# CVEs published 2021-01-11

84 CVEs were published on January 11, 2021: 0 critical, 3 high. Days are UTC.

- [CVE-2021-0301](https://cve.now/CVE-2021-0301.md): In ged, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0313](https://cve.now/CVE-2021-0313.md): In isWordBreakAfter of LayoutUtils.cpp, there is a possible way to slow or crash a TextView due to improper input validation. (no CVSS, Android)
- [CVE-2021-0312](https://cve.now/CVE-2021-0312.md): In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0303](https://cve.now/CVE-2021-0303.md): In dispatchGraphTerminationMessage() of packages/services/Car/computepipe/runner/graph/StreamSetObserver.cpp, there is a possible use after (no CVSS, Android)
- [CVE-2021-0311](https://cve.now/CVE-2021-0311.md): In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0310](https://cve.now/CVE-2021-0310.md): In LazyServiceRegistrar of LazyServiceRegistrar.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0320](https://cve.now/CVE-2021-0320.md): In is\_device\_locked and set\_device\_locked of keystore\_keymaster\_enforcement.h, there is a possible bypass of lockscreen requirements for key (no CVSS, Android)
- [CVE-2021-0315](https://cve.now/CVE-2021-0315.md): In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to convince the user to grant an app access to an account du (no CVSS, Android)
- [CVE-2020-0471](https://cve.now/CVE-2020-0471.md): In reassemble\_and\_dispatch of packet\_fragmenter.cc, there is a possible way to inject packets into an encrypted Bluetooth connection due to (no CVSS, Android)
- [CVE-2021-0316](https://cve.now/CVE-2021-0316.md): In avrc\_pars\_vendor\_cmd of avrc\_pars\_tg.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0317](https://cve.now/CVE-2021-0317.md): In createOrUpdate of Permission.java and related code, there is possible permission escalation due to a logic error. (no CVSS, Android)
- [CVE-2021-0318](https://cve.now/CVE-2021-0318.md): In appendEventsToCacheLocked of SensorEventConnection.cpp, there is a possible out of bounds write due to a use-after-free. (no CVSS, Android)
- [CVE-2021-0319](https://cve.now/CVE-2021-0319.md): In checkCallerIsSystemOr of CompanionDeviceManagerService.java, there is a possible way to get a nearby Bluetooth device's MAC address witho (no CVSS, Android)
- [CVE-2021-0321](https://cve.now/CVE-2021-0321.md): In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is installed due to sid (no CVSS, Android)
- [CVE-2021-0304](https://cve.now/CVE-2021-0304.md): In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-0322](https://cve.now/CVE-2021-0322.md): In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input validation. (no CVSS, Android)
- [CVE-2021-0309](https://cve.now/CVE-2021-0309.md): In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. (no CVSS, Android)
- [CVE-2021-0308](https://cve.now/CVE-2021-0308.md): In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0307](https://cve.now/CVE-2021-0307.md): In updatePermissionSourcePackage of PermissionManagerService.java, there is a possible automatic runtime permission grant due to a confused (no CVSS, Android)
- [CVE-2021-0306](https://cve.now/CVE-2021-0306.md): In addAllPermissions of PermissionManagerService.java, there is a possible permissions bypass when upgrading major Android versions which al (no CVSS, Android)
- [CVE-2021-21241](https://cve.now/CVE-2021-21241.md): CSRF can expose users authentication token in Flask-Security-Too (CVSS 7.4, Flask-Middleware flask-security-too · flask-security-too)
- [CVE-2020-27059](https://cve.now/CVE-2020-27059.md): In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an over (no CVSS, Android)
- [CVE-2021-0342](https://cve.now/CVE-2021-0342.md): In tun\_get\_user of tun.c, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2020-24027](https://cve.now/CVE-2020-24027.md): In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" comm (no CVSS)
- [CVE-2020-23631](https://cve.now/CVE-2020-23631.md): Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting (XSS) a (no CVSS)
- [CVE-2020-13559](https://cve.now/CVE-2020-13559.md): A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. (CVSS 5.9, FreyrSCADA)
- [CVE-2020-24025](https://cve.now/CVE-2020-24025.md): Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative d (no CVSS, node-sass)
- [CVE-2020-4869](https://cve.now/CVE-2020-4869.md): IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. (CVSS 5.3, IBM MQ Appliance)
- [CVE-2020-35701](https://cve.now/CVE-2020-35701.md): An issue was discovered in Cacti 1.2.x through 1.2.16. (no CVSS)
- [CVE-2020-27281](https://cve.now/CVE-2020-27281.md): A stack-based buffer overflow may exist in Delta Electronics CNCSoft ScreenEditor versions 1.01.26 and prior when processing specially craft (no CVSS, Delta Electronics CNCSoft ScreenEditor)
- [CVE-2020-23960](https://cve.now/CVE-2020-23960.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unau (no CVSS, forkcms/forkcms)
- [CVE-2019-3405](https://cve.now/CVE-2019-3405.md): In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by constructing and sending a s (no CVSS, 360F5)
- [CVE-2018-11246](https://cve.now/CVE-2018-11246.md): K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak. (no CVSS)
- [CVE-2021-23253](https://cve.now/CVE-2021-23253.md): Opera Mini for Android below 53.1 displays URL left-aligned in the address field. (no CVSS, Opera Mini for Android)
- [CVE-2018-11010](https://cve.now/CVE-2018-11010.md): A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2018-11005](https://cve.now/CVE-2018-11005.md): A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2018-11007](https://cve.now/CVE-2018-11007.md): A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2018-11009](https://cve.now/CVE-2018-11009.md): A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2018-11008](https://cve.now/CVE-2018-11008.md): An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2018-11006](https://cve.now/CVE-2018-11006.md): An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. (no CVSS)
- [CVE-2020-25659](https://cve.now/CVE-2020-25659.md): python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 (no CVSS, python-cryptography · cryptography)
- [CVE-2018-8044](https://cve.now/CVE-2018-8044.md): K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. (no CVSS)
- [CVE-2018-8726](https://cve.now/CVE-2018-8726.md): K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. (no CVSS)
- [CVE-2018-8725](https://cve.now/CVE-2018-8725.md): K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow. (no CVSS)
- [CVE-2018-8724](https://cve.now/CVE-2018-8724.md): K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. (no CVSS)
- [CVE-2018-9333](https://cve.now/CVE-2018-9333.md): K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. (no CVSS)
- [CVE-2020-17534](https://cve.now/CVE-2020-17534.md): There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in \`webkit\` subproject (no CVSS, Apache NetBeans HTML/Java API · org.netbeans.html:pom)
- [CVE-2018-9332](https://cve.now/CVE-2018-9332.md): K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. (no CVSS)
- [CVE-2020-27293](https://cve.now/CVE-2020-27293.md): Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a type confusion issue while processing project files, which may allow an attacke (no CVSS, Delta Electronics)
- [CVE-2020-27289](https://cve.now/CVE-2020-27289.md): Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior has a null pointer dereference issue while processing project files, which may allow (no CVSS, Delta Electronics)
- [CVE-2020-27291](https://cve.now/CVE-2020-27291.md): Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds read while processing project files, which may allo (no CVSS, Delta Electronics)
- [CVE-2020-27287](https://cve.now/CVE-2020-27287.md): Delta Electronics CNCSoft-B Versions 1.0.0.2 and prior is vulnerable to an out-of-bounds write while processing project files, which may all (no CVSS, Delta Electronics)
- [CVE-2020-24003](https://cve.now/CVE-2020-24003.md): Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's pri (no CVSS)
- [CVE-2020-27275](https://cve.now/CVE-2020-27275.md): Delta Electronics DOPSoft Version 4.0.8.21 and prior is vulnerable to an out-of-bounds write while processing project files, which may allow (no CVSS, Delta Electronics)
- [CVE-2020-27277](https://cve.now/CVE-2020-27277.md): Delta Electronics DOPSoft Version 4.0.8.21 and prior has a null pointer dereference issue while processing project files, which may allow an (no CVSS, Delta Electronics)
- [CVE-2020-26118](https://cve.now/CVE-2020-26118.md): In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deseriali (CVSS 8.8)
- [CVE-2020-35483](https://cve.now/CVE-2020-35483.md): AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, all (no CVSS)
- [CVE-2020-2508](https://cve.now/CVE-2020-2508.md): Command Injection Vulnerability in QTS and QuTS hero (CVSS 7.2, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2020-23630](https://cve.now/CVE-2020-23630.md): A blind SQL injection vulnerability exists in zzcms ver201910 based on time (cookie injection). (no CVSS)
- [CVE-2020-23849](https://cve.now/CVE-2020-23849.md): Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. (no CVSS, jsoneditor)
- [CVE-2020-23644](https://cve.now/CVE-2020-23644.md): XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS\] to Home/c/ErrorController.php. (no CVSS)
- [CVE-2020-23643](https://cve.now/CVE-2020-23643.md): XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS\] to Home/c/WechatController.php. (no CVSS)
- [CVE-2020-26800](https://cve.now/CVE-2020-26800.md): A stack overflow vulnerability in Aleth Ethereum C++ client version \<= 1.8.0 using a specially crafted a config.json file may result in a de (no CVSS)
- [CVE-2020-17508](https://cve.now/CVE-2020-17508.md): The ATS ESI plugin has a memory disclosure vulnerability. (no CVSS, Apache Traffic Server)
- [CVE-2020-17509](https://cve.now/CVE-2020-17509.md): ATS negative cache option is vulnerable to a cache poisoning attack. (no CVSS, Apache Traffic Server)
- [CVE-2020-11995](https://cve.now/CVE-2020-11995.md): Apache Dubbo default deserialization protocol Hessian2 cause CRE (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2020-13922](https://cve.now/CVE-2020-13922.md): Apache DolphinScheduler (incubating) Permission vulnerability (no CVSS, Apache Software Foundation Apache DolphinScheduler · apa… +1)
- [CVE-2021-3121](https://cve.now/CVE-2021-3121.md): An issue was discovered in GoGo Protobuf before 1.3.2. (no CVSS, github.com/gogo/protobuf)
- [CVE-2021-3118](https://cve.now/CVE-2021-3118.md): EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has multiple SQL Injection issues in the login form and the password-forgotten form (s (no CVSS)
- [CVE-2021-3116](https://cve.now/CVE-2021-3116.md): before\_upstream\_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data be (no CVSS, proxy-py)
- [CVE-2020-35727](https://cve.now/CVE-2020-35727.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35726](https://cve.now/CVE-2020-35726.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35725](https://cve.now/CVE-2020-35725.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35724](https://cve.now/CVE-2020-35724.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35723](https://cve.now/CVE-2020-35723.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35722](https://cve.now/CVE-2020-35722.md): CSRF in Web Compliance Manager in Quest Policy Authority 8.1.2.200 allows remote attackers to force user modification/creation via a special (no CVSS)
- [CVE-2020-35721](https://cve.now/CVE-2020-35721.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35720](https://cve.now/CVE-2020-35720.md): Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name, last name, an (no CVSS)
- [CVE-2020-35719](https://cve.now/CVE-2020-35719.md): Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35204](https://cve.now/CVE-2020-35204.md): Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted (no CVSS)
- [CVE-2020-35205](https://cve.now/CVE-2020-35205.md): Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal p (no CVSS)
- [CVE-2020-35206](https://cve.now/CVE-2020-35206.md): Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the brows (no CVSS)
- [CVE-2020-35203](https://cve.now/CVE-2020-35203.md): Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the brows (no CVSS)
- [CVE-2020-26298](https://cve.now/CVE-2020-26298.md): Injection in Redcarpet (CVSS 6.8, vmg redcarpet · redcarpet)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.