CVEs published January 28, 2021
31 CVEs were published on January 28, 2021: 0 critical, 2 high.
- Published
- 31
- Critical
- 0
- High
- 2
- Medium
- 2
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- moodle · moodle/moodle
- 5
- https://github.com/revive-adserver/revive-adserver
- 2
- NEC Aterm WG2600HP and Aterm WG2600HP2
- 2
- Atlassian Bamboo
- 1
- electron
- 1
- IBM MQ
- 1
- IBM QRadar SIEM
- 1
- Infoscience Logstorage and ELC Analytics
- 1
- keycloak · org.keycloak:keycloak-parent
- 1
- Louketo Keycloak Gatekeeper
- 1
High 2
- CVE-2020-4682IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deIBM MQ
- CVE-2020-13569A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f6OpenEMR
Medium, low and unrated 29
- CVE-2020-8585OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use OnCommand Unified Manager for 7-Mode
- CVE-2019-25016In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed
- CVE-2021-3160Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote atta
- CVE-2021-3337The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicki
- CVE-2020-35754OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execut
- CVE-2020-36115Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or La
- CVE-2020-35517A flaw was found in qemu.qemu
- CVE-2020-1723A flaw was found in Keycloak Gatekeeper (Louketo).Louketo Keycloak Gatekeeper
- CVE-2020-1725A flaw was found in keycloak before version 13.0.0.keycloak · org.keycloak:keycloak-parent
- CVE-2021-20185It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages,moodle · moodle/moodle
- CVE-2021-25647Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to
- CVE-2021-20184It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meantmoodle · moodle/moodle
- CVE-2021-20186It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of moodle · moodle/moodle
- CVE-2021-20183It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of searchmoodle · moodle/moodle
- CVE-2021-20187It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP moodle · moodle/moodle
- CVE-2020-26272Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFselectron
- CVE-2021-22875Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.https://github.com/revive-adserver/revive-adserver
- CVE-2021-22874Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.https://github.com/revive-adserver/revive-adserver
- CVE-2020-4888IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system,IBM QRadar SIEM
- CVE-2021-20621Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and eNEC Aterm WG2600HP and Aterm WG2600HP2
- CVE-2021-20622Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allowsNEC Aterm WG2600HP and Aterm WG2600HP2
- CVE-2020-5626Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands viInfoscience Logstorage and ELC Analytics
- CVE-2021-20620Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via NEC Aterm WF800HP
- CVE-2020-35124A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaSmautic/core
- CVE-2020-25785An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77.
- CVE-2020-25784An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77.
- CVE-2020-25783An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77.
- CVE-2020-25782An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77.
- CVE-2021-26067Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home dAtlassian Bamboo