# CVEs published 2021-01-19

48 CVEs were published on January 19, 2021: 2 critical, 8 high. Days are UTC.

- [CVE-2020-28707](https://cve.now/CVE-2020-28707.md): The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio\_chart\_historical-wp.j (no CVSS)
- [CVE-2020-27269](https://cve.now/CVE-2020-27269.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and A (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2020-27268](https://cve.now/CVE-2020-27268.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDan (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2020-27266](https://cve.now/CVE-2020-27266.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDan (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2020-11997](https://cve.now/CVE-2020-11997.md): Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. (no CVSS, Apache Guacamole)
- [CVE-2020-27264](https://cve.now/CVE-2020-27264.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and A (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2020-27258](https://cve.now/CVE-2020-27258.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the communication protocol (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2020-27256](https://cve.now/CVE-2020-27256.md): In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump a (no CVSS, SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and Any…)
- [CVE-2021-21263](https://cve.now/CVE-2021-21263.md): Query Binding Exploitation in Laravel (CVSS 7.2, laravel framework · laravel/framework +1)
- [CVE-2020-8581](https://cve.now/CVE-2020-8581.md): Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authenticated but unauthorized (no CVSS, Clustered Data ONTAP)
- [CVE-2020-35929](https://cve.now/CVE-2020-35929.md): In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of (no CVSS, Kaspersky TinyCheck)
- [CVE-2021-20190](https://cve.now/CVE-2021-20190.md): A flaw was found in jackson-databind before 2.9.10.7. (CVSS 8.1, jackson-databind · com.fasterxml.jackson.core:jackson-datab…)
- [CVE-2020-27276](https://cve.now/CVE-2020-27276.md): SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i & AnyDana-A mo (no CVSS, SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A)
- [CVE-2020-27272](https://cve.now/CVE-2020-27272.md): SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i,AnyDana-A mobile ap (no CVSS, SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A)
- [CVE-2020-27270](https://cve.now/CVE-2020-27270.md): SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDana-A mobile apps doe (no CVSS, SOOIL Developments CoLtd DiabecareRS,AnyDana-i,AnyDana-A)
- [CVE-2021-3184](https://cve.now/CVE-2021-3184.md): MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global\_menu.ctp user homepage favourite button. (no CVSS)
- [CVE-2021-22498](https://cve.now/CVE-2021-22498.md): XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality Center) product. (no CVSS, Application Lifecycle Management ( Previously known as Qual…)
- [CVE-2020-27733](https://cve.now/CVE-2020-27733.md): Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request. (no CVSS)
- [CVE-2021-25323](https://cve.now/CVE-2021-25323.md): The default setting of MISP 2.4.136 did not enable the requirements (aka require\_password\_confirmation) to provide the previous password whe (no CVSS)
- [CVE-2021-25324](https://cve.now/CVE-2021-25324.md): MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp. (no CVSS)
- [CVE-2021-25325](https://cve.now/CVE-2021-25325.md): MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. (no CVSS)
- [CVE-2020-4881](https://cve.now/CVE-2020-4881.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server hostname verification (CVSS 5.9, IBM Planning Analytics)
- [CVE-2020-4873](https://cve.now/CVE-2020-4873.md): IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. (CVSS 5.3, IBM Planning Analytics)
- [CVE-2020-4871](https://cve.now/CVE-2020-4871.md): IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Planning Analytics)
- [CVE-2021-3183](https://cve.now/CVE-2021-3183.md): Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a removal of a login (no CVSS)
- [CVE-2020-28482](https://cve.now/CVE-2020-28482.md): Cross-site Request Forgery (CSRF) (CVSS 5.9, fastify-csrf)
- [CVE-2020-28479](https://cve.now/CVE-2020-28479.md): Denial of Service (DoS) (CVSS 5.9, jointjs)
- [CVE-2020-28480](https://cve.now/CVE-2020-28480.md): Prototype Pollution (CVSS 7.3, jointjs)
- [CVE-2020-28481](https://cve.now/CVE-2020-28481.md): Insecure Defaults (CVSS 5.3, socket.io)
- [CVE-2021-3182](https://cve.now/CVE-2021-3182.md): D-Link DCS-5220 devices have a buffer overflow. (CVSS 8.0)
- [CVE-2021-3181](https://cve.now/CVE-2021-3181.md): rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with (no CVSS)
- [CVE-2020-23342](https://cve.now/CVE-2020-23342.md): A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users. (no CVSS)
- [CVE-2020-35128](https://cve.now/CVE-2020-35128.md): Mautic before 3.2.4 is affected by stored XSS. (no CVSS, mautic/core)
- [CVE-2020-35129](https://cve.now/CVE-2020-35129.md): Mautic before 3.2.4 is affected by stored XSS. (no CVSS, mautic/core)
- [CVE-2020-20950](https://cve.now/CVE-2020-20950.md): Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. (no CVSS)
- [CVE-2020-23522](https://cve.now/CVE-2020-23522.md): Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data \[Password\] parameter. (no CVSS)
- [CVE-2020-28472](https://cve.now/CVE-2020-28472.md): Prototype Pollution (CVSS 7.3, @aws-sdk/shared-ini-file-loader · aws-sdk)
- [CVE-2020-28478](https://cve.now/CVE-2020-28478.md): Prototype Pollution (CVSS 7.5, gsap)
- [CVE-2020-28477](https://cve.now/CVE-2020-28477.md): Prototype Pollution (CVSS 7.5, immer)
- [CVE-2021-22852](https://cve.now/CVE-2021-22852.md): HGiga OAKloud Portal - SQL injection -2 (CVSS 8.8, HGiga OAKSv20 OAKlouds-mol\_course\_v3 · HGiga OAKSv30 OAKlou…)
- [CVE-2021-22851](https://cve.now/CVE-2021-22851.md): HGiga OAKloud Portal - SQL injection -1 (CVSS 9.8, HGiga OAKSv20 OAKlouds-document\_v3 · HGiga OAKSv30 OAKlouds…)
- [CVE-2021-22850](https://cve.now/CVE-2021-22850.md): HGiga OAKloud Portal - Security Misconfiguration (CVSS 5.3, HGiga OAKSv20 OAKlouds-document\_v3 · HGiga OAKSv30 OAKlouds…)
- [CVE-2021-3178](https://cve.now/CVE-2021-3178.md): fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers (no CVSS)
- [CVE-2021-20619](https://cve.now/CVE-2021-20619.md): Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via (no CVSS, WESEEK GROWI v4.2 Series)
- [CVE-2020-29450](https://cve.now/CVE-2020-29450.md): Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denia (no CVSS, Atlassian Confluence Server)
- [CVE-2020-14409](https://cve.now/CVE-2020-14409.md): SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL\_memcpy heap corruption) in SDL\_BlitCopy in video/SD (no CVSS)
- [CVE-2020-14410](https://cve.now/CVE-2020-14410.md): SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit\_3or4\_to\_3or4\_\_inversed\_rgb in video/SDL\_blit\_N.c via (no CVSS)
- [CVE-2021-3177](https://cve.now/CVE-2021-3177.md): Python 3.x through 3.9.1 has a buffer overflow in PyCArg\_repr in \_ctypes/callproc.c, which may lead to remote code execution in certain Pyth (CVSS 9.8, libpython · python +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.