CVEs published January 12, 2021
178 CVEs were published on January 12, 2021: 3 critical, 66 high. 2 are now in CISA KEV.
- Published
- 178
- Critical
- 3
- High
- 66
- Medium
- 45
- Low
- 1
- Unrated
- 63
- Now in CISA KEV
- 2
- Fix available
- 36
Most affected products
- Microsoft Windows
- 56
- SAP SE SAP 3D Visual Enterprise Viewer
- 16
- Siemens JT2Go · Siemens Teamcenter Visualization
- 16
- Microsoft Windows Server · Microsoft Windows
- 4
- Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- 4
- Joomla! Project Joomla! CMS
- 3
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 3
- pillow
- 3
- HCL Commerce
- 2
- IBM Workload Automation
- 2
Critical 3
- CVE-2021-21466SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged attSAP SE SAP Business Warehouse · SAP SE SAP BW/4HANA
- CVE-2021-21465The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database.SAP SE SAP Business Warehouse
- CVE-2021-3129Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of ifacade/ignition
High 66
- CVE-2021-1723ASP.NET Core and Visual Studio Denial of Service VulnerabilityMicrosoft ASP.NET Core · Microsoft Visual Studio +12
- CVE-2021-1719Microsoft SharePoint Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2021-1718Microsoft SharePoint Server Tampering VulnerabilityMicrosoft SharePoint Foundation 2010 Service Pack
- CVE-2021-1716Microsoft Word Remote Code Execution VulnerabilityMicrosoft Office Web Apps Server 2013 Service Pack · Mic… +4
- CVE-2021-1714Microsoft Excel Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server 2013 Service Pack… +2
- CVE-2021-1715Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +3
- CVE-2021-1713Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-1711Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-1712Microsoft SharePoint Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-1710Microsoft Windows Media Foundation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1709Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1706Windows LUAFV Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1707Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +2
- CVE-2021-1703Windows Event Logging Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1704Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-1702Windows Remote Procedure Call Runtime Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1700Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1701Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1697Windows InstallService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1694Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1695Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1693Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1691Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-1692Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-1690Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1688Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1689Windows Multipoint Management Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1687Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1685Windows AppX Deployment Extensions Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1686Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1682Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1681Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1680Diagnostics Hub Standard Collector Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2021-1678Windows Print Spooler Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-1673Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1674Windows Remote Desktop Protocol Core Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-1671Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1669Windows Remote Desktop Security Feature Bypass VulnerabilityMicrosoft Windows · Microsoft Remote Desktop for Mac +2
- CVE-2021-1668Microsoft DTV-DVD Video Decoder Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1666Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1667Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1664Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1665GDI+ Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1662Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1660Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1661Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1658Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1659Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1657Windows Fax Compose Form Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1655Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1654Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1652Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1653Windows CSC Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1651Diagnostics Hub Standard Collector Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2021-1649Active Template Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1650Windows Runtime C++ Template Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1647Microsoft Defender Remote Code Execution VulnerabilityMicrosoft System Center Endpoint Protection · Microsoft… +3
- CVE-2021-1648Microsoft splwow64 Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1644HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-1643HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-1642Windows AppX Deployment Extensions Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1638Windows Bluetooth Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-1636Microsoft SQL Elevation of Privilege VulnerabilityMicrosoft SQL Server 2012 Service Pack · Microsoft SQL S… +1
- CVE-2020-4079Information disclosure vulnerability in iTopCombodo iTop
- CVE-2020-27148TIBCO EBX EXML External EntityTIBCO Software TIBCO EBX Add-ons
- CVE-2021-21446SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from accesSAP SE SAP NetWeaver AS ABAP
Medium, low and unrated 109
- CVE-2021-23927OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request.
- CVE-2021-23928OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string.
- CVE-2021-23929OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/<share-token>?
- CVE-2021-23930OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile.
- CVE-2021-23931OX App Suite through 7.10.4 allows XSS via an inline binary file.
- CVE-2021-23932OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename.
- CVE-2021-23933OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL.
- CVE-2021-23934OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code.
- CVE-2021-23935OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code.
- CVE-2021-23936OX App Suite through 7.10.4 allows XSS via the subject of a task.
- CVE-2021-23125[20210103] - Core - XSS in com_tags image parametersJoomla! Project Joomla! CMS
- CVE-2021-23124[20210102] - Core - XSS in mod_breadcrumbs aria-label attributeJoomla! Project Joomla! CMS
- CVE-2021-23123[20210101] - Core - com_modules exposes module namesJoomla! Project Joomla! CMS
- CVE-2020-28386A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-28390A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3).Siemens Opcenter Execution Core
- CVE-2020-26992A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26993A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26994A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26995A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26996A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-28381A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-28382A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-28383A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (ASiemens JT2Go · Siemens Solid Edge SE2020 +2
- CVE-2020-28384A vulnerability has been identified in Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (All Versions < SE2021MP2).Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021
- CVE-2020-26982A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26983A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26984A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26985A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26986A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26987A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26988A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26989A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Solid Edge SE2020 (All Versions < SE2020MP12), Solid Edge SE2021 (ASiemens JT2Go · Siemens Solid Edge SE2020 +2
- CVE-2020-26990A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26991A vulnerability has been identified in JT2Go (All versions < V13.1.0.2), Teamcenter Visualization (All versions < V13.1.0.2).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-15799A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE X-2…
- CVE-2020-15800A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1
- CVE-2020-25226A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE X-2…
- CVE-2020-26980A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2020-26981A vulnerability has been identified in JT2Go (All versions < V13.1.0), Teamcenter Visualization (All versions < V13.1.0).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-1725Bot Framework SDK Information Disclosure VulnerabilityMicrosoft Bot Framework SDK for .NET Framework · Microso… +2
- CVE-2021-1717Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-1708Windows GDI+ Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1705Microsoft Edge (HTML-based) Memory Corruption VulnerabilityMicrosoft Edge
- CVE-2021-1699Windows (modem.sys) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1696Windows Graphics Component Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1684Windows Bluetooth Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-1683Windows Bluetooth Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-1679Windows CryptoAPI Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-1676Windows NT Lan Manager Datagram Receiver Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1677Azure Active Directory Pod Identity Spoofing VulnerabilityMicrosoft Azure Kubernetes Service
- CVE-2021-1672Windows Projected File System FS Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1670Windows Projected File System FS Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1663Windows Projected File System FS Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1656TPM Device Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-1646Windows WLAN Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1645Windows Docker Information Disclosure VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-1641Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-1637Windows DNS Query Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2020-36190RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.rails_admin
- CVE-2021-3134Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878.
- CVE-2021-3133The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.
- CVE-2020-13116OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.
- CVE-2020-4838IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting.IBM API Connect
- CVE-2020-4674IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system.IBM Workload Automation
- CVE-2020-4673IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system.IBM Workload Automation
- CVE-2021-21469When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possibleSAP SE SAP NetWeaver Master Data Management
- CVE-2021-21445SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP responSAP SE SAP Commerce Cloud
- CVE-2021-21463SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21467SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalatioSAP SE SAP Banking Services
- CVE-2021-21470SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attacSAP SE SAP EPM Add-in for Microsoft Office · SAP SE SAP EPM…
- CVE-2021-21468The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges tSAP SE SAP Business Warehouse
- CVE-2021-21462SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21447SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript payloSAP SE SAP BusinessObjects Business Intelligence platform
- CVE-2021-21457SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21456SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21448SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the clientSAP SE SAP GUI FOR WINDOWS
- CVE-2021-21461SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21449SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21458SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21450SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21453SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21454SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21464SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21451SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21455SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21452SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21460SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-21459SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2020-25657A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API m2crypto
- CVE-2020-35459An issue was discovered in ClusterLabs crmsh through 4.2.1.crmsh
- CVE-2020-14274Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain HCL Commerce
- CVE-2020-14275Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of servicHCL Commerce
- CVE-2020-14341The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connecRed Hat Single Sign-On
- CVE-2020-35458An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x.
- CVE-2021-21471In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not intenSAP SE CLA-Assistant
- CVE-2020-26713REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort.
- CVE-2020-26712REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter.
- CVE-2021-23240selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by
- CVE-2020-35655In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tablpillow
- CVE-2020-35654In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation confpillow
- CVE-2020-35653In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted pillow
- CVE-2020-24701OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).
- CVE-2020-24700OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig.
- CVE-2020-26050SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted o
- CVE-2020-16146Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buf
- CVE-2020-27637The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise.
- CVE-2020-28391A vulnerability has been identified in SCALANCE X-200 switch family (incl.Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1
- CVE-2020-28395A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl.Siemens SCALANCE X-200RNA switch family · Siemens SCALANCE…
- CVE-2021-23239The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning