CVEs published January 21, 2021
72 CVEs were published on January 21, 2021: 0 critical, 3 high.
- Published
- 72
- Critical
- 0
- High
- 3
- Medium
- 9
- Low
- 1
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 29
- IBM Security Identity Governance and Intelligence
- 4
- https://github.com/revive-adserver/revive-adserver
- 3
- feehi/cms
- 2
- IdentityPython pysaml2 · pysaml2
- 2
- Kaspersky TinyCheck
- 2
- OpenMage magento-lts
- 2
- Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- 2
- Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- 2
- Rocket.Chat server
- 2
High 3
- CVE-2020-4958IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user IBM Security Identity Governance and Intelligence
- CVE-2020-26295CMS Editor code executionOpenMage magento-lts
- CVE-2020-26285Widget instances allows a hacker to inject an executable file on the server on OpenMageOpenMage magento-lts
Medium, low and unrated 69
- CVE-2020-36200TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.Kaspersky TinyCheck
- CVE-2020-36199TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several pKaspersky TinyCheck
- CVE-2020-21147RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administ
- CVE-2020-21146Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability.feehi/cms
- CVE-2020-36201An issue was discovered in certain Xerox WorkCentre products.
- CVE-2019-25015LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.
- CVE-2021-22871Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which https://github.com/revive-adserver/revive-adserver
- CVE-2021-22872Revive Adserver before 5.1.0 is vulnerable to a reflected cross-site scripting (XSS) vulnerability via the publicly accessible afr.php delivhttps://github.com/revive-adserver/revive-adserver
- CVE-2021-22873Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delihttps://github.com/revive-adserver/revive-adserver
- CVE-2020-8292Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in messagRocket.Chat server
- CVE-2020-8288The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `valuRocket.Chat server
- CVE-2021-21723Some ZTE products have a DoS vulnerability.<ZXR10 9904, ZXR10 9908, ZXR10 9916, ZXR10 9904-S, ZXR10 99…
- CVE-2020-8570Kubernetes Java client libraries unvalidated path traversal in Copy implementationKubernetes Java Client · io.kubernetes:client-java
- CVE-2020-8569Kubernetes CSI snapshot-controller DoSKubernetes CSI Snapshotter · github.com/kubernetes-csi/e… +1
- CVE-2020-8568Kubernetes Secrets Store CSI Driver sync/rotate directory traversalKubernetes Secrets Store CSI Driver · sigs.k8s.io/secrets-s…
- CVE-2020-8567Kubernetes Secrets Store CSI Driver plugin directory traversalsKubernetes Secrets Store CSI Driver · github.com/hashico… +2
- CVE-2020-8554Kubernetes man in the middle using LoadBalancer or ExternalIPsKubernetes · k8s.io/kubernetes
- CVE-2020-22643Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution.feehi/cms
- CVE-2021-3152Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrat
- CVE-2020-28874reset-password.php in ProjectSend before r1295 allows remote attackers to reset a password because of incorrect business logic.
- CVE-2020-35309Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbit
- CVE-2020-29241Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web s
- CVE-2020-26941A local (authenticated) low-privileged user can exploit a behavior in an ESET installer to achieve arbitrary file overwrite (deletion) of an
- CVE-2021-21253Use of a One-Way Hash without a Salt in OnlineVotingSystemdbijaya OnlineVotingSystem
- CVE-2021-21238SAML XML Signature wrappingIdentityPython pysaml2 · pysaml2
- CVE-2021-21239Open default xmlsec1 key-type preferenceIdentityPython pysaml2 · pysaml2
- CVE-2020-4969IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failureIBM Security Identity Governance and Intelligence
- CVE-2020-4968IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to dIBM Security Identity Governance and Intelligence
- CVE-2020-4966IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies.IBM Security Identity Governance and Intelligence
- CVE-2020-3691Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3686Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array without checking the lengQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-3687Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.
- CVE-2020-3685Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdragon Auto, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11217A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdragon Compute, SnapdragoQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2020-11225Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11216Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto, Snapdragon Compute, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11214Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it as more number of immQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11215An out of bounds read can happen when processing VSA attribute due to improper minimum required length check in Snapdragon Auto, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11213Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in Snapdragon Auto, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11200Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11212Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Auto, Snapdragon CompuQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11197Possible integer overflow can occur when stream info update is called when total number of streams detected are zero while parsing TS clip wQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11183A process can potentially cause a buffer overflow in the display service allowing privilege escalation by executing code as that service in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2020-11185Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data received from firmware in Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2020-11181Out of bound access issue while handling cvp process control command due to improper validation of buffer pointer received from HLOS in SnapQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2020-11179Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11180Out of bound access in computer vision control due to improper validation of command length before processing it in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11152Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects inQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11167Memory corruption while calculating L2CAP packet length in reassembly logic when remote sends more data than expected in Snapdragon Auto, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11151Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11149Out of bound access due to usage of an out-of-range pointer offset in the camera driver.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11150Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of poinQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11148Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11145Divide by zero issue can happen while updating delta extension header due to improper validation of master SN and extension header SN in SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11146Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11144Buffer over-read while UE process invalid DL ROHC packet for decompression due to lack of check of size of compresses packet in Snapdragon AQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11140Out of bound memory access during music playback with ALAC modified content due to improper validation in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11143Out of bound memory access during music playback with modified content due to copying data without checking destination buffer size in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11139Out of bound memory access while processing frames due to lack of check of invalid frames received in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11137Integer multiplication overflow resulting in lower buffer size allocation than expected causes memory access out of bounds resulting in possQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11138Uninitialized pointers accessed during music play back with incorrect bit stream due to an uninitialized heap memory result in instability iQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11119Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11136Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-3195bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpw
- CVE-2021-3190The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tasync-git
- CVE-2021-3188phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.
- CVE-2021-3164ChurchRota 2.6.4 is vulnerable to authenticated remote code execution.
- CVE-2020-27221In Eclipse OpenJ9 up to and including version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natThe Eclipse Foundation Eclipse OpenJ9
- CVE-2020-27583IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote unauthenticated attacker