# CVEs published 2021-01-12

178 CVEs were published on January 12, 2021: 3 critical, 66 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-23927](https://cve.now/CVE-2021-23927.md): OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. (no CVSS)
- [CVE-2021-23928](https://cve.now/CVE-2021-23928.md): OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string. (no CVSS)
- [CVE-2021-23929](https://cve.now/CVE-2021-23929.md): OX App Suite through 7.10.4 allows XSS via a crafted Content-Disposition header in an uploaded HTML document to an ajax/share/\<share-token\>? (no CVSS)
- [CVE-2021-23930](https://cve.now/CVE-2021-23930.md): OX App Suite through 7.10.4 allows XSS via use of the conversion API for a distributedFile. (no CVSS)
- [CVE-2021-23931](https://cve.now/CVE-2021-23931.md): OX App Suite through 7.10.4 allows XSS via an inline binary file. (no CVSS)
- [CVE-2021-23932](https://cve.now/CVE-2021-23932.md): OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename. (no CVSS)
- [CVE-2021-23933](https://cve.now/CVE-2021-23933.md): OX App Suite through 7.10.4 allows XSS via JavaScript in a Note referenced by a mail:// URL. (no CVSS)
- [CVE-2021-23934](https://cve.now/CVE-2021-23934.md): OX App Suite through 7.10.4 allows XSS via a contact whose name contains JavaScript code. (no CVSS)
- [CVE-2021-23935](https://cve.now/CVE-2021-23935.md): OX App Suite through 7.10.4 allows XSS via an appointment in which the location contains JavaScript code. (no CVSS)
- [CVE-2021-23936](https://cve.now/CVE-2021-23936.md): OX App Suite through 7.10.4 allows XSS via the subject of a task. (no CVSS)
- [CVE-2021-23125](https://cve.now/CVE-2021-23125.md): \[20210103\] - Core - XSS in com\_tags image parameters (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23124](https://cve.now/CVE-2021-23124.md): \[20210102\] - Core - XSS in mod\_breadcrumbs aria-label attribute (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-23123](https://cve.now/CVE-2021-23123.md): \[20210101\] - Core - com\_modules exposes module names (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2020-28386](https://cve.now/CVE-2020-28386.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (All Versions \< SE2021MP2). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-28390](https://cve.now/CVE-2020-28390.md): A vulnerability has been identified in Opcenter Execution Core (V8.2), Opcenter Execution Core (V8.3). (no CVSS, Siemens Opcenter Execution Core)
- [CVE-2020-26992](https://cve.now/CVE-2020-26992.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26993](https://cve.now/CVE-2020-26993.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26994](https://cve.now/CVE-2020-26994.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26995](https://cve.now/CVE-2020-26995.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26996](https://cve.now/CVE-2020-26996.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-28381](https://cve.now/CVE-2020-28381.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (All Versions \< SE2021MP2). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-28382](https://cve.now/CVE-2020-28382.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (All Versions \< SE2021MP2). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-28383](https://cve.now/CVE-2020-28383.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (A (no CVSS, Siemens JT2Go · Siemens Solid Edge SE2020 +2)
- [CVE-2020-28384](https://cve.now/CVE-2020-28384.md): A vulnerability has been identified in Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (All Versions \< SE2021MP2). (no CVSS, Siemens Solid Edge SE2020 · Siemens Solid Edge SE2021)
- [CVE-2020-26982](https://cve.now/CVE-2020-26982.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26983](https://cve.now/CVE-2020-26983.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26984](https://cve.now/CVE-2020-26984.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26985](https://cve.now/CVE-2020-26985.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26986](https://cve.now/CVE-2020-26986.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26987](https://cve.now/CVE-2020-26987.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26988](https://cve.now/CVE-2020-26988.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26989](https://cve.now/CVE-2020-26989.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Solid Edge SE2020 (All Versions \< SE2020MP12), Solid Edge SE2021 (A (no CVSS, Siemens JT2Go · Siemens Solid Edge SE2020 +2)
- [CVE-2020-26990](https://cve.now/CVE-2020-26990.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26991](https://cve.now/CVE-2020-26991.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.2), Teamcenter Visualization (All versions \< V13.1.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-15799](https://cve.now/CVE-2020-15799.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE X-2…)
- [CVE-2020-15800](https://cve.now/CVE-2020-15800.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1)
- [CVE-2020-25226](https://cve.now/CVE-2020-25226.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE X-2…)
- [CVE-2020-26980](https://cve.now/CVE-2020-26980.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26981](https://cve.now/CVE-2020-26981.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0), Teamcenter Visualization (All versions \< V13.1.0). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2021-1723](https://cve.now/CVE-2021-1723.md): ASP.NET Core and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft ASP.NET Core · Microsoft Visual Studio +12)
- [CVE-2021-1725](https://cve.now/CVE-2021-1725.md): Bot Framework SDK Information Disclosure Vulnerability (CVSS 5.5, Microsoft Bot Framework SDK for .NET Framework · Microso… +2)
- [CVE-2021-1719](https://cve.now/CVE-2021-1719.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2021-1717](https://cve.now/CVE-2021-1717.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-1718](https://cve.now/CVE-2021-1718.md): Microsoft SharePoint Server Tampering Vulnerability (CVSS 8.0, Microsoft SharePoint Foundation 2010 Service Pack)
- [CVE-2021-1716](https://cve.now/CVE-2021-1716.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Web Apps Server 2013 Service Pack · Mic… +4)
- [CVE-2021-1714](https://cve.now/CVE-2021-1714.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server 2013 Service Pack… +2)
- [CVE-2021-1715](https://cve.now/CVE-2021-1715.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +3)
- [CVE-2021-1713](https://cve.now/CVE-2021-1713.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-1711](https://cve.now/CVE-2021-1711.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2021-1712](https://cve.now/CVE-2021-1712.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-1710](https://cve.now/CVE-2021-1710.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1708](https://cve.now/CVE-2021-1708.md): Windows GDI+ Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-1709](https://cve.now/CVE-2021-1709.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-1706](https://cve.now/CVE-2021-1706.md): Windows LUAFV Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2021-1707](https://cve.now/CVE-2021-1707.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +2)
- [CVE-2021-1705](https://cve.now/CVE-2021-1705.md): Microsoft Edge (HTML-based) Memory Corruption Vulnerability (CVSS 4.2, Microsoft Edge)
- [CVE-2021-1703](https://cve.now/CVE-2021-1703.md): Windows Event Logging Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1704](https://cve.now/CVE-2021-1704.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows Server · Microsoft Windows)
- [CVE-2021-1702](https://cve.now/CVE-2021-1702.md): Windows Remote Procedure Call Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1700](https://cve.now/CVE-2021-1700.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1701](https://cve.now/CVE-2021-1701.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1699](https://cve.now/CVE-2021-1699.md): Windows (modem.sys) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1696](https://cve.now/CVE-2021-1696.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1697](https://cve.now/CVE-2021-1697.md): Windows InstallService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1694](https://cve.now/CVE-2021-1694.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-1695](https://cve.now/CVE-2021-1695.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1693](https://cve.now/CVE-2021-1693.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1691](https://cve.now/CVE-2021-1691.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2021-1692](https://cve.now/CVE-2021-1692.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2021-1690](https://cve.now/CVE-2021-1690.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1688](https://cve.now/CVE-2021-1688.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1689](https://cve.now/CVE-2021-1689.md): Windows Multipoint Management Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1687](https://cve.now/CVE-2021-1687.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1685](https://cve.now/CVE-2021-1685.md): Windows AppX Deployment Extensions Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2021-1686](https://cve.now/CVE-2021-1686.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1684](https://cve.now/CVE-2021-1684.md): Windows Bluetooth Security Feature Bypass Vulnerability (CVSS 5.0, Microsoft Windows)
- [CVE-2021-1682](https://cve.now/CVE-2021-1682.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-1683](https://cve.now/CVE-2021-1683.md): Windows Bluetooth Security Feature Bypass Vulnerability (CVSS 5.0, Microsoft Windows)
- [CVE-2021-1681](https://cve.now/CVE-2021-1681.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1679](https://cve.now/CVE-2021-1679.md): Windows CryptoAPI Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-1680](https://cve.now/CVE-2021-1680.md): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-1678](https://cve.now/CVE-2021-1678.md): Windows Print Spooler Spoofing Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1676](https://cve.now/CVE-2021-1676.md): Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1677](https://cve.now/CVE-2021-1677.md): Azure Active Directory Pod Identity Spoofing Vulnerability (CVSS 5.5, Microsoft Azure Kubernetes Service)
- [CVE-2021-1673](https://cve.now/CVE-2021-1673.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1674](https://cve.now/CVE-2021-1674.md): Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1672](https://cve.now/CVE-2021-1672.md): Windows Projected File System FS Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1670](https://cve.now/CVE-2021-1670.md): Windows Projected File System FS Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1671](https://cve.now/CVE-2021-1671.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1669](https://cve.now/CVE-2021-1669.md): Windows Remote Desktop Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows · Microsoft Remote Desktop for Mac +2)
- [CVE-2021-1668](https://cve.now/CVE-2021-1668.md): Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1666](https://cve.now/CVE-2021-1666.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1667](https://cve.now/CVE-2021-1667.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1664](https://cve.now/CVE-2021-1664.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1665](https://cve.now/CVE-2021-1665.md): GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1663](https://cve.now/CVE-2021-1663.md): Windows Projected File System FS Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1662](https://cve.now/CVE-2021-1662.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1660](https://cve.now/CVE-2021-1660.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1661](https://cve.now/CVE-2021-1661.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1658](https://cve.now/CVE-2021-1658.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-1659](https://cve.now/CVE-2021-1659.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1657](https://cve.now/CVE-2021-1657.md): Windows Fax Compose Form Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1655](https://cve.now/CVE-2021-1655.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1656](https://cve.now/CVE-2021-1656.md): TPM Device Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-1654](https://cve.now/CVE-2021-1654.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1652](https://cve.now/CVE-2021-1652.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1653](https://cve.now/CVE-2021-1653.md): Windows CSC Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1651](https://cve.now/CVE-2021-1651.md): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows · Microsoft Visual Studio)
- [CVE-2021-1649](https://cve.now/CVE-2021-1649.md): Active Template Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1650](https://cve.now/CVE-2021-1650.md): Windows Runtime C++ Template Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1647](https://cve.now/CVE-2021-1647.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft System Center Endpoint Protection · Microsoft… +3)
- [CVE-2021-1648](https://cve.now/CVE-2021-1648.md): Microsoft splwow64 Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1646](https://cve.now/CVE-2021-1646.md): Windows WLAN Service Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2021-1644](https://cve.now/CVE-2021-1644.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-1645](https://cve.now/CVE-2021-1645.md): Windows Docker Information Disclosure Vulnerability (CVSS 5.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2021-1643](https://cve.now/CVE-2021-1643.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-1641](https://cve.now/CVE-2021-1641.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-1642](https://cve.now/CVE-2021-1642.md): Windows AppX Deployment Extensions Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-1638](https://cve.now/CVE-2021-1638.md): Windows Bluetooth Security Feature Bypass Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2021-1636](https://cve.now/CVE-2021-1636.md): Microsoft SQL Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2012 Service Pack · Microsoft SQL S… +1)
- [CVE-2021-1637](https://cve.now/CVE-2021-1637.md): Windows DNS Query Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2020-36190](https://cve.now/CVE-2020-36190.md): RailsAdmin (aka rails\_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms. (no CVSS, rails\_admin)
- [CVE-2020-4079](https://cve.now/CVE-2020-4079.md): Information disclosure vulnerability in iTop (CVSS 7.7, Combodo iTop)
- [CVE-2021-3134](https://cve.now/CVE-2021-3134.md): Mubu 2.2.1 allows local users to gain privileges to execute commands, aka CNVD-2020-68878. (no CVSS)
- [CVE-2021-3133](https://cve.now/CVE-2021-3133.md): The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages. (no CVSS)
- [CVE-2020-13116](https://cve.now/CVE-2020-13116.md): OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation. (no CVSS)
- [CVE-2020-27148](https://cve.now/CVE-2020-27148.md): TIBCO EBX EXML External Entity (CVSS 7.1, TIBCO Software TIBCO EBX Add-ons)
- [CVE-2020-4838](https://cve.now/CVE-2020-4838.md): IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM API Connect)
- [CVE-2020-4674](https://cve.now/CVE-2020-4674.md): IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. (CVSS 4.3, IBM Workload Automation)
- [CVE-2020-4673](https://cve.now/CVE-2020-4673.md): IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. (CVSS 4.3, IBM Workload Automation)
- [CVE-2021-21469](https://cve.now/CVE-2021-21469.md): When security guidelines for SAP NetWeaver Master Data Management running on windows have not been thoroughly reviewed, it might be possible (CVSS 5.3, SAP SE SAP NetWeaver Master Data Management)
- [CVE-2021-21466](https://cve.now/CVE-2021-21466.md): SAP Business Warehouse, versions 700, 701, 702, 711, 730, 731, 740, 750, 782 and SAP BW/4HANA, versions 100, 200, allow a low privileged att (CVSS 9.9, SAP SE SAP Business Warehouse · SAP SE SAP BW/4HANA)
- [CVE-2021-21445](https://cve.now/CVE-2021-21445.md): SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP respon (CVSS 5.4, SAP SE SAP Commerce Cloud)
- [CVE-2021-21463](https://cve.now/CVE-2021-21463.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21467](https://cve.now/CVE-2021-21467.md): SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, resulting in escalatio (CVSS 4.3, SAP SE SAP Banking Services)
- [CVE-2021-21470](https://cve.now/CVE-2021-21470.md): SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an authenticated attac (CVSS 3.6, SAP SE SAP EPM Add-in for Microsoft Office · SAP SE SAP EPM…)
- [CVE-2021-21465](https://cve.now/CVE-2021-21465.md): The BW Database Interface allows an attacker with low privileges to execute any crafted database queries, exposing the backend database. (CVSS 9.9, SAP SE SAP Business Warehouse)
- [CVE-2021-21468](https://cve.now/CVE-2021-21468.md): The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges t (CVSS 6.5, SAP SE SAP Business Warehouse)
- [CVE-2021-21462](https://cve.now/CVE-2021-21462.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21447](https://cve.now/CVE-2021-21447.md): SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malicious JavaScript paylo (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence platform)
- [CVE-2021-21457](https://cve.now/CVE-2021-21457.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21456](https://cve.now/CVE-2021-21456.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21448](https://cve.now/CVE-2021-21448.md): SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend systems in the client (CVSS 5.3, SAP SE SAP GUI FOR WINDOWS)
- [CVE-2021-21461](https://cve.now/CVE-2021-21461.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated BMP file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21446](https://cve.now/CVE-2021-21446.md): SAP NetWeaver AS ABAP, versions 740, 750, 751, 752, 753, 754, 755, allows an unauthenticated attacker to prevent legitimate users from acces (CVSS 7.5, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2021-21449](https://cve.now/CVE-2021-21449.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21458](https://cve.now/CVE-2021-21458.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21450](https://cve.now/CVE-2021-21450.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21453](https://cve.now/CVE-2021-21453.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21454](https://cve.now/CVE-2021-21454.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated RLE file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21464](https://cve.now/CVE-2021-21464.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21451](https://cve.now/CVE-2021-21451.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated SGI file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21455](https://cve.now/CVE-2021-21455.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21452](https://cve.now/CVE-2021-21452.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21460](https://cve.now/CVE-2021-21460.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated DIB file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-21459](https://cve.now/CVE-2021-21459.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in cr (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2020-25657](https://cve.now/CVE-2020-25657.md): A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API (no CVSS, m2crypto)
- [CVE-2020-35459](https://cve.now/CVE-2020-35459.md): An issue was discovered in ClusterLabs crmsh through 4.2.1. (no CVSS, crmsh)
- [CVE-2020-14274](https://cve.now/CVE-2020-14274.md): Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain (no CVSS, HCL Commerce)
- [CVE-2020-14275](https://cve.now/CVE-2020-14275.md): Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of servic (no CVSS, HCL Commerce)
- [CVE-2020-14341](https://cve.now/CVE-2020-14341.md): The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connec (no CVSS, Red Hat Single Sign-On)
- [CVE-2020-35458](https://cve.now/CVE-2020-35458.md): An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. (no CVSS)
- [CVE-2021-21471](https://cve.now/CVE-2021-21471.md): In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints which are not inten (CVSS 6.5, SAP SE CLA-Assistant)
- [CVE-2020-26713](https://cve.now/CVE-2020-26713.md): REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. (no CVSS)
- [CVE-2020-26712](https://cve.now/CVE-2020-26712.md): REDCap 10.3.4 contains a SQL injection vulnerability in the ToDoList function via sort parameter. (no CVSS)
- [CVE-2021-3129](https://cve.now/CVE-2021-3129.md): Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of i (CVSS 9.8, KEV, facade/ignition)
- [CVE-2021-23240](https://cve.now/CVE-2021-23240.md): selinux\_edit\_copy\_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by (no CVSS)
- [CVE-2020-35655](https://cve.now/CVE-2020-35655.md): In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tabl (no CVSS, pillow)
- [CVE-2020-35654](https://cve.now/CVE-2020-35654.md): In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conf (no CVSS, pillow)
- [CVE-2020-35653](https://cve.now/CVE-2020-35653.md): In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted (no CVSS, pillow)
- [CVE-2020-24701](https://cve.now/CVE-2020-24701.md): OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH\_INFO to the /appsuite URI). (no CVSS)
- [CVE-2020-24700](https://cve.now/CVE-2020-24700.md): OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconfig. (no CVSS)
- [CVE-2020-26050](https://cve.now/CVE-2020-26050.md): SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted o (no CVSS)
- [CVE-2020-16146](https://cve.now/CVE-2020-16146.md): Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buf (no CVSS)
- [CVE-2020-27637](https://cve.now/CVE-2020-27637.md): The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. (no CVSS)
- [CVE-2020-28391](https://cve.now/CVE-2020-28391.md): A vulnerability has been identified in SCALANCE X-200 switch family (incl. (no CVSS, Siemens SCALANCE X-200 switch family · Siemens SCALANCE… +1)
- [CVE-2020-28395](https://cve.now/CVE-2020-28395.md): A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions \< V3.2.7), SCALANCE X-300 switch family (incl. (no CVSS, Siemens SCALANCE X-200RNA switch family · Siemens SCALANCE…)
- [CVE-2021-23239](https://cve.now/CVE-2021-23239.md): The sudoedit personality of Sudo before 1.9.5 may allow a local unprivileged user to perform arbitrary directory-existence tests by winning (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.