CVEs published January 19, 2021
48 CVEs were published on January 19, 2021: 2 critical, 8 high.
- Published
- 48
- Critical
- 2
- High
- 8
- Medium
- 7
- Low
- 0
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- 6
- IBM Planning Analytics
- 3
- SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
- 3
- HGiga OAKSv20 OAKlouds-document_v3 · HGiga OAKSv30 OAKlouds…
- 2
- jointjs
- 2
- mautic/core
- 2
- @aws-sdk/shared-ini-file-loader · aws-sdk
- 1
- Apache Guacamole
- 1
- Application Lifecycle Management ( Previously known as Qual…
- 1
- Atlassian Confluence Server
- 1
Critical 2
High 8
- CVE-2021-21263Query Binding Exploitation in Laravellaravel framework · laravel/framework +1
- CVE-2021-20190A flaw was found in jackson-databind before 2.9.10.7.jackson-databind · com.fasterxml.jackson.core:jackson-datab…
- CVE-2020-28480Prototype Pollutionjointjs
- CVE-2021-3182D-Link DCS-5220 devices have a buffer overflow.
- CVE-2020-28472Prototype Pollution@aws-sdk/shared-ini-file-loader · aws-sdk
- CVE-2020-28478Prototype Pollutiongsap
- CVE-2020-28477Prototype Pollutionimmer
- CVE-2021-22852HGiga OAKloud Portal - SQL injection -2HGiga OAKSv20 OAKlouds-mol_course_v3 · HGiga OAKSv30 OAKlou…
Medium, low and unrated 38
- CVE-2020-28707The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.j
- CVE-2020-27269In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and ASOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-27268In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDanSOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-27266In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDanSOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-11997Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility.Apache Guacamole
- CVE-2020-27264In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and ASOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-27258In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-27256In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump aSOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…
- CVE-2020-8581Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorizedClustered Data ONTAP
- CVE-2020-35929In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part ofKaspersky TinyCheck
- CVE-2020-27276SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A moSOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
- CVE-2020-27272SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile apSOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
- CVE-2020-27270SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doeSOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A
- CVE-2021-3184MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.
- CVE-2021-22498XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product.Application Lifecycle Management ( Previously known as Qual…
- CVE-2020-27733Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.
- CVE-2021-25323The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the previous password whe
- CVE-2021-25324MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
- CVE-2021-25325MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp.
- CVE-2020-4881IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verificationIBM Planning Analytics
- CVE-2020-4873IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy.IBM Planning Analytics
- CVE-2020-4871IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system.IBM Planning Analytics
- CVE-2021-3183Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login
- CVE-2020-28482Cross-site Request Forgery (CSRF)fastify-csrf
- CVE-2020-28479Denial of Service (DoS)jointjs
- CVE-2020-28481Insecure Defaultssocket.io
- CVE-2021-3181rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with
- CVE-2020-23342A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.
- CVE-2020-35128Mautic before 3.2.4 is affected by stored XSS.mautic/core
- CVE-2020-35129Mautic before 3.2.4 is affected by stored XSS.mautic/core
- CVE-2020-20950Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26.
- CVE-2020-23522Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.
- CVE-2021-22850HGiga OAKloud Portal - Security MisconfigurationHGiga OAKSv20 OAKlouds-document_v3 · HGiga OAKSv30 OAKlouds…
- CVE-2021-3178fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers
- CVE-2021-20619Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script viaWESEEK GROWI v4.2 Series
- CVE-2020-29450Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a DeniaAtlassian Confluence Server
- CVE-2020-14409SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_BlitCopy in video/SD
- CVE-2020-14410SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in video/SDL_blit_N.c via