CVEs published January 26, 2021
53 CVEs were published on January 26, 2021: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 0
- High
- 5
- Medium
- 5
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- OPC UA Tunneller
- 4
- Nextcloud Server
- 2
- NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- 2
- Reolink RLC-4XX series · Reolink RLC-5XX series +1
- 2
- TPEditor
- 2
- Apache Hadoop · org.apache.hadoop:hadoop-common
- 1
- Apache Traffic Control · github.com/apache/trafficcontrol
- 1
- ckeditor4
- 1
- ckeditor4-dev
- 1
- DIYgod RSSHub · rsshub
- 1
High 5
- CVE-2021-1070NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- CVE-2021-21278Risk of code injection in RSSHubDIYgod RSSHub · rsshub
- CVE-2020-13582A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00.Micrium
- CVE-2020-4949IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML dIBM WebSphere Application Server
- CVE-2021-3156Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root
Medium, low and unrated 48
- CVE-2013-2512The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command arguftpd
- CVE-2021-3165SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
- CVE-2021-3317KLog Server through 2.4.1 allows authenticated command injection.
- CVE-2021-1071NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2…
- CVE-2020-23776A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on.
- CVE-2020-23774A reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause JavaScript code to be executed.
- CVE-2021-21271Denial of service in TenderMint Coretendermint · github.com/tendermint/tendermint
- CVE-2021-21283XSS in Flarum Sticky extension.flarum sticky · flarum/sticky
- CVE-2021-26272It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the ckeditor4
- CVE-2021-26271It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles inckeditor4-dev
- CVE-2021-3309packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Aut
- CVE-2021-3308An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x.
- CVE-2021-22159Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management (formerly ObserveI
- CVE-2020-27295The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition on theOPC UA Tunneller
- CVE-2020-27297The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values OPC UA Tunneller
- CVE-2020-27299The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information oOPC UA Tunneller
- CVE-2020-27274Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to closOPC UA Tunneller
- CVE-2021-23272TIBCO BPM Cross Site Scripting (XSS)TIBCO Software TIBCO BPM Enterprise
- CVE-2020-35263EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbitrary code execution
- CVE-2020-23449newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java.
- CVE-2020-23448newbee-mall all versions are affected by incorrect access control to remotely gain privileges through AdminLoginInterceptor.java.
- CVE-2020-23447newbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle.
- CVE-2020-8295A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.Nextcloud Server
- CVE-2020-8293A missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to store unlimited data in workflow rules causingNextcloud Server
- CVE-2020-4889IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development eIBM Spectrum Scale
- CVE-2020-9492In Apache Hadoop 3.2.0 to 3.2.1, 3.0.0-alpha1 to 3.1.3, and 2.0.0-alpha to 2.10.0, WebHDFS client might send SPNEGO authorization header to Apache Hadoop · org.apache.hadoop:hadoop-common
- CVE-2020-27284TPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it processes project files, allowing an attacker toTPEditor
- CVE-2020-27280A use after free issue has been identified in the way ISPSoft(v3.12 and prior) processes project files, allowing an attacker to craft a specISPSoft
- CVE-2020-27288An untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior) processes project files, allowing an attacker to cTPEditor
- CVE-2020-25169Reolink P2P CamerasReolink RLC-4XX series · Reolink RLC-5XX series +1
- CVE-2020-25173Reolink P2P CamerasReolink RLC-4XX series · Reolink RLC-5XX series +1
- CVE-2020-17522When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files includeApache Traffic Control · github.com/apache/trafficcontrol
- CVE-2021-21615Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-cJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-3297On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.
- CVE-2021-25864node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fnode-red-contrib-huemagic
- CVE-2021-25863Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account.
- CVE-2020-36011A cross-site scripting (XSS) issue in Add Patient Form in QDOCS Smart Hospital Management System 3.1 allows a remote attacker to inject arbi
- CVE-2021-3291Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and zencart/zencart
- CVE-2021-3304Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.
- CVE-2021-3223Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.node-red-dashboard
- CVE-2021-26266cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578).
- CVE-2021-26267cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579).
- CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the loweststdlib
- CVE-2021-3115Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" ctoolchain
- CVE-2020-29001An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW0
- CVE-2020-29000An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices.
- CVE-2020-28999An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices.
- CVE-2020-28998An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices.