CVEs published February 2, 2021
53 CVEs were published on February 2, 2021: 3 critical, 6 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 3
- High
- 6
- Medium
- 9
- Low
- 0
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 17
Most affected products
- Android
- 14
- HCL Digital Experience
- 3
- moby · github.com/moby/moby
- 2
- total.js
- 2
- Adobe Experience Manager · com.adobe.acs:acs-aem-commons
- 1
- ADT LifeShield DIY HD Video Doorbell
- 1
- BlueZ Advisory
- 1
- Cloudflare WARP for Windows
- 1
- django
- 1
- dotty
- 1
Critical 3
High 6
- CVE-2021-21294Unbounded connection acceptance in http4s-blaze-serverhttp4s · org.http4s:http4s-blaze-server_2.12 +1
- CVE-2021-21293Unbounded connection acceptance leads to file handle exhaustionhttp4s blaze · org.http4s:blaze-core_2.11 +2
- CVE-2021-21289Command Injection Vulnerability in Mechanizesparklemotion mechanize · mechanize
- CVE-2021-23271TIBCO EBX Cross Site Scripting (XSS)TIBCO Software TIBCO EBX
- CVE-2020-28494Command Injectiontotal.js
- CVE-2020-28495Prototype Pollutiontotal.js
Medium, low and unrated 44
- CVE-2020-35152Privilege escalation through unquoted service binary path on Cloudflare WARP for WindowsCloudflare WARP for Windows
- CVE-2021-0352In RT regmap driver, there is a possible memory corruption due to type confusion.Android
- CVE-2021-0353In kisd, there is a possible memory corruption due to a heap buffer overflow.Android
- CVE-2021-0354In ged, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0355In kisd, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0356In netdiag, there is a possible command injection due to improper input validation.Android
- CVE-2021-0357In netdiag, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0358In netdiag, there is a possible command injection due to improper input validation.Android
- CVE-2021-0359In netdiag, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0360In netdiag, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-0361In kisd, there is a possible out of bounds read due to improper input validation.Android
- CVE-2021-0362In aee, there is a possible memory corruption due to a stack buffer overflow.Android
- CVE-2021-0363In mobile_log_d, there is a possible command injection due to a missing bounds check.Android
- CVE-2021-0364In mobile_log_d, there is a possible command injection due to improper input validation.Android
- CVE-2021-0365In display driver, there is a possible memory corruption due to a use after free.Android
- CVE-2021-21043Reflected Cross-site Scripting (XSS) on version-compare and page-compare toolsAdobe Experience Manager · com.adobe.acs:acs-aem-commons
- CVE-2020-24490Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access.BlueZ Advisory
- CVE-2020-8672Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allowIntel BIOS Advisory
- CVE-2020-29662In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path.github.com/goharbor/harbor
- CVE-2021-3395A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file.
- CVE-2020-8734Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentiallIntel® Server Board M10JNP2SB Advisory
- CVE-2020-4081In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS).HCL Digital Experience
- CVE-2020-1910A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed WhatsApp Business for Android · WhatsApp for Android
- CVE-2020-14255HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests.HCL Digital Experience
- CVE-2021-21292Unquoted Windows binary path in Traccartraccar
- CVE-2020-14221HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.HCL Digital Experience
- CVE-2021-21291Subdomain checking of whitelisted domains could allow unintended redirectsoauth2-proxy · github.com/oauth2-proxy/oauth2-proxy/v7 +1
- CVE-2020-28498Cryptographic Issueselliptic
- CVE-2021-25912Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remodotty
- CVE-2021-20199Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts).podman · github.com/containers/podman/v3
- CVE-2021-21284privilege escalation in Mobymoby · github.com/moby/moby
- CVE-2021-21285Docker daemon crash during image pull of malicious imagemoby · github.com/moby/moby
- CVE-2019-25017An issue was discovered in rcp in MIT krb5-appl through 1.0.3.
- CVE-2019-25018In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of .
- CVE-2020-4934IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system.IBM Content Navigator
- CVE-2021-25310The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute
- CVE-2020-18568The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execu
- CVE-2020-8101Command execution due to unsanitized input in LifeShield DIY HD Video DoorbellADT LifeShield DIY HD Video Doorbell
- CVE-2020-1896A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.cFacebook Hermes
- CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template"django
- CVE-2020-24335An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG.
- CVE-2020-25035UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a related issue to CVE
- CVE-2020-25036UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell wit
- CVE-2020-25037UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command.