# CVEs published 2021-01-25

39 CVEs were published on January 25, 2021: 1 critical, 1 high. Days are UTC.

- [CVE-2021-21275](https://cve.now/CVE-2021-21275.md): CSRF in MediaWiki Report extension (CVSS 5.3, Kenny2github Report)
- [CVE-2020-27542](https://cve.now/CVE-2020-27542.md): Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. (no CVSS)
- [CVE-2020-27541](https://cve.now/CVE-2020-27541.md): Denial of Service vulnerability in Rostelecom CS-C2SHW 5.0.082.1. (no CVSS)
- [CVE-2020-27539](https://cve.now/CVE-2020-27539.md): Heap overflow with full parsing of HTTP respose in Rostelecom CS-C2SHW 5.0.082.1. (no CVSS)
- [CVE-2020-27540](https://cve.now/CVE-2020-27540.md): Bash injection vulnerability and bypass of signature verification in Rostelecom CS-C2SHW 5.0.082.1. (no CVSS)
- [CVE-2020-35845](https://cve.now/CVE-2020-35845.md): FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x96cf. (no CVSS)
- [CVE-2020-35844](https://cve.now/CVE-2020-35844.md): FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0xbe9c4. (no CVSS)
- [CVE-2020-35843](https://cve.now/CVE-2020-35843.md): FastStone Image Viewer 7.5 has an out-of-bounds write (via a crafted image file) at FSViewer.exe+0x956e. (no CVSS)
- [CVE-2020-16236](https://cve.now/CVE-2020-16236.md): anasonic FPWIN Pro (no CVSS, Panasonic FPWIN Pro)
- [CVE-2020-6780](https://cve.now/CVE-2020-6780.md): Password Hash With Insufficient Computational Effort in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server (CVSS 4.4, Bosch FSM-2500 · Bosch FSM-5000)
- [CVE-2020-6779](https://cve.now/CVE-2020-6779.md): Hard-coded Credentials in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server (CVSS 10.0, Bosch FSM-2500 · Bosch FSM-5000)
- [CVE-2020-27814](https://cve.now/CVE-2020-27814.md): A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. (no CVSS, openjpeg)
- [CVE-2021-21272](https://cve.now/CVE-2021-21272.md): zip slip in ORAS (CVSS 7.7, deislabs oras · github.com/deislabs/oras)
- [CVE-2020-25737](https://cve.now/CVE-2020-25737.md): An elevation of privilege vulnerability exists in Hackolade versions prior 4.2.0 on Windows has an issue in specific deployment scenarios th (no CVSS)
- [CVE-2021-22698](https://cve.now/CVE-2021-22698.md): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 a (no CVSS, EcoStruxure Power Build - Rapsody software V2.1.13 and prio…)
- [CVE-2021-22697](https://cve.now/CVE-2021-22697.md): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 a (no CVSS, EcoStruxure Power Build - Rapsody software V2.1.13 and prio…)
- [CVE-2020-28221](https://cve.now/CVE-2020-28221.md): A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (version details in the (no CVSS, EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A a…)
- [CVE-2020-0236](https://cve.now/CVE-2020-0236.md): In A2DP\_GetCodecType of a2dp\_codec\_config, there is a possible out-of-bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2021-3185](https://cve.now/CVE-2021-3185.md): A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an attacker could cause (no CVSS, gstreamer)
- [CVE-2020-35513](https://cve.now/CVE-2020-35513.md): A flaw incorrect umask during file or directory modification in the Linux kernel NFS (network file system) functionality was found in the wa (no CVSS, kernel)
- [CVE-2021-3278](https://cve.now/CVE-2021-3278.md): Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . (no CVSS)
- [CVE-2020-35854](https://cve.now/CVE-2020-35854.md): Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter. (no CVSS)
- [CVE-2020-35853](https://cve.now/CVE-2020-35853.md): 4images Image Gallery Management System 1.7.11 is affected by cross-site scripting (XSS) in the Image URL. (no CVSS)
- [CVE-2020-35270](https://cve.now/CVE-2020-35270.md): Student Result Management System In PHP With Source Code is affected by SQL injection. (no CVSS)
- [CVE-2020-36221](https://cve.now/CVE-2020-36221.md): An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, result (no CVSS, openldap)
- [CVE-2020-36222](https://cve.now/CVE-2020-36222.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial (no CVSS, openldap)
- [CVE-2020-36224](https://cve.now/CVE-2020-36224.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting (no CVSS, openldap)
- [CVE-2020-36225](https://cve.now/CVE-2020-36225.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial (no CVSS, openldap)
- [CVE-2020-36226](https://cve.now/CVE-2020-36226.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch-\>bv\_len miscalculation and slapd crash in the saslAuthzTo processing, res (no CVSS, openldap)
- [CVE-2020-36228](https://cve.now/CVE-2020-36228.md): An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, r (no CVSS, openldap)
- [CVE-2020-36229](https://cve.now/CVE-2020-36229.md): A flaw was discovered in ldap\_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad\_keystring, resultin (no CVSS, openldap)
- [CVE-2020-36230](https://cve.now/CVE-2020-36230.md): A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber\_next\_elemen (no CVSS, openldap)
- [CVE-2020-36227](https://cve.now/CVE-2020-36227.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel\_extop Cancel operation, resulting in de (no CVSS, openldap)
- [CVE-2020-36223](https://cve.now/CVE-2020-36223.md): A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial o (no CVSS, openldap)
- [CVE-2020-17532](https://cve.now/CVE-2020-17532.md): Apache ServiceComb Yaml remote deserialization vulnerability (no CVSS, Apache Software Foundation Apache ServiceComb-Java-Chassis…)
- [CVE-2021-23901](https://cve.now/CVE-2021-23901.md): An XML external entity (XXE) injection vulnerability exists in the Nutch DmozParser (no CVSS, Apache Software Foundation Apache Nutch · org.apache.nutch:…)
- [CVE-2021-26025](https://cve.now/CVE-2021-26025.md): PlugIns\\IDE\_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE\_ACDStd!zlibVersion+0x000 (no CVSS)
- [CVE-2021-26026](https://cve.now/CVE-2021-26026.md): PlugIns\\IDE\_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE\_ACDStd!JPEGTransW+0x0000 (no CVSS)
- [CVE-2020-35576](https://cve.now/CVE-2020-35576.md): A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticate (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.