CVEs published January 29, 2021
60 CVEs were published on January 29, 2021: 1 critical, 5 high. 1 is now in CISA KEV.
- Published
- 60
- Critical
- 1
- High
- 5
- Medium
- 10
- Low
- 0
- Unrated
- 44
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- 16
- mantisbt/mantisbt
- 3
- raw-cpuid
- 2
- ZIV AUTOMATION 4CCT-EA6-334126BF
- 2
- Apache Software Foundation Apache Druid · org.apache.druid:…
- 1
- cdr
- 1
- ckeditor5 · @ckeditor/ckeditor5-markdown-gfm
- 1
- iniparserjs
- 1
- marc
- 1
- Robot Controller MELFA FR Series; Robot Controller CR Serie…
- 1
Critical 1
High 5
- CVE-2021-3347An issue was discovered in the Linux kernel through 5.10.11.
- CVE-2021-25909ZIV AUTOMATION 4CCT Denial of Service vulnerabilityZIV AUTOMATION 4CCT-EA6-334126BF
- CVE-2021-25910ZIV AUTOMATION 4CCT vulnerable to improper authenticationZIV AUTOMATION 4CCT-EA6-334126BF
- CVE-2020-28405An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change t
- CVE-2020-28403A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change
Medium, low and unrated 54
- CVE-2021-21254Regular expression Denial of Service in Markdown pluginckeditor5 · @ckeditor/ckeditor5-markdown-gfm
- CVE-2021-25646Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.Apache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2020-24666The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authe
- CVE-2020-24664The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an a
- CVE-2020-24670The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an a
- CVE-2020-24669The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows a
- CVE-2021-25136The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25135The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25134The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25137The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2020-24665The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an
- CVE-2021-25130The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25133The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25132The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25131The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25128The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25127The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25129The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25125The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25126The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25124The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-25138The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2021-3346Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.
- CVE-2021-23328Prototype Pollutioniniparserjs
- CVE-2021-20586Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-*V*D" of RV-*FR***-D-* all versions, conRobot Controller MELFA FR Series; Robot Controller CR Serie…
- CVE-2021-3345_gcry_md_block_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets
- CVE-2021-25123The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 SHPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…
- CVE-2020-35652An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, a
- CVE-2020-35145Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple co
- CVE-2020-29604An issue was discovered in MantisBT before 2.24.4.mantisbt/mantisbt
- CVE-2020-29605An issue was discovered in MantisBT before 2.24.4.mantisbt/mantisbt
- CVE-2020-29603In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_mantisbt/mantisbt
- CVE-2020-29538Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API.
- CVE-2020-29536Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability.
- CVE-2020-29537Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability.
- CVE-2020-29535Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability.
- CVE-2021-3176The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to
- CVE-2020-35547A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and
- CVE-2020-29004The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF a
- CVE-2020-29005The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosu
- CVE-2020-28406An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access d
- CVE-2020-28404An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access t
- CVE-2020-28402An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access L
- CVE-2020-28401An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access W
- CVE-2019-25014A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0.
- CVE-2021-3298Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manage
- CVE-2021-3336DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED2251
- CVE-2021-26305An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust.cdr
- CVE-2021-26306An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust.raw-cpuid
- CVE-2021-26307An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust.raw-cpuid
- CVE-2021-26308An issue was discovered in the marc crate before 2.0.0 for Rust.marc
- CVE-2021-26303PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.
- CVE-2021-26304PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.
- CVE-2021-3341A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before