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is return (CVSS 4.3, IBM Engineering Workflow Management · IBM Rational Colla… +8)
- [CVE-2020-4487](https://cve.now/CVE-2020-4487.md): IBM Jazz Foundation Products could allow a remote attacker to obtain sensitive information when a detailed technical error message is return (CVSS 4.3, IBM Engineering Lifecycle Optimization · IBM Rational DO… +8)
- [CVE-2020-5022](https://cve.now/CVE-2020-5022.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow unauthenticated and unauthorized access to VDAP proxy which can result in an attac (CVSS 5.3, IBM Spectrum Protect Plus)
- [CVE-2020-5021](https://cve.now/CVE-2020-5021.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 does not invalidate session after a password reset which could allow a local user to imperso (CVSS 4.0, IBM Spectrum Protect Plus)
- [CVE-2020-5020](https://cve.now/CVE-2020-5020.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 could allow a remote attacker to hijack the clicking action of the victim. (CVSS 6.1, IBM Spectrum Protect Plus)
- [CVE-2020-5019](https://cve.now/CVE-2020-5019.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST h (CVSS 6.5, IBM Spectrum Protect Plus)
- [CVE-2020-5018](https://cve.now/CVE-2020-5018.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may include sensitive information in its URLs increasing the risk of such information being (CVSS 3.7, IBM Spectrum Protect Plus)
- [CVE-2020-5017](https://cve.now/CVE-2020-5017.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.6 may allow a local user to obtain access to information beyond their intended role and permis (CVSS 2.9, IBM Spectrum Protect Plus)
- [CVE-2020-26186](https://cve.now/CVE-2020-26186.md): Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2020-25678](https://cve.now/CVE-2020-25678.md): A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. (no CVSS, ceph)
- [CVE-2021-21116](https://cve.now/CVE-2021-21116.md): Heap buffer overflow in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-21115](https://cve.now/CVE-2021-21115.md): User after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2021-21107](https://cve.now/CVE-2021-21107.md): Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer (no CVSS, Google Chrome)
- [CVE-2021-21108](https://cve.now/CVE-2021-21108.md): Use after free in media in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to potent (no CVSS, Google Chrome)
- [CVE-2021-21109](https://cve.now/CVE-2021-21109.md): Use after free in payments in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2021-21110](https://cve.now/CVE-2021-21110.md): Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape vi (no CVSS, Google Chrome)
- [CVE-2021-21111](https://cve.now/CVE-2021-21111.md): Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malic (no CVSS, Google Chrome)
- [CVE-2021-21112](https://cve.now/CVE-2021-21112.md): Use after free in Blink in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-21113](https://cve.now/CVE-2021-21113.md): Heap buffer overflow in Skia in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-21114](https://cve.now/CVE-2021-21114.md): Use after free in audio in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-21106](https://cve.now/CVE-2021-21106.md): Use after free in autofill in Google Chrome prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2020-16043](https://cve.now/CVE-2020-16043.md): Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access (no CVSS, Google Chrome)
- [CVE-2020-16038](https://cve.now/CVE-2020-16038.md): Use after free in media in Google Chrome on OS X prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2020-16039](https://cve.now/CVE-2020-16039.md): Use after free in extensions in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2020-16040](https://cve.now/CVE-2020-16040.md): Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2020-16041](https://cve.now/CVE-2020-16041.md): Out of bounds read in networking in Google Chrome prior to 87.0.4280.88 allowed a remote attacker who had compromised the renderer process t (no CVSS, Google Chrome)
- [CVE-2020-16042](https://cve.now/CVE-2020-16042.md): Uninitialized Use in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to obtain potentially sensitive information from pr (no CVSS, Google Chrome)
- [CVE-2020-16037](https://cve.now/CVE-2020-16037.md): Use after free in clipboard in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-16033](https://cve.now/CVE-2020-16033.md): Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted H (no CVSS, Google Chrome)
- [CVE-2020-16034](https://cve.now/CVE-2020-16034.md): Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to bypass policy restrictions via a c (no CVSS, Google Chrome)
- [CVE-2020-16035](https://cve.now/CVE-2020-16035.md): Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised (no CVSS, Google Chrome)
- [CVE-2020-16036](https://cve.now/CVE-2020-16036.md): Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass cookie restrictions via a (no CVSS, Google Chrome)
- [CVE-2020-16030](https://cve.now/CVE-2020-16030.md): Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML ( (no CVSS, Google Chrome)
- [CVE-2020-16031](https://cve.now/CVE-2020-16031.md): Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (UR (no CVSS, Google Chrome)
- [CVE-2020-16032](https://cve.now/CVE-2020-16032.md): Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibo (no CVSS, Google Chrome)
- [CVE-2020-16026](https://cve.now/CVE-2020-16026.md): Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2020-16027](https://cve.now/CVE-2020-16027.md): Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2020-16028](https://cve.now/CVE-2020-16028.md): Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2020-16029](https://cve.now/CVE-2020-16029.md): Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions vi (no CVSS, Google Chrome)
- [CVE-2020-16024](https://cve.now/CVE-2020-16024.md): Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2020-16025](https://cve.now/CVE-2020-16025.md): Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2020-16023](https://cve.now/CVE-2020-16023.md): Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2020-16022](https://cve.now/CVE-2020-16022.md): Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewal (no CVSS, Google Chrome)
- [CVE-2020-16021](https://cve.now/CVE-2020-16021.md): Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised the browser process to (no CVSS, Google Chrome)
- [CVE-2020-16020](https://cve.now/CVE-2020-16020.md): Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised (no CVSS, Google Chrome)
- [CVE-2020-16019](https://cve.now/CVE-2020-16019.md): Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had compromised (no CVSS, Google Chrome)
- [CVE-2020-16018](https://cve.now/CVE-2020-16018.md): Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2020-16017](https://cve.now/CVE-2020-16017.md): Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process (CVSS 9.6, KEV, Google Chrome · CefSharp.Common +3)
- [CVE-2020-16016](https://cve.now/CVE-2020-16016.md): Inappropriate implementation in base in Google Chrome prior to 86.0.4240.193 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2020-16015](https://cve.now/CVE-2020-16015.md): Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-16014](https://cve.now/CVE-2020-16014.md): Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potenti (no CVSS, Google Chrome)
- [CVE-2020-16012](https://cve.now/CVE-2020-16012.md): Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2020-16013](https://cve.now/CVE-2020-16013.md): Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, KEV, Google Chrome · CefSharp.Common +3)
- [CVE-2020-26664](https://cve.now/CVE-2020-26664.md): A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via (no CVSS)
- [CVE-2020-28208](https://cve.now/CVE-2020-28208.md): An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1. (no CVSS)
- [CVE-2020-17504](https://cve.now/CVE-2020-17504.md): The NDN-210 has a web administration panel which is made available over https. (no CVSS)
- [CVE-2020-17503](https://cve.now/CVE-2020-17503.md): The NDN-210 has a web administration panel which is made available over https. (no CVSS)
- [CVE-2020-17502](https://cve.now/CVE-2020-17502.md): Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). (no CVSS)
- [CVE-2020-35131](https://cve.now/CVE-2020-35131.md): Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/M (no CVSS)
- [CVE-2020-8584](https://cve.now/CVE-2020-8584.md): Element OS versions prior to 1.8P1 and 12.2 are susceptible to a vulnerability that could allow an unauthenticated remote attacker to perfor (no CVSS, Element OS)
- [CVE-2020-27260](https://cve.now/CVE-2020-27260.md): Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 HL7 v2.x injection vulnerabilities exist in the affected products that a (no CVSS, BIGCOMPANYSOFT SOFTWARE PRODUCT)
- [CVE-2020-27262](https://cve.now/CVE-2020-27262.md): Innokas Yhtymä Oy Vital Signs Monitor VC150 prior to Version 1.7.15 A stored cross-site scripting (XSS) vulnerability exists in the affected (no CVSS, Innokas Yhtymä Oy Vital Signs Monitor VC150)
- [CVE-2020-5805](https://cve.now/CVE-2020-5805.md): In Marvell QConvergeConsole GUI \<= 5.5.0.74, credentials are stored in cleartext in tomcat-users.xml. (no CVSS, Marvell QConvergeConsole GUI)
- [CVE-2020-5804](https://cve.now/CVE-2020-5804.md): Marvell QConvergeConsole GUI \<= 5.5.0.74 is affected by a path traversal vulnerability. (no CVSS, Marvell QConvergeConsole GUI)
- [CVE-2021-1066](https://cve.now/CVE-2021-1066.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to unexpected consumpt (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1064](https://cve.now/CVE-2021-1064.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which it obtains a value from an untrusted source, converts this value t (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1065](https://cve.now/CVE-2021-1065.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which input data is not validated, which may lead to tampering of data o (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1063](https://cve.now/CVE-2021-1063.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input offset is not validated, which may lead to a buffer overr (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1061](https://cve.now/CVE-2021-1061.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which a race condition may cause the vGPU plugin to continue using a pre (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1062](https://cve.now/CVE-2021-1062.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input data length is not validated, which may lead to tampering (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1060](https://cve.now/CVE-2021-1060.md): NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input index is not validated, whi (no CVSS, NVIDIA Virtual GPU Software)
- [CVE-2021-1058](https://cve.now/CVE-2021-1058.md): NVIDIA vGPU software contains a vulnerability in the guest kernel mode driver and vGPU plugin, in which an input data size is not validated, (no CVSS, NVIDIA Virtual GPU Software)
- [CVE-2021-1059](https://cve.now/CVE-2021-1059.md): NVIDIA vGPU manager contains a vulnerability in the vGPU plugin, in which an input index is not validated, which may lead to integer overflo (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2021-1057](https://cve.now/CVE-2021-1057.md): NVIDIA Virtual GPU Manager NVIDIA vGPU manager contains a vulnerability in the vGPU plugin in which it allows guests to allocate some resour (no CVSS, NVIDIA Virtual GPU Manager)
- [CVE-2020-4667](https://cve.now/CVE-2020-4667.md): IBM Engineering Requirements Quality Assistant On-Premises could allow an authenticated user to obtain sensitive information due to improper (CVSS 4.3, IBM Engineering Requirements Quality Assistant)
- [CVE-2020-4666](https://cve.now/CVE-2020-4666.md): IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Requirements Quality Assistant)
- [CVE-2020-4664](https://cve.now/CVE-2020-4664.md): IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Requirements Quality Assistant)
- [CVE-2020-4663](https://cve.now/CVE-2020-4663.md): IBM Engineering Requirements Quality Assistant On-Premises is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Requirements Quality Assistant)
- [CVE-2020-4606](https://cve.now/CVE-2020-4606.md): IBM Security Verify Privilege Manager 10.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 5.7, IBM Security Verify Privilege Manager)
- [CVE-2021-3111](https://cve.now/CVE-2021-3111.md): The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express (no CVSS)
- [CVE-2020-7784](https://cve.now/CVE-2020-7784.md): command\_injection (CVSS 9.8, ts-process-promises)
- [CVE-2020-7794](https://cve.now/CVE-2020-7794.md): Command Injection (CVSS 9.8, buns)
- [CVE-2020-28468](https://cve.now/CVE-2020-28468.md): Improper Control of Generation of Code ('Code Injection') (CVSS 8.1, pwntools)
- [CVE-2020-25950](https://cve.now/CVE-2020-25950.md): Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additio (no CVSS)
- [CVE-2020-24577](https://cve.now/CVE-2020-24577.md): An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU\_2.31\_V1.1.47ae55. (no CVSS)
- [CVE-2021-3025](https://cve.now/CVE-2021-3025.md): Invision Community IPS Community Suite before 4.5.4.2 allows SQL Injection via the Downloads REST API (the sortDir parameter in a sortBy=pop (no CVSS)
- [CVE-2021-1055](https://cve.now/CVE-2021-1055.md): NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEsc (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2021-1054](https://cve.now/CVE-2021-1054.md): NVIDIA GPU Display Driver for Windows, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEsc (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2021-1051](https://cve.now/CVE-2021-1051.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape in which a (CVSS 8.4, NVIDIA GPU Display Driver)
- [CVE-2021-1052](https://cve.now/CVE-2021-1052.md): NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2021-1053](https://cve.now/CVE-2021-1053.md): NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for (no CVSS, NVIDIA GPU Display Driver)
- [CVE-2021-1056](https://cve.now/CVE-2021-1056.md): NVIDIA GPU Display Driver for Linux, all versions, contains a vulnerability in the kernel mode layer (nvidia.ko) in which it does not comple (no CVSS, NVIDIA GPU Display Driver)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.