CVEs published February 1, 2021
49 CVEs were published on February 1, 2021: 5 critical, 6 high.
- Published
- 49
- Critical
- 5
- High
- 6
- Medium
- 3
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- phpGACL
- 3
- Atlassian Fisheye · Atlassian Crucible
- 1
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- cydrobolt polr
- 1
- github.com/hashicorp/nomad
- 1
- github.com/hashicorp/vault
- 1
- jinja2
- 1
- kill-process-on-port
- 1
- launchpad
- 1
- minio
- 1
Critical 5
- CVE-2020-13564A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpGACL
- CVE-2020-13563A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpGACL
- CVE-2021-23330Command Injectionlaunchpad
- CVE-2020-13562A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpGACL
- CVE-2021-21276Privilege escalation in Polrcydrobolt polr
High 6
- CVE-2019-20471An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
- CVE-2019-20470An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
- CVE-2021-21287Server-Side Request Forgery in MinIO Browser APIminio
- CVE-2020-28426Command Injectionkill-process-on-port
- CVE-2021-21286Authorization Bypass in AVideo PlatformWWBN AVideo
- CVE-2021-21277Angular Expressions - Remote Code Executionpeerigon angular-expressions · angular-expressions
Medium, low and unrated 38
- CVE-2020-14192Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabiliAtlassian Fisheye · Atlassian Crucible
- CVE-2020-36231Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have accessAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-3378FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile
- CVE-2021-3340A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arb
- CVE-2019-20468An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
- CVE-2019-20473An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices.
- CVE-2020-28493Regular Expression Denial of Service (ReDoS)jinja2
- CVE-2020-20287Unrestricted file upload vulnerability in the yccms 3.3 project.
- CVE-2020-20289Sql injection vulnerability in the yccms 3.3 project.
- CVE-2020-20290Directory traversal vulnerability in the yccms 3.3 project.
- CVE-2020-20296An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious par
- CVE-2020-20295An issue was found in CMSWing project version 1.3.8.
- CVE-2020-20294An issue was found in CMSWing project version 1.3.8.
- CVE-2020-21180Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the
- CVE-2020-21179Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the
- CVE-2020-21176SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrathinkjs
- CVE-2021-3024HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HT
- CVE-2020-25594HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests.
- CVE-2021-3282HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secondaries without authegithub.com/hashicorp/vault
- CVE-2021-3283HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same nogithub.com/hashicorp/nomad
- CVE-2021-21266XXE vulnerability in OpenHABopenhab-addons
- CVE-2020-24271A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacus
- CVE-2020-36109ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function of the httpd module
- CVE-2020-28194Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2.
- CVE-2021-3350deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.
- CVE-2021-3349GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution
- CVE-2021-3348nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by loca
- CVE-2020-13858An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices.
- CVE-2020-15836An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices.
- CVE-2020-15835An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices.
- CVE-2020-15834An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices.
- CVE-2020-15833An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices.
- CVE-2020-15832An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices.
- CVE-2020-13860An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices.
- CVE-2020-13859An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices.
- CVE-2020-13856An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices.
- CVE-2020-13857An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices.
- CVE-2020-26547Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results.