# CVEs published 2021-01-27

43 CVEs were published on January 27, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-3331](https://cve.now/CVE-2021-3331.md): WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session (no CVSS)
- [CVE-2021-26276](https://cve.now/CVE-2021-26276.md): scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set comma (no CVSS, config-shield)
- [CVE-2021-25247](https://cve.now/CVE-2021-25247.md): A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious (no CVSS, Trend Micro HouseCall for Home Networks)
- [CVE-2021-25226](https://cve.now/CVE-2021-25226.md): A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can c (no CVSS, Trend Micro ServerProtect for Linux)
- [CVE-2021-25224](https://cve.now/CVE-2021-25224.md): A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can c (no CVSS, Trend Micro ServerProtect for Linux)
- [CVE-2021-25225](https://cve.now/CVE-2021-25225.md): A memory exhaustion vulnerability in Trend Micro ServerProtect for Linux 3.0 could allow a local attacker to craft specific files that can c (no CVSS, Trend Micro ServerProtect for Linux)
- [CVE-2021-22637](https://cve.now/CVE-2021-22637.md): Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to (no CVSS, Tellus Lite V-Simulator and V-Server Lite)
- [CVE-2021-22655](https://cve.now/CVE-2021-22655.md): Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a (no CVSS, Tellus Lite V-Simulator and V-Server Lite)
- [CVE-2021-22639](https://cve.now/CVE-2021-22639.md): An uninitialized pointer issue has been identified in the way the application processes project files, allowing an attacker to craft a speci (no CVSS, Tellus Lite V-Simulator and V-Server Lite)
- [CVE-2021-22641](https://cve.now/CVE-2021-22641.md): A heap-based buffer overflow issue has been identified in the way the application processes project files, allowing an attacker to craft a s (no CVSS, Tellus Lite V-Simulator and V-Server Lite)
- [CVE-2021-22653](https://cve.now/CVE-2021-22653.md): Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a (no CVSS, Tellus Lite V-Simulator and V-Server Lite)
- [CVE-2021-3325](https://cve.now/CVE-2021-3325.md): Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation without a hosts\_den (no CVSS)
- [CVE-2021-26118](https://cve.now/CVE-2021-26118.md): Flaw in ActiveMQ Artemis OpenWire support (no CVSS, Apache Software Foundation Apache ActiveMQ Artemis · org.ap…)
- [CVE-2020-5428](https://cve.now/CVE-2020-5428.md): Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query (CVSS 5.1, Spring by VMware Spring Cloud Task · org.springframework.cl…)
- [CVE-2020-5427](https://cve.now/CVE-2020-5427.md): Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query (CVSS 5.7, Spring by VMware Spring Cloud Data Flow)
- [CVE-2021-3318](https://cve.now/CVE-2021-3318.md): attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter. (no CVSS)
- [CVE-2020-4952](https://cve.now/CVE-2020-4952.md): IBM Security Guardium 11.2 could allow an authenticated user to gain root access due to improper access control. (CVSS 8.8, IBM Security Guardium)
- [CVE-2020-4789](https://cve.now/CVE-2020-4789.md): IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 could allow a remote attacker to traverse dire (CVSS 6.5, IBM QRadar SIEM)
- [CVE-2020-4787](https://cve.now/CVE-2020-4787.md): IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery ( (CVSS 4.2, IBM QRadar SIEM)
- [CVE-2020-4786](https://cve.now/CVE-2020-4786.md): IBM QRadar SIEM 7.4.2 GA to 7.4.2 Patch 1, 7.4.0 to 7.4.1 Patch 1, and 7.3.0 to 7.3.3 Patch 5 is vulnerable to server side request forgery ( (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2020-4189](https://cve.now/CVE-2020-4189.md): IBM Security Guardium 11.2 discloses sensitive information in the response headers that could be used in further attacks against the system. (CVSS 4.3, IBM Security Guardium)
- [CVE-2021-20357](https://cve.now/CVE-2021-20357.md): IBM Jazz Foundation products is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational DOORS Next Generation · IBM Rational Qualit… +8)
- [CVE-2020-4865](https://cve.now/CVE-2020-4865.md): IBM Jazz Foundation products is vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Lifecycle Optimization · IBM Rational Rh… +8)
- [CVE-2020-4855](https://cve.now/CVE-2020-4855.md): IBM Jazz Foundation products is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ra… +8)
- [CVE-2020-4547](https://cve.now/CVE-2020-4547.md): IBM Jazz Foundation products could allow a remote attacker to hijack the clicking action of the victim. (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational Engin… +8)
- [CVE-2020-4524](https://cve.now/CVE-2020-4524.md): IBM Jazz Foundation products is vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ra… +8)
- [CVE-2021-25311](https://cve.now/CVE-2021-25311.md): condor\_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC\_CREDENTIAL\_DIRECTORY\_OAUTH directory, as demonstrated by c (no CVSS)
- [CVE-2021-25312](https://cve.now/CVE-2021-25312.md): HTCondor before 8.9.11 allows a user to submit a job as another user on the system, because of a flaw in the IDTOKENS authentication method. (no CVSS)
- [CVE-2020-23361](https://cve.now/CVE-2020-23361.md): phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begi (no CVSS)
- [CVE-2020-23360](https://cve.now/CVE-2020-23360.md): oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the che (no CVSS)
- [CVE-2020-23359](https://cve.now/CVE-2020-23359.md): WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the iden (no CVSS)
- [CVE-2020-23356](https://cve.now/CVE-2020-23356.md): dmin/kernel/api/login.class.phpin in nibbleblog v3.7.1c allows type juggling for login bypass because == is used instead of === for password (no CVSS)
- [CVE-2020-23355](https://cve.now/CVE-2020-23355.md): \*\* PRODUCT NOT SUPPORTED WHEN ASSIGNED \*\* Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentica (no CVSS, codiad/codiad)
- [CVE-2020-23352](https://cve.now/CVE-2020-23352.md): Z-BlogPHP 1.6.0 Valyria is affected by incorrect access control. (no CVSS)
- [CVE-2020-4967](https://cve.now/CVE-2020-4967.md): IBM Cloud Pak for Security (CP4S) 1.3.0.1 could disclose sensitive information through HTTP headers which could be used in further attacks a (CVSS 3.1, IBM Cloud Pak for Security)
- [CVE-2020-4820](https://cve.now/CVE-2020-4820.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Cloud Pak for Security)
- [CVE-2020-4816](https://cve.now/CVE-2020-4816.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly e (CVSS 5.3, IBM Cloud Pak for Security)
- [CVE-2020-4815](https://cve.now/CVE-2020-4815.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0 could allow a remote user to obtain sensitive information from HTTP response headers that could be (CVSS 5.3, IBM Cloud Pak for Security)
- [CVE-2020-4628](https://cve.now/CVE-2020-4628.md): IBM Cloud Pak for Security (CP4S) 1.3.0.1 and 1.4.0.0 could allow a remote attacker to obtain sensitive information when a detailed technica (CVSS 5.3, IBM Cloud Pak for Security)
- [CVE-2020-36012](https://cve.now/CVE-2020-36012.md): Stored XSS vulnerability in BDTASK Multi-Store Inventory Management System 1.0 allows a local admin to inject arbitrary code via the Custome (no CVSS)
- [CVE-2021-3272](https://cve.now/CVE-2021-3272.md): jp2\_decode in jp2/jp2\_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between th (no CVSS)
- [CVE-2021-26117](https://cve.now/CVE-2021-26117.md): ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind (no CVSS, Apache Software Foundation Apache ActiveMQ · org.apache.… +1)
- [CVE-2021-3326](https://cve.now/CVE-2021-3326.md): The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.