# CVEs published 2021-01-14 29 CVEs were published on January 14, 2021: 2 critical, 6 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-27220](https://cve.now/CVE-2020-27220.md): The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & con (no CVSS, The Eclipse Foundation Eclipse Hono) - [CVE-2020-27219](https://cve.now/CVE-2020-27219.md): In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe (no CVSS, The Eclipse Foundation Eclipse Hawkbit · org.eclipse.hawkbi…) - [CVE-2020-29495](https://cve.now/CVE-2020-29495.md): DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. (CVSS 10.0, Dell Avamar) - [CVE-2020-29494](https://cve.now/CVE-2020-29494.md): Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM. (CVSS 8.7, Dell Avamar) - [CVE-2020-29493](https://cve.now/CVE-2020-29493.md): DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. (CVSS 10.0, Dell Avamar) - [CVE-2020-16046](https://cve.now/CVE-2020-16046.md): Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted (no CVSS, Google Chrome) - [CVE-2020-6572](https://cve.now/CVE-2020-6572.md): Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, KEV, Google Chrome) - [CVE-2020-16045](https://cve.now/CVE-2020-16045.md): Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome) - [CVE-2021-21261](https://cve.now/CVE-2021-21261.md): Flatpak sandbox escape via spawn portal (CVSS 7.3, flatpak) - [CVE-2021-22132](https://cve.now/CVE-2021-22132.md): Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch) - [CVE-2020-29015](https://cve.now/CVE-2020-29015.md): A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote at (no CVSS, Fortinet FortiWeb) - [CVE-2020-29018](https://cve.now/CVE-2020-29018.md): A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and (no CVSS, Fortinet FortiWeb) - [CVE-2020-29016](https://cve.now/CVE-2020-29016.md): A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unauthenticated, remote at (no CVSS, Fortinet FortiWeb) - [CVE-2020-29017](https://cve.now/CVE-2020-29017.md): An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary co (no CVSS, Fortinet FortiDeceptor) - [CVE-2020-29019](https://cve.now/CVE-2020-29019.md): A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote, unauthenticated att (no CVSS, Fortinet FortiWeb) - [CVE-2021-21722](https://cve.now/CVE-2021-21722.md): A ZTE Smart STB is impacted by an information leak vulnerability. (no CVSS, ZXV10 B860A) - [CVE-2020-27368](https://cve.now/CVE-2020-27368.md): Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via (no CVSS) - [CVE-2020-26733](https://cve.now/CVE-2020-26733.md): Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated (no CVSS) - [CVE-2020-6777](https://cve.now/CVE-2020-6777.md): Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 4.8, Bosch PRAESIDEO · Bosch PRAESENSA) - [CVE-2020-6776](https://cve.now/CVE-2020-6776.md): CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface (CVSS 8.8, Bosch PRAESIDEO · Bosch PRAESENSA) - [CVE-2020-29587](https://cve.now/CVE-2020-29587.md): SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. (no CVSS) - [CVE-2021-23926](https://cve.now/CVE-2021-23926.md): XMLBeans XML Entity Expansion (no CVSS, Apache Software Foundation Apache XMLBeans · org.apache.xml…) - [CVE-2021-24122](https://cve.now/CVE-2021-24122.md): Apache Tomcat information disclosure (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1) - [CVE-2020-28470](https://cve.now/CVE-2020-28470.md): Cross-site Scripting (XSS) (CVSS 7.3, @scullyio/scully · @scullyio/ng-lib) - [CVE-2021-20618](https://cve.now/CVE-2021-20618.md): Privilege chaining vulnerability in acmailer ver. (no CVSS, Seeds Co. acmailer and acmailer DB) - [CVE-2021-20617](https://cve.now/CVE-2021-20617.md): Improper access control vulnerability in acmailer ver. (no CVSS, Seeds Co. acmailer and acmailer DB) - [CVE-2021-3138](https://cve.now/CVE-2021-3138.md): In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. (no CVSS) - [CVE-2020-16119](https://cve.now/CVE-2020-16119.md): DCCP CCID structure use-after-free (CVSS 6.3, Canonical Linux kernel) - [CVE-2020-26732](https://cve.now/CVE-2020-26732.md): SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie in an HTTPS session, (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-01-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.