# CVEs published 2021-01-28 31 CVEs were published on January 28, 2021: 0 critical, 2 high. Days are UTC. - [CVE-2020-8585](https://cve.now/CVE-2020-8585.md): OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use (no CVSS, OnCommand Unified Manager for 7-Mode) - [CVE-2019-25016](https://cve.now/CVE-2019-25016.md): In OpenDoas from 6.6 to 6.8 the users PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed (no CVSS) - [CVE-2021-3160](https://cve.now/CVE-2021-3160.md): Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote atta (no CVSS) - [CVE-2021-3337](https://cve.now/CVE-2021-3337.md): The Hide-Thread-Content plugin through 2021-01-27 for MyBB allows remote attackers to bypass intended content-reading restrictions by clicki (no CVSS) - [CVE-2020-35754](https://cve.now/CVE-2020-35754.md): OpenSolution Quick.CMS \< 6.7 and Quick.Cart \< 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execut (no CVSS) - [CVE-2020-36115](https://cve.now/CVE-2020-36115.md): Stored Cross Site Scripting (XSS) vulnerability in EGavilan Media CRUD Operation with PHP, MySQL, Bootstrap, and Dompdf via First Name or La (no CVSS) - [CVE-2020-35517](https://cve.now/CVE-2020-35517.md): A flaw was found in qemu. (no CVSS, qemu) - [CVE-2020-1723](https://cve.now/CVE-2020-1723.md): A flaw was found in Keycloak Gatekeeper (Louketo). (no CVSS, Louketo Keycloak Gatekeeper) - [CVE-2020-1725](https://cve.now/CVE-2020-1725.md): A flaw was found in keycloak before version 13.0.0. (no CVSS, keycloak · org.keycloak:keycloak-parent) - [CVE-2021-20185](https://cve.now/CVE-2021-20185.md): It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, (no CVSS, moodle · moodle/moodle) - [CVE-2021-25647](https://cve.now/CVE-2021-25647.md): Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to (no CVSS) - [CVE-2021-20184](https://cve.now/CVE-2021-20184.md): It was found in Moodle before version 3.10.1, 3.9.4 and 3.8.7 that a insufficient capability checks in some grade related web services meant (no CVSS, moodle · moodle/moodle) - [CVE-2021-20186](https://cve.now/CVE-2021-20186.md): It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that if the TeX notation filter was enabled, additional sanitizing of (no CVSS, moodle · moodle/moodle) - [CVE-2021-20183](https://cve.now/CVE-2021-20183.md): It was found in Moodle before version 3.10.1 that some search inputs were vulnerable to reflected XSS due to insufficient escaping of search (no CVSS, moodle · moodle/moodle) - [CVE-2021-20187](https://cve.now/CVE-2021-20187.md): It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP (no CVSS, moodle · moodle/moodle) - [CVE-2020-26272](https://cve.now/CVE-2020-26272.md): Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs (CVSS 5.4, electron) - [CVE-2021-22875](https://cve.now/CVE-2021-22875.md): Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the \`setPerPage\` parameter. (no CVSS, https://github.com/revive-adserver/revive-adserver) - [CVE-2021-22874](https://cve.now/CVE-2021-22874.md): Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the \`period\_preset\` parameter. (no CVSS, https://github.com/revive-adserver/revive-adserver) - [CVE-2020-4888](https://cve.now/CVE-2020-4888.md): IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, (CVSS 6.3, IBM QRadar SIEM) - [CVE-2020-4682](https://cve.now/CVE-2020-4682.md): IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe de (CVSS 8.1, IBM MQ) - [CVE-2020-13569](https://cve.now/CVE-2020-13569.md): A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f6 (CVSS 8.8, OpenEMR) - [CVE-2021-20621](https://cve.now/CVE-2021-20621.md): Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and e (no CVSS, NEC Aterm WG2600HP and Aterm WG2600HP2) - [CVE-2021-20622](https://cve.now/CVE-2021-20622.md): Cross-site scripting vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows (no CVSS, NEC Aterm WG2600HP and Aterm WG2600HP2) - [CVE-2020-5626](https://cve.now/CVE-2020-5626.md): Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands vi (no CVSS, Infoscience Logstorage and ELC Analytics) - [CVE-2021-20620](https://cve.now/CVE-2021-20620.md): Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via (no CVSS, NEC Aterm WF800HP) - [CVE-2020-35124](https://cve.now/CVE-2020-35124.md): A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaS (no CVSS, mautic/core) - [CVE-2020-25785](https://cve.now/CVE-2020-25785.md): An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. (no CVSS) - [CVE-2020-25784](https://cve.now/CVE-2020-25784.md): An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. (no CVSS) - [CVE-2020-25783](https://cve.now/CVE-2020-25783.md): An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.77. (no CVSS) - [CVE-2020-25782](https://cve.now/CVE-2020-25782.md): An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.77. (no CVSS) - [CVE-2021-26067](https://cve.now/CVE-2021-26067.md): Affected versions of Atlassian Bamboo allow an unauthenticated remote attacker to view a stack trace that may reveal the path for the home d (no CVSS, Atlassian Bamboo) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-01-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.