# CVEs published 2021-01-22 54 CVEs were published on January 22, 2021: 1 critical, 7 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2020-23014](https://cve.now/CVE-2020-23014.md): APfell 1.4 is vulnerable to authenticated reflected cross-site scripting (XSS) in /apiui/command\_ through the payloadtypes\_callback function (no CVSS) - [CVE-2020-27098](https://cve.now/CVE-2020-27098.md): In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access contacts due to a permissions bypass. (no CVSS, Android) - [CVE-2020-27097](https://cve.now/CVE-2020-27097.md): In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass. (no CVSS, Android) - [CVE-2020-23826](https://cve.now/CVE-2020-23826.md): The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. (no CVSS) - [CVE-2020-12525](https://cve.now/CVE-2020-12525.md): WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component (CVSS 7.3, M&M Software fdtCONTAINER Component · M&M Software fdtCO… +3) - [CVE-2020-12514](https://cve.now/CVE-2020-12514.md): Pepper+Fuchs Comtrol IO-Link Master NULL Pointer Dereference (CVSS 6.6, Pepper+Fuchs Comtrol IO-Link Master) - [CVE-2020-12513](https://cve.now/CVE-2020-12513.md): Pepper+Fuchs Comtrol IO-Link Master OS Command Injection (CVSS 7.5, Pepper+Fuchs Comtrol IO-Link Master) - [CVE-2020-12512](https://cve.now/CVE-2020-12512.md): Pepper+Fuchs Comtrol IO-Link Master Cross-Site Scripting (CVSS 7.5, Pepper+Fuchs Comtrol IO-Link Master) - [CVE-2020-12511](https://cve.now/CVE-2020-12511.md): Pepper+Fuchs Comtrol IO-Link Master Cross-Site Request Forgery (CVSS 8.8, Pepper+Fuchs Comtrol IO-Link Master) - [CVE-2020-20269](https://cve.now/CVE-2020-20269.md): A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22. (no CVSS) - [CVE-2021-21270](https://cve.now/CVE-2021-21270.md): Cleartext Storage of Sensitive Information (CVSS 6.2, OctopusDeploy OctopusDSC) - [CVE-2021-21260](https://cve.now/CVE-2021-21260.md): XSS in description field (CVSS 7.6, bigprof-software online-invoicing-system) - [CVE-2020-28487](https://cve.now/CVE-2020-28487.md): Cross-site Scripting (XSS) (CVSS 6.8, vis-timeline) - [CVE-2021-21259](https://cve.now/CVE-2021-21259.md): Stored XSS in slide mode (CVSS 7.4, hedgedoc) - [CVE-2021-3271](https://cve.now/CVE-2021-3271.md): PressBooks 5.17.3 contains a cross-site scripting (XSS). (no CVSS, pressbooks/pressbooks) - [CVE-2020-4766](https://cve.now/CVE-2020-4766.md): IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ data requests which wou (CVSS 5.9, IBM MQ Internet Pass-Thru) - [CVE-2020-23262](https://cve.now/CVE-2020-23262.md): An issue was discovered in ming-soft MCMS v5.0, where a malicious user can exploit SQL injection without logging in through /mcms/view.do. (no CVSS, net.mingsoft:ms-mcms) - [CVE-2020-23162](https://cve.now/CVE-2020-23162.md): Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to re (no CVSS) - [CVE-2020-23161](https://cve.now/CVE-2020-23161.md): Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories (no CVSS) - [CVE-2020-23160](https://cve.now/CVE-2020-23160.md): Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands (no CVSS) - [CVE-2020-36202](https://cve.now/CVE-2020-36202.md): An issue was discovered in the async-h1 crate before 2.3.0 for Rust. (no CVSS, async-h1) - [CVE-2020-36203](https://cve.now/CVE-2020-36203.md): An issue was discovered in the reffers crate through 2020-12-01 for Rust. (no CVSS, reffers) - [CVE-2020-36204](https://cve.now/CVE-2020-36204.md): An issue was discovered in the im crate through 2020-11-09 for Rust. (no CVSS, im) - [CVE-2020-36205](https://cve.now/CVE-2020-36205.md): An issue was discovered in the xcb crate through 2020-12-10 for Rust. (no CVSS, xcb) - [CVE-2020-36206](https://cve.now/CVE-2020-36206.md): An issue was discovered in the rusb crate before 0.7.0 for Rust. (no CVSS, rusb) - [CVE-2020-36207](https://cve.now/CVE-2020-36207.md): An issue was discovered in the aovec crate through 2020-12-10 for Rust. (no CVSS, aovec) - [CVE-2020-36208](https://cve.now/CVE-2020-36208.md): An issue was discovered in the conquer-once crate before 0.3.2 for Rust. (no CVSS, conquer-once) - [CVE-2020-36209](https://cve.now/CVE-2020-36209.md): An issue was discovered in the late-static crate before 0.4.0 for Rust. (no CVSS, late-static) - [CVE-2020-36210](https://cve.now/CVE-2020-36210.md): An issue was discovered in the autorand crate before 0.2.3 for Rust. (no CVSS, autorand) - [CVE-2020-36211](https://cve.now/CVE-2020-36211.md): An issue was discovered in the gfwx crate before 0.3.0 for Rust. (no CVSS, gfwx) - [CVE-2020-36212](https://cve.now/CVE-2020-36212.md): An issue was discovered in the abi\_stable crate before 0.9.1 for Rust. (no CVSS, abi\_stable) - [CVE-2020-36213](https://cve.now/CVE-2020-36213.md): An issue was discovered in the abi\_stable crate before 0.9.1 for Rust. (no CVSS, abi\_stable) - [CVE-2020-36214](https://cve.now/CVE-2020-36214.md): An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. (no CVSS, multiqueue2) - [CVE-2020-36215](https://cve.now/CVE-2020-36215.md): An issue was discovered in the hashconsing crate before 1.1.0 for Rust. (no CVSS, hashconsing) - [CVE-2020-36216](https://cve.now/CVE-2020-36216.md): An issue was discovered in Input\ in the eventio crate before 0.5.1 for Rust. (no CVSS, eventio) - [CVE-2020-36217](https://cve.now/CVE-2020-36217.md): An issue was discovered in the may\_queue crate through 2020-11-10 for Rust. (no CVSS, may\_queue) - [CVE-2020-36218](https://cve.now/CVE-2020-36218.md): An issue was discovered in the buttplug crate before 1.0.4 for Rust. (no CVSS, buttplug) - [CVE-2020-36219](https://cve.now/CVE-2020-36219.md): An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. (no CVSS, atomic-option) - [CVE-2020-36220](https://cve.now/CVE-2020-36220.md): An issue was discovered in the va-ts crate before 0.0.4 for Rust. (no CVSS, va-ts) - [CVE-2021-25900](https://cve.now/CVE-2021-25900.md): An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. (no CVSS, smallvec) - [CVE-2021-25901](https://cve.now/CVE-2021-25901.md): An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. (no CVSS, lazy-init) - [CVE-2021-25902](https://cve.now/CVE-2021-25902.md): An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. (no CVSS, glsl-layout) - [CVE-2021-25903](https://cve.now/CVE-2021-25903.md): An issue was discovered in the cache crate through 2021-01-01 for Rust. (no CVSS, cache) - [CVE-2021-25904](https://cve.now/CVE-2021-25904.md): An issue was discovered in the av-data crate before 0.3.0 for Rust. (no CVSS, av-data) - [CVE-2021-25905](https://cve.now/CVE-2021-25905.md): An issue was discovered in the bra crate before 0.1.1 for Rust. (no CVSS, bra) - [CVE-2021-25906](https://cve.now/CVE-2021-25906.md): An issue was discovered in the basic\_dsp\_matrix crate before 0.9.2 for Rust. (no CVSS, basic\_dsp\_matrix) - [CVE-2021-25907](https://cve.now/CVE-2021-25907.md): An issue was discovered in the containers crate before 0.9.11 for Rust. (no CVSS, containers) - [CVE-2021-25908](https://cve.now/CVE-2021-25908.md): An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. (no CVSS, fil-ocl) - [CVE-2021-22849](https://cve.now/CVE-2021-22849.md): Hyweb HyCMS-J1 - Stored XSS (CVSS 4.6, Hyweb HyCMS-J1) - [CVE-2021-22847](https://cve.now/CVE-2021-22847.md): Hyweb HyCMS-J1 - SQL Injection (CVSS 8.8, Hyweb HyCMS-J1) - [CVE-2020-29443](https://cve.now/CVE-2020-29443.md): ide\_atapi\_cmd\_reply\_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated. (no CVSS) - [CVE-2021-3193](https://cve.now/CVE-2021-3193.md): Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7, allows an unauthen (no CVSS) - [CVE-2020-35753](https://cve.now/CVE-2020-35753.md): The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20 (no CVSS) - [CVE-2021-3199](https://cve.now/CVE-2021-3199.md): Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. (CVSS 9.8, KEV) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-01-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.