# CVEs published 2021-01-15

52 CVEs were published on January 15, 2021: 8 critical, 15 high. Days are UTC.

- [CVE-2020-25533](https://cve.now/CVE-2020-25533.md): An issue was discovered in Malwarebytes before 4.0 on macOS. (no CVSS)
- [CVE-2021-3162](https://cve.now/CVE-2021-3162.md): Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation. (no CVSS)
- [CVE-2021-21245](https://cve.now/CVE-2021-21245.md): Pre-Auth Arbitrary File Upload (CVSS 10.0, theonedev onedev)
- [CVE-2021-21246](https://cve.now/CVE-2021-21246.md): Pre-Auth Access token leak (CVSS 8.6, theonedev onedev)
- [CVE-2021-21247](https://cve.now/CVE-2021-21247.md): Post-Auth Unsafe Deserialization on BasePage (AJAX) (CVSS 9.6, theonedev onedev)
- [CVE-2021-21249](https://cve.now/CVE-2021-21249.md): Post-Auth Unsafe Yaml deserialization (CVSS 9.6, theonedev onedev)
- [CVE-2021-21248](https://cve.now/CVE-2021-21248.md): Post-Auth Arbitrary Code execution via Groovy script injection (CVSS 9.6, theonedev onedev)
- [CVE-2021-21250](https://cve.now/CVE-2021-21250.md): Post-Auth External Entity Expansion (XXE) (CVSS 7.7, theonedev onedev)
- [CVE-2021-21251](https://cve.now/CVE-2021-21251.md): ZipSlip Arbitrary File Upload (CVSS 7.7, theonedev onedev)
- [CVE-2021-21242](https://cve.now/CVE-2021-21242.md): Pre-Auth Unsafe Deserialization on AttachmentUploadServet (CVSS 10.0, theonedev onedev)
- [CVE-2021-21243](https://cve.now/CVE-2021-21243.md): Pre-Auth Unsafe Deserialization on KubernetesResource (CVSS 10.0, theonedev onedev)
- [CVE-2021-21244](https://cve.now/CVE-2021-21244.md): Pre-Auth SSTI via Bean validation message tampering (CVSS 10.0, theonedev onedev)
- [CVE-2020-24640](https://cve.now/CVE-2020-24640.md): There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment (no CVSS, Aruba AirWave Glass Software)
- [CVE-2020-24639](https://cve.now/CVE-2020-24639.md): There is a vulnerability caused by unsafe Java deserialization that allows for arbitrary command execution in a containerized environment wi (no CVSS, Aruba AirWave Glass Software)
- [CVE-2020-24638](https://cve.now/CVE-2020-24638.md): Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. (no CVSS, Aruba AirWave Glass Software)
- [CVE-2020-24641](https://cve.now/CVE-2020-24641.md): In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if succes (no CVSS, Aruba AirWave Glass Software)
- [CVE-2021-21237](https://cve.now/CVE-2021-21237.md): Git LFS can execute a Git binary from the current directory on Windows (CVSS 7.2, git-lfs · github.com/git-lfs/git-lfs)
- [CVE-2021-0223](https://cve.now/CVE-2021-0223.md): Junos OS: telnetd.real Local Privilege Escalation vulnerabilities in SUID binaries (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2021-0222](https://cve.now/CVE-2021-0222.md): Junos OS: Upon receipt of certain protocol packets with invalid payloads a self-propagating Denial of Service may occur. (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2021-0221](https://cve.now/CVE-2021-0221.md): Junos OS: QFX Series: Traffic loop Denial of Service (DoS) upon receipt of specific IP multicast traffic (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0220](https://cve.now/CVE-2021-0220.md): Junos Space: Shared secrets stored in recoverable format and directly exposed through the UI (CVSS 6.8, Juniper Networks Junos Space)
- [CVE-2021-0219](https://cve.now/CVE-2021-0219.md): Junos OS: Command injection vulnerability in 'request system software' CLI command (CVSS 6.7, Juniper Networks Junos OS)
- [CVE-2021-0218](https://cve.now/CVE-2021-0218.md): Junos OS: Command injection vulnerability in license-check daemon (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2021-0217](https://cve.now/CVE-2021-0217.md): Junos OS: EX Series and QFX Series: Memory leak issue processing specific DHCP packets (CVSS 7.4, Juniper Networks Junos OS)
- [CVE-2021-0215](https://cve.now/CVE-2021-0215.md): Junos OS: EX Series, QFX Series, SRX Branch Series, MX Series: Memory leak in packet forwarding engine due to 802.1X authenticator port interface flaps (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0212](https://cve.now/CVE-2021-0212.md): Contrail Networking: Administrator credentials are exposed in a plaintext file (CVSS 5.0, Juniper Networks Contrail Networking)
- [CVE-2021-0211](https://cve.now/CVE-2021-0211.md): Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. (CVSS 10.0, Juniper Networks Junos OS)
- [CVE-2021-0210](https://cve.now/CVE-2021-0210.md): Junos OS: Privilege escalation in J-Web due to arbitrary command and code execution via information disclosure from another users active session (CVSS 6.8, Juniper Networks Junos OS)
- [CVE-2021-0209](https://cve.now/CVE-2021-0209.md): Junos OS Evolved: Receipt of certain valid BGP update packets from BGP peers may cause RPD to core when using REGEX. (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2021-0208](https://cve.now/CVE-2021-0208.md): Junos OS and Junos OS Evolved: In bidirectional LSP configurations, on MPLS egress router RPD may core upon receipt of specific malformed RSVP packet. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2021-0207](https://cve.now/CVE-2021-0207.md): NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0206](https://cve.now/CVE-2021-0206.md): Junos OS: NFX Series, SRX Series: PFE may crash upon receipt of specific packet when SSL Proxy is configured. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0205](https://cve.now/CVE-2021-0205.md): Junos OS: MX Series: Dynamic filter fails to match IPv6 prefix (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2021-0204](https://cve.now/CVE-2021-0204.md): Junos OS: dexp Local Privilege Escalation vulnerabilities in SUID binaries (CVSS 7.8, Juniper Networks Junos OS)
- [CVE-2021-0203](https://cve.now/CVE-2021-0203.md): Junos OS: EX and QFX5K Series: Storm Control does not work as expected when Redundant Trunk Group is configured (CVSS 8.6, Juniper Networks Junos OS)
- [CVE-2021-0202](https://cve.now/CVE-2021-0202.md): Junos OS: MX Series, EX9200 Series: Trio-based MPC memory leak when Integrated Routing and Bridging (IRB) interface is mapped to a VPLS instance or a Bridge-Domain (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2020-16255](https://cve.now/CVE-2020-16255.md): ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.' (no CVSS)
- [CVE-2020-35749](https://cve.now/CVE-2020-35749.md): Directory traversal vulnerability in class-simple\_job\_board\_resume\_download\_handler.php in the Simple Board Job plugin 2.9.3 and earlier for (no CVSS)
- [CVE-2020-35748](https://cve.now/CVE-2020-35748.md): Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress a (no CVSS)
- [CVE-2020-26414](https://cve.now/CVE-2020-26414.md): An issue has been discovered in GitLab affecting all versions starting from 12.4. (CVSS 4.3, GitLab)
- [CVE-2021-22166](https://cve.now/CVE-2021-22166.md): An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method (CVSS 5.3, GitLab)
- [CVE-2021-22167](https://cve.now/CVE-2021-22167.md): An issue has been discovered in GitLab affecting all versions starting from 12.1. (CVSS 5.3, GitLab)
- [CVE-2021-22171](https://cve.now/CVE-2021-22171.md): Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if th (CVSS 7.3, GitLab)
- [CVE-2021-22168](https://cve.now/CVE-2021-22168.md): A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8. (CVSS 4.3, GitLab)
- [CVE-2020-35733](https://cve.now/CVE-2020-35733.md): An issue was discovered in Erlang/OTP before 23.2.2. (no CVSS)
- [CVE-2019-16961](https://cve.now/CVE-2019-16961.md): SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name. (no CVSS)
- [CVE-2021-23838](https://cve.now/CVE-2021-23838.md): An issue was discovered in flatCore before 2.0.0 build 139. (no CVSS)
- [CVE-2021-23837](https://cve.now/CVE-2021-23837.md): An issue was discovered in flatCore before 2.0.0 build 139. (no CVSS)
- [CVE-2021-23836](https://cve.now/CVE-2021-23836.md): An issue was discovered in flatCore before 2.0.0 build 139. (no CVSS)
- [CVE-2021-23835](https://cve.now/CVE-2021-23835.md): An issue was discovered in flatCore before 2.0.0 build 139. (no CVSS)
- [CVE-2020-35582](https://cve.now/CVE-2020-35582.md): A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML (no CVSS)
- [CVE-2020-35581](https://cve.now/CVE-2020-35581.md): A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.