CVEs published January 27, 2021
43 CVEs were published on January 27, 2021: 0 critical, 2 high.
- Published
- 43
- Critical
- 0
- High
- 2
- Medium
- 15
- Low
- 1
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- IBM Cloud Pak for Security
- 5
- Tellus Lite V-Simulator and V-Server Lite
- 5
- IBM QRadar SIEM
- 3
- Trend Micro ServerProtect for Linux
- 3
- IBM Rational Collaborative Lifecycle Management · IBM Ra… +8
- 2
- IBM Security Guardium
- 2
- Apache Software Foundation Apache ActiveMQ · org.apache.… +1
- 1
- Apache Software Foundation Apache ActiveMQ Artemis · org.ap…
- 1
- codiad/codiad
- 1
- config-shield
- 1
High 2
Medium, low and unrated 41
- CVE-2021-3331WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session
- CVE-2021-26276scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set commaconfig-shield
- CVE-2021-25247A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious Trend Micro HouseCall for Home Networks
- CVE-2021-25226A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cTrend Micro ServerProtect for Linux
- CVE-2021-25224A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cTrend Micro ServerProtect for Linux
- CVE-2021-25225A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can cTrend Micro ServerProtect for Linux
- CVE-2021-22637Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker toTellus Lite V-Simulator and V-Server Lite
- CVE-2021-22655Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a Tellus Lite V-Simulator and V-Server Lite
- CVE-2021-22639An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a speciTellus Lite V-Simulator and V-Server Lite
- CVE-2021-22641A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a sTellus Lite V-Simulator and V-Server Lite
- CVE-2021-22653Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft aTellus Lite V-Simulator and V-Server Lite
- CVE-2021-3325Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts_den
- CVE-2021-26118Flaw in ActiveMQ Artemis OpenWire supportApache Software Foundation Apache ActiveMQ Artemis · org.ap…
- CVE-2020-5428Possibility of SQL Injection in Spring Cloud Task Execution Sorting QuerySpring by VMware Spring Cloud Task · org.springframework.cl…
- CVE-2020-5427Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting QuerySpring by VMware Spring Cloud Data Flow
- CVE-2021-3318attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.
- CVE-2020-4789IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse direIBM QRadar SIEM
- CVE-2020-4787IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (IBM QRadar SIEM
- CVE-2020-4786IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery (IBM QRadar SIEM
- CVE-2020-4189IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system.IBM Security Guardium
- CVE-2021-20357IBM Jazz Foundation products is vulnerable to cross-site scripting.IBM Rational DOORS Next Generation · IBM Rational Qualit… +8
- CVE-2020-4865IBM Jazz Foundation products is vulnerable to cross-site scripting.IBM Engineering Lifecycle Optimization · IBM Rational Rh… +8
- CVE-2020-4855IBM Jazz Foundation products is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management · IBM Ra… +8
- CVE-2020-4547IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim.IBM Engineering Workflow Management · IBM Rational Engin… +8
- CVE-2020-4524IBM Jazz Foundation products is vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management · IBM Ra… +8
- CVE-2021-25311condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory, as demonstrated by c
- CVE-2021-25312HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method.
- CVE-2020-23361phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begi
- CVE-2020-23360oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the che
- CVE-2020-23359WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the iden
- CVE-2020-23356dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password
- CVE-2020-23355** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authenticacodiad/codiad
- CVE-2020-23352Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control.
- CVE-2020-4967IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks aIBM Cloud Pak for Security
- CVE-2020-4820IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting.IBM Cloud Pak for Security
- CVE-2020-4816IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly eIBM Cloud Pak for Security
- CVE-2020-4815IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could beIBM Cloud Pak for Security
- CVE-2020-4628IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technicaIBM Cloud Pak for Security
- CVE-2020-36012Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Custome
- CVE-2021-3272jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between th
- CVE-2021-26117ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindApache Software Foundation Apache ActiveMQ · org.apache.… +1