# CVEs published 2021-02-01

49 CVEs were published on February 1, 2021: 5 critical, 6 high. Days are UTC.

- [CVE-2020-14192](https://cve.now/CVE-2020-14192.md): Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Disclosure vulnerabili (no CVSS, Atlassian Fisheye · Atlassian Crucible)
- [CVE-2020-36231](https://cve.now/CVE-2020-36231.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they should not have access (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-3378](https://cve.now/CVE-2021-3378.md): FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile (no CVSS)
- [CVE-2021-3340](https://cve.now/CVE-2021-3340.md): A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote attackers to inject arb (no CVSS)
- [CVE-2019-20468](https://cve.now/CVE-2019-20468.md): An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. (no CVSS)
- [CVE-2019-20473](https://cve.now/CVE-2019-20473.md): An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. (CVSS 6.8)
- [CVE-2019-20471](https://cve.now/CVE-2019-20471.md): An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. (CVSS 7.8)
- [CVE-2019-20470](https://cve.now/CVE-2019-20470.md): An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. (CVSS 7.5)
- [CVE-2020-28493](https://cve.now/CVE-2020-28493.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, jinja2)
- [CVE-2020-20287](https://cve.now/CVE-2020-20287.md): Unrestricted file upload vulnerability in the yccms 3.3 project. (no CVSS)
- [CVE-2020-20289](https://cve.now/CVE-2020-20289.md): Sql injection vulnerability in the yccms 3.3 project. (no CVSS)
- [CVE-2020-20290](https://cve.now/CVE-2020-20290.md): Directory traversal vulnerability in the yccms 3.3 project. (no CVSS)
- [CVE-2020-20296](https://cve.now/CVE-2020-20296.md): An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious par (no CVSS)
- [CVE-2020-20295](https://cve.now/CVE-2020-20295.md): An issue was found in CMSWing project version 1.3.8. (no CVSS)
- [CVE-2020-20294](https://cve.now/CVE-2020-20294.md): An issue was found in CMSWing project version 1.3.8. (no CVSS)
- [CVE-2020-21180](https://cve.now/CVE-2020-21180.md): Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the (no CVSS)
- [CVE-2020-21179](https://cve.now/CVE-2020-21179.md): Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the (no CVSS)
- [CVE-2020-21176](https://cve.now/CVE-2020-21176.md): SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitra (no CVSS, thinkjs)
- [CVE-2021-21287](https://cve.now/CVE-2021-21287.md): Server-Side Request Forgery in MinIO Browser API (CVSS 7.7, minio)
- [CVE-2021-3024](https://cve.now/CVE-2021-3024.md): HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HT (no CVSS)
- [CVE-2020-25594](https://cve.now/CVE-2020-25594.md): HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. (no CVSS)
- [CVE-2021-3282](https://cve.now/CVE-2021-3282.md): HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the \`remove-peer\` raft operator command to be executed against DR secondaries without authe (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-3283](https://cve.now/CVE-2021-3283.md): HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same no (no CVSS, github.com/hashicorp/nomad)
- [CVE-2020-28426](https://cve.now/CVE-2020-28426.md): Command Injection (CVSS 7.3, kill-process-on-port)
- [CVE-2021-21286](https://cve.now/CVE-2021-21286.md): Authorization Bypass in AVideo Platform (CVSS 7.7, WWBN AVideo)
- [CVE-2020-13564](https://cve.now/CVE-2020-13564.md): A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. (CVSS 9.6, phpGACL)
- [CVE-2020-13563](https://cve.now/CVE-2020-13563.md): A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. (CVSS 9.6, phpGACL)
- [CVE-2021-21277](https://cve.now/CVE-2021-21277.md): Angular Expressions - Remote Code Execution (CVSS 8.5, peerigon angular-expressions · angular-expressions)
- [CVE-2021-23330](https://cve.now/CVE-2021-23330.md): Command Injection (CVSS 9.8, launchpad)
- [CVE-2020-13562](https://cve.now/CVE-2020-13562.md): A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. (CVSS 9.6, phpGACL)
- [CVE-2021-21266](https://cve.now/CVE-2021-21266.md): XXE vulnerability in OpenHAB (CVSS 6.4, openhab-addons)
- [CVE-2020-24271](https://cve.now/CVE-2020-24271.md): A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/insert/navTabId/rbacus (no CVSS)
- [CVE-2020-36109](https://cve.now/CVE-2020-36109.md): ASUS RT-AX86U router firmware below version under 9.0.0.4\_386 has a buffer overflow in the blocking\_request.cgi function of the httpd module (no CVSS)
- [CVE-2020-28194](https://cve.now/CVE-2020-28194.md): Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. (no CVSS)
- [CVE-2021-3350](https://cve.now/CVE-2021-3350.md): deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter. (no CVSS)
- [CVE-2021-3349](https://cve.now/CVE-2021-3349.md): GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution (no CVSS)
- [CVE-2021-3348](https://cve.now/CVE-2021-3348.md): nbd\_add\_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb\_queue\_rq use-after-free that could be triggered by loca (no CVSS)
- [CVE-2020-13858](https://cve.now/CVE-2020-13858.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. (no CVSS)
- [CVE-2020-15836](https://cve.now/CVE-2020-15836.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. (no CVSS)
- [CVE-2020-15835](https://cve.now/CVE-2020-15835.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. (no CVSS)
- [CVE-2020-15834](https://cve.now/CVE-2020-15834.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. (no CVSS)
- [CVE-2020-15833](https://cve.now/CVE-2020-15833.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. (no CVSS)
- [CVE-2020-15832](https://cve.now/CVE-2020-15832.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. (no CVSS)
- [CVE-2020-13860](https://cve.now/CVE-2020-13860.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. (no CVSS)
- [CVE-2020-13859](https://cve.now/CVE-2020-13859.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. (no CVSS)
- [CVE-2020-13856](https://cve.now/CVE-2020-13856.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. (no CVSS)
- [CVE-2020-13857](https://cve.now/CVE-2020-13857.md): An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. (no CVSS)
- [CVE-2020-26547](https://cve.now/CVE-2020-26547.md): Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. (no CVSS)
- [CVE-2021-21276](https://cve.now/CVE-2021-21276.md): Privilege escalation in Polr (CVSS 9.3, cydrobolt polr)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.