CVEs published January 15, 2021
52 CVEs were published on January 15, 2021: 8 critical, 15 high.
- Published
- 52
- Critical
- 8
- High
- 15
- Medium
- 12
- Low
- 0
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Juniper Networks Junos OS
- 16
- theonedev onedev
- 10
- GitLab
- 5
- Aruba AirWave Glass Software
- 4
- git-lfs · github.com/git-lfs/git-lfs
- 1
- Juniper Networks Contrail Networking
- 1
- Juniper Networks Junos OS Evolved
- 1
- Juniper Networks Junos Space
- 1
Critical 8
- CVE-2021-21245Pre-Auth Arbitrary File Uploadtheonedev onedev
- CVE-2021-21247Post-Auth Unsafe Deserialization on BasePage (AJAX)theonedev onedev
- CVE-2021-21249Post-Auth Unsafe Yaml deserializationtheonedev onedev
- CVE-2021-21248Post-Auth Arbitrary Code execution via Groovy script injectiontheonedev onedev
- CVE-2021-21242Pre-Auth Unsafe Deserialization on AttachmentUploadServettheonedev onedev
- CVE-2021-21243Pre-Auth Unsafe Deserialization on KubernetesResourcetheonedev onedev
- CVE-2021-21244Pre-Auth SSTI via Bean validation message tamperingtheonedev onedev
- CVE-2021-0211Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted.Juniper Networks Junos OS
High 15
- CVE-2021-21246Pre-Auth Access token leaktheonedev onedev
- CVE-2021-21250Post-Auth External Entity Expansion (XXE)theonedev onedev
- CVE-2021-21251ZipSlip Arbitrary File Uploadtheonedev onedev
- CVE-2021-21237Git LFS can execute a Git binary from the current directory on Windowsgit-lfs · github.com/git-lfs/git-lfs
- CVE-2021-0223Junos OS: telnetd.real Local Privilege Escalation vulnerabilities in SUID binariesJuniper Networks Junos OS
- CVE-2021-0222Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur.Juniper Networks Junos OS
- CVE-2021-0218Junos OS: Command injection vulnerability in license-check daemonJuniper Networks Junos OS
- CVE-2021-0217Junos OS: EX Series and QFX Series: Memory leak issue processing specific DHCP packetsJuniper Networks Junos OS
- CVE-2021-0208Junos OS and Junos OS Evolved: In bidirectional LSP configurations, on MPLS egress router RPD may core upon receipt of specific malformed RSVP packet.Juniper Networks Junos OS
- CVE-2021-0207NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.Juniper Networks Junos OS
- CVE-2021-0206Junos OS: NFX Series, SRX Series: PFE may crash upon receipt of specific packet when SSL Proxy is configured.Juniper Networks Junos OS
- CVE-2021-0204Junos OS: dexp Local Privilege Escalation vulnerabilities in SUID binariesJuniper Networks Junos OS
- CVE-2021-0203Junos OS: EX and QFX5K Series: Storm Control does not work as expected when Redundant Trunk Group is configuredJuniper Networks Junos OS
- CVE-2021-0202Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-DomainJuniper Networks Junos OS
- CVE-2021-22171Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if thGitLab
Medium, low and unrated 29
- CVE-2020-25533An issue was discovered in Malwarebytes before 4.0 on macOS.
- CVE-2021-3162Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
- CVE-2020-24640There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment Aruba AirWave Glass Software
- CVE-2020-24639There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment wiAruba AirWave Glass Software
- CVE-2020-24638Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli.Aruba AirWave Glass Software
- CVE-2020-24641In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if succesAruba AirWave Glass Software
- CVE-2021-0221Junos OS: QFX Series: Traffic loop Denial of Service (DoS) upon receipt of specific IP multicast trafficJuniper Networks Junos OS
- CVE-2021-0220Junos Space: Shared secrets stored in recoverable format and directly exposed through the UIJuniper Networks Junos Space
- CVE-2021-0219Junos OS: Command injection vulnerability in 'request system software' CLI commandJuniper Networks Junos OS
- CVE-2021-0215Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flapsJuniper Networks Junos OS
- CVE-2021-0212Contrail Networking: Administrator credentials are exposed in a plaintext fileJuniper Networks Contrail Networking
- CVE-2021-0210Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active sessionJuniper Networks Junos OS
- CVE-2021-0209Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX.Juniper Networks Junos OS Evolved
- CVE-2021-0205Junos OS: MX Series: Dynamic filter fails to match IPv6 prefixJuniper Networks Junos OS
- CVE-2020-16255ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'
- CVE-2020-35749Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for
- CVE-2020-35748Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress a
- CVE-2020-26414An issue has been discovered in GitLab affecting all versions starting from 12.4.GitLab
- CVE-2021-22166An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed methodGitLab
- CVE-2021-22167An issue has been discovered in GitLab affecting all versions starting from 12.1.GitLab
- CVE-2021-22168A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.GitLab
- CVE-2020-35733An issue was discovered in Erlang/OTP before 23.2.2.
- CVE-2019-16961SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.
- CVE-2021-23838An issue was discovered in flatCore before 2.0.0 build 139.
- CVE-2021-23837An issue was discovered in flatCore before 2.0.0 build 139.
- CVE-2021-23836An issue was discovered in flatCore before 2.0.0 build 139.
- CVE-2021-23835An issue was discovered in flatCore before 2.0.0 build 139.
- CVE-2020-35582A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML
- CVE-2020-35581A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML