CVEs published January 11, 2021
84 CVEs were published on January 11, 2021: 0 critical, 3 high.
- Published
- 84
- Critical
- 0
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 78
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Android
- 22
- Delta Electronics
- 6
- Apache Traffic Server
- 2
- 360F5
- 1
- Apache NetBeans HTML/Java API · org.netbeans.html:pom
- 1
- Apache Software Foundation Apache DolphinScheduler · apa… +1
- 1
- Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- 1
- Delta Electronics CNCSoft ScreenEditor
- 1
- Flask-Middleware flask-security-too · flask-security-too
- 1
- forkcms/forkcms
- 1
High 3
- CVE-2021-21241CSRF can expose users authentication token in Flask-Security-TooFlask-Middleware flask-security-too · flask-security-too
- CVE-2020-26118In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deseriali
- CVE-2020-2508Command Injection Vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
Medium, low and unrated 81
- CVE-2021-0301In ged, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0313In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation.Android
- CVE-2021-0312In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0303In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after Android
- CVE-2021-0311In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0310In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0320In is_device_locked and set_device_locked of keystore_keymaster_enforcement.h, there is a possible bypass of lockscreen requirements for keyAndroid
- CVE-2021-0315In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account duAndroid
- CVE-2020-0471In reassemble_and_dispatch of packet_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to Android
- CVE-2021-0316In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0317In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error.Android
- CVE-2021-0318In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free.Android
- CVE-2021-0319In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address withoAndroid
- CVE-2021-0321In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to sidAndroid
- CVE-2021-0304In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0322In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation.Android
- CVE-2021-0309In onCreate of grantCredentialsPermissionActivity, there is a confused deputy.Android
- CVE-2021-0308In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0307In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused Android
- CVE-2021-0306In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which alAndroid
- CVE-2020-27059In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overAndroid
- CVE-2021-0342In tun_get_user of tun.c, there is possible memory corruption due to a use after free.Android
- CVE-2020-24027In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" comm
- CVE-2020-23631Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) a
- CVE-2020-13559A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028.FreyrSCADA
- CVE-2020-24025Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative dnode-sass
- CVE-2020-4869IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow.IBM MQ Appliance
- CVE-2020-35701An issue was discovered in Cacti 1.2.x through 1.2.16.
- CVE-2020-27281A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially craftDelta Electronics CNCSoft ScreenEditor
- CVE-2020-23960Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauforkcms/forkcms
- CVE-2019-3405In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a s360F5
- CVE-2018-11246K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak.
- CVE-2021-23253Opera Mini for Android below 53.1 displays URL left-aligned in the address field.Opera Mini for Android
- CVE-2018-11010A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2018-11005A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2018-11007A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2018-11009A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2018-11008An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2018-11006An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.
- CVE-2020-25659python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 python-cryptography · cryptography
- CVE-2018-8044K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control.
- CVE-2018-8726K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow.
- CVE-2018-8725K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow.
- CVE-2018-8724K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control.
- CVE-2018-9333K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow.
- CVE-2020-17534There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject Apache NetBeans HTML/Java API · org.netbeans.html:pom
- CVE-2018-9332K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control.
- CVE-2020-27293Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attackeDelta Electronics
- CVE-2020-27289Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow Delta Electronics
- CVE-2020-27291Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files, which may alloDelta Electronics
- CVE-2020-27287Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may allDelta Electronics
- CVE-2020-24003Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's pri
- CVE-2020-27275Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allowDelta Electronics
- CVE-2020-27277Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow anDelta Electronics
- CVE-2020-35483AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, all
- CVE-2020-23630A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection).
- CVE-2020-23849Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.jsoneditor
- CVE-2020-23644XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.
- CVE-2020-23643XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.
- CVE-2020-26800A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a de
- CVE-2020-17508The ATS ESI plugin has a memory disclosure vulnerability.Apache Traffic Server
- CVE-2020-17509ATS negative cache option is vulnerable to a cache poisoning attack.Apache Traffic Server
- CVE-2020-11995Apache Dubbo default deserialization protocol Hessian2 cause CREApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2020-13922Apache DolphinScheduler (incubating) Permission vulnerabilityApache Software Foundation Apache DolphinScheduler · apa… +1
- CVE-2021-3121An issue was discovered in GoGo Protobuf before 1.3.2.github.com/gogo/protobuf
- CVE-2021-3118EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (s
- CVE-2021-3116before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data beproxy-py
- CVE-2020-35727Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35726Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35725Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35724Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35723Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35722CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a special
- CVE-2020-35721Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35720Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, an
- CVE-2020-35719Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35204Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted
- CVE-2020-35205Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal p
- CVE-2020-35206Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the brows
- CVE-2020-35203Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the brows
- CVE-2020-26298Injection in Redcarpetvmg redcarpet · redcarpet