CVEs published January 14, 2021
29 CVEs were published on January 14, 2021: 2 critical, 6 high. 1 is now in CISA KEV.
- Published
- 29
- Critical
- 2
- High
- 6
- Medium
- 2
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Fortinet FortiWeb
- 4
- Dell Avamar
- 3
- Google Chrome
- 3
- Bosch PRAESIDEO · Bosch PRAESENSA
- 2
- Seeds Co. acmailer and acmailer DB
- 2
- @scullyio/scully · @scullyio/ng-lib
- 1
- Apache Software Foundation Apache Tomcat · tomcat +1
- 1
- Apache Software Foundation Apache XMLBeans · org.apache.xml…
- 1
- Canonical Linux kernel
- 1
- Elasticsearch · org.elasticsearch:elasticsearch
- 1
Critical 2
High 6
- CVE-2020-29494Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM.Dell Avamar
- CVE-2020-6572Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2021-21261Flatpak sandbox escape via spawn portalflatpak
- CVE-2020-6776CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management InterfaceBosch PRAESIDEO · Bosch PRAESENSA
- CVE-2020-28470Cross-site Scripting (XSS)@scullyio/scully · @scullyio/ng-lib
- CVE-2020-26732SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session,
Medium, low and unrated 21
- CVE-2020-27220The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & conThe Eclipse Foundation Eclipse Hono
- CVE-2020-27219In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe The Eclipse Foundation Eclipse Hawkbit · org.eclipse.hawkbi…
- CVE-2020-16046Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted Google Chrome
- CVE-2020-16045Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2021-22132Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2020-29015A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote atFortinet FortiWeb
- CVE-2020-29018A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and Fortinet FortiWeb
- CVE-2020-29016A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote atFortinet FortiWeb
- CVE-2020-29017An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary coFortinet FortiDeceptor
- CVE-2020-29019A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated attFortinet FortiWeb
- CVE-2021-21722A ZTE Smart STB is impacted by an information leak vulnerability.ZXV10 B860A
- CVE-2020-27368Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via
- CVE-2020-26733Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated
- CVE-2020-6777Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management InterfaceBosch PRAESIDEO · Bosch PRAESENSA
- CVE-2020-29587SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals.
- CVE-2021-23926XMLBeans XML Entity ExpansionApache Software Foundation Apache XMLBeans · org.apache.xml…
- CVE-2021-24122Apache Tomcat information disclosureApache Software Foundation Apache Tomcat · tomcat +1
- CVE-2021-20618Privilege chaining vulnerability in acmailer ver.Seeds Co. acmailer and acmailer DB
- CVE-2021-20617Improper access control vulnerability in acmailer ver.Seeds Co. acmailer and acmailer DB
- CVE-2021-3138In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.
- CVE-2020-16119DCCP CCID structure use-after-freeCanonical Linux kernel