# CVEs published 2021-01-29

60 CVEs were published on January 29, 2021: 1 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-21254](https://cve.now/CVE-2021-21254.md): Regular expression Denial of Service in Markdown plugin (CVSS 6.5, ckeditor5 · @ckeditor/ckeditor5-markdown-gfm)
- [CVE-2020-29557](https://cve.now/CVE-2020-29557.md): An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. (CVSS 9.8, KEV)
- [CVE-2021-25646](https://cve.now/CVE-2021-25646.md): Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2020-24666](https://cve.now/CVE-2020-24666.md): The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authe (no CVSS)
- [CVE-2020-24664](https://cve.now/CVE-2020-24664.md): The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an a (no CVSS)
- [CVE-2020-24670](https://cve.now/CVE-2020-24670.md): The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an a (no CVSS)
- [CVE-2020-24669](https://cve.now/CVE-2020-24669.md): The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows a (no CVSS)
- [CVE-2021-25136](https://cve.now/CVE-2021-25136.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25135](https://cve.now/CVE-2021-25135.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25134](https://cve.now/CVE-2021-25134.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25137](https://cve.now/CVE-2021-25137.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2020-24665](https://cve.now/CVE-2020-24665.md): The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an (no CVSS)
- [CVE-2021-25130](https://cve.now/CVE-2021-25130.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25133](https://cve.now/CVE-2021-25133.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25132](https://cve.now/CVE-2021-25132.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25131](https://cve.now/CVE-2021-25131.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25128](https://cve.now/CVE-2021-25128.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25127](https://cve.now/CVE-2021-25127.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25129](https://cve.now/CVE-2021-25129.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25125](https://cve.now/CVE-2021-25125.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25126](https://cve.now/CVE-2021-25126.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25124](https://cve.now/CVE-2021-25124.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-25138](https://cve.now/CVE-2021-25138.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2021-3347](https://cve.now/CVE-2021-3347.md): An issue was discovered in the Linux kernel through 5.10.11. (CVSS 7.8)
- [CVE-2021-3346](https://cve.now/CVE-2021-3346.md): Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template. (no CVSS)
- [CVE-2021-23328](https://cve.now/CVE-2021-23328.md): Prototype Pollution (CVSS 5.6, iniparserjs)
- [CVE-2021-20586](https://cve.now/CVE-2021-20586.md): Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-\*V\*D" of RV-\*FR\*\*\*-D-\* all versions, con (no CVSS, Robot Controller MELFA FR Series; Robot Controller CR Serie…)
- [CVE-2021-3345](https://cve.now/CVE-2021-3345.md): \_gcry\_md\_block\_write in cipher/hash-common.c in Libgcrypt version 1.9.0 has a heap-based buffer overflow when the digest final function sets (no CVSS)
- [CVE-2021-25909](https://cve.now/CVE-2021-25909.md): ZIV AUTOMATION 4CCT Denial of Service vulnerability (CVSS 8.6, ZIV AUTOMATION 4CCT-EA6-334126BF)
- [CVE-2021-25910](https://cve.now/CVE-2021-25910.md): ZIV AUTOMATION 4CCT vulnerable to improper authentication (CVSS 8.0, ZIV AUTOMATION 4CCT-EA6-334126BF)
- [CVE-2021-25123](https://cve.now/CVE-2021-25123.md): The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 S (no CVSS, HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9…)
- [CVE-2020-35652](https://cve.now/CVE-2020-35652.md): An issue was discovered in res\_pjsip\_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, a (no CVSS)
- [CVE-2020-35145](https://cve.now/CVE-2020-35145.md): Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple co (no CVSS)
- [CVE-2020-29604](https://cve.now/CVE-2020-29604.md): An issue was discovered in MantisBT before 2.24.4. (no CVSS, mantisbt/mantisbt)
- [CVE-2020-29605](https://cve.now/CVE-2020-29605.md): An issue was discovered in MantisBT before 2.24.4. (no CVSS, mantisbt/mantisbt)
- [CVE-2020-29603](https://cve.now/CVE-2020-29603.md): In manage\_proj\_edit\_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage\_ (no CVSS, mantisbt/mantisbt)
- [CVE-2020-29538](https://cve.now/CVE-2020-29538.md): Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. (CVSS 4.9)
- [CVE-2020-29536](https://cve.now/CVE-2020-29536.md): Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. (CVSS 4.3)
- [CVE-2020-29537](https://cve.now/CVE-2020-29537.md): Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. (CVSS 4.6)
- [CVE-2020-29535](https://cve.now/CVE-2020-29535.md): Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. (CVSS 5.3)
- [CVE-2021-3176](https://cve.now/CVE-2021-3176.md): The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to (no CVSS)
- [CVE-2020-35547](https://cve.now/CVE-2020-35547.md): A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and (no CVSS)
- [CVE-2020-29004](https://cve.now/CVE-2020-29004.md): The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF a (no CVSS)
- [CVE-2020-29005](https://cve.now/CVE-2020-29005.md): The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosu (no CVSS)
- [CVE-2020-28406](https://cve.now/CVE-2020-28406.md): An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access d (CVSS 6.5)
- [CVE-2020-28405](https://cve.now/CVE-2020-28405.md): An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to change t (CVSS 8.8)
- [CVE-2020-28404](https://cve.now/CVE-2020-28404.md): An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access t (CVSS 6.5)
- [CVE-2020-28403](https://cve.now/CVE-2020-28403.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an attacker to change (CVSS 8.0)
- [CVE-2020-28402](https://cve.now/CVE-2020-28402.md): An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access L (CVSS 5.4)
- [CVE-2020-28401](https://cve.now/CVE-2020-28401.md): An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access W (CVSS 6.5)
- [CVE-2019-25014](https://cve.now/CVE-2019-25014.md): A NULL pointer dereference was found in pkg/proxy/envoy/v2/debug.go getResourceVersion in Istio pilot before 1.5.0-alpha.0. (no CVSS)
- [CVE-2021-3298](https://cve.now/CVE-2021-3298.md): Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manage (no CVSS)
- [CVE-2021-3336](https://cve.now/CVE-2021-3336.md): DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED2251 (no CVSS)
- [CVE-2021-26305](https://cve.now/CVE-2021-26305.md): An issue was discovered in Deserializer::read\_vec in the cdr crate before 0.2.4 for Rust. (no CVSS, cdr)
- [CVE-2021-26306](https://cve.now/CVE-2021-26306.md): An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. (no CVSS, raw-cpuid)
- [CVE-2021-26307](https://cve.now/CVE-2021-26307.md): An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. (no CVSS, raw-cpuid)
- [CVE-2021-26308](https://cve.now/CVE-2021-26308.md): An issue was discovered in the marc crate before 2.0.0 for Rust. (no CVSS, marc)
- [CVE-2021-26303](https://cve.now/CVE-2021-26303.md): PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field. (no CVSS)
- [CVE-2021-26304](https://cve.now/CVE-2021-26304.md): PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter. (no CVSS)
- [CVE-2021-3341](https://cve.now/CVE-2021-3341.md): A path traversal vulnerability in the DxWebEngine component of DH2i DxEnterprise and DxOdyssey for Windows, version 19.5 through 20.x before (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.