# CVEs published 2021-02-02

53 CVEs were published on February 2, 2021: 3 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-35152](https://cve.now/CVE-2020-35152.md): Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows (CVSS 4.5, Cloudflare WARP for Windows)
- [CVE-2021-0352](https://cve.now/CVE-2021-0352.md): In RT regmap driver, there is a possible memory corruption due to type confusion. (no CVSS, Android)
- [CVE-2021-0353](https://cve.now/CVE-2021-0353.md): In kisd, there is a possible memory corruption due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0354](https://cve.now/CVE-2021-0354.md): In ged, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0355](https://cve.now/CVE-2021-0355.md): In kisd, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0356](https://cve.now/CVE-2021-0356.md): In netdiag, there is a possible command injection due to improper input validation. (no CVSS, Android)
- [CVE-2021-0357](https://cve.now/CVE-2021-0357.md): In netdiag, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0358](https://cve.now/CVE-2021-0358.md): In netdiag, there is a possible command injection due to improper input validation. (no CVSS, Android)
- [CVE-2021-0359](https://cve.now/CVE-2021-0359.md): In netdiag, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0360](https://cve.now/CVE-2021-0360.md): In netdiag, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0361](https://cve.now/CVE-2021-0361.md): In kisd, there is a possible out of bounds read due to improper input validation. (no CVSS, Android)
- [CVE-2021-0362](https://cve.now/CVE-2021-0362.md): In aee, there is a possible memory corruption due to a stack buffer overflow. (no CVSS, Android)
- [CVE-2021-0363](https://cve.now/CVE-2021-0363.md): In mobile\_log\_d, there is a possible command injection due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0364](https://cve.now/CVE-2021-0364.md): In mobile\_log\_d, there is a possible command injection due to improper input validation. (no CVSS, Android)
- [CVE-2021-0365](https://cve.now/CVE-2021-0365.md): In display driver, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-21043](https://cve.now/CVE-2021-21043.md): Reflected Cross-site Scripting (XSS) on version-compare and page-compare tools (CVSS 6.1, Adobe Experience Manager · com.adobe.acs:acs-aem-commons)
- [CVE-2021-21294](https://cve.now/CVE-2021-21294.md): Unbounded connection acceptance in http4s-blaze-server (CVSS 7.5, http4s · org.http4s:http4s-blaze-server\_2.12 +1)
- [CVE-2021-21293](https://cve.now/CVE-2021-21293.md): Unbounded connection acceptance leads to file handle exhaustion (CVSS 7.5, http4s blaze · org.http4s:blaze-core\_2.11 +2)
- [CVE-2020-24490](https://cve.now/CVE-2020-24490.md): Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access. (no CVSS, BlueZ Advisory)
- [CVE-2020-8672](https://cve.now/CVE-2020-8672.md): Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow (no CVSS, Intel BIOS Advisory)
- [CVE-2020-29662](https://cve.now/CVE-2020-29662.md): In Harbor 2.0 before 2.0.5 and 2.1.x before 2.1.2 the catalog’s registry API is exposed on an unauthenticated path. (no CVSS, github.com/goharbor/harbor)
- [CVE-2021-3395](https://cve.now/CVE-2021-3395.md): A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. (no CVSS)
- [CVE-2020-8734](https://cve.now/CVE-2020-8734.md): Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentiall (no CVSS, Intel® Server Board M10JNP2SB Advisory)
- [CVE-2020-4081](https://cve.now/CVE-2020-4081.md): In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS). (no CVSS, HCL Digital Experience)
- [CVE-2020-1910](https://cve.now/CVE-2020-1910.md): A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed (no CVSS, WhatsApp Business for Android · WhatsApp for Android)
- [CVE-2020-14255](https://cve.now/CVE-2020-14255.md): HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests. (no CVSS, HCL Digital Experience)
- [CVE-2021-21292](https://cve.now/CVE-2021-21292.md): Unquoted Windows binary path in Traccar (CVSS 5.5, traccar)
- [CVE-2020-14221](https://cve.now/CVE-2020-14221.md): HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users. (no CVSS, HCL Digital Experience)
- [CVE-2021-21291](https://cve.now/CVE-2021-21291.md): Subdomain checking of whitelisted domains could allow unintended redirects (CVSS 4.7, oauth2-proxy · github.com/oauth2-proxy/oauth2-proxy/v7 +1)
- [CVE-2020-28498](https://cve.now/CVE-2020-28498.md): Cryptographic Issues (CVSS 6.8, elliptic)
- [CVE-2021-21289](https://cve.now/CVE-2021-21289.md): Command Injection Vulnerability in Mechanize (CVSS 7.4, sparklemotion mechanize · mechanize)
- [CVE-2021-25912](https://cve.now/CVE-2021-25912.md): Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remo (no CVSS, dotty)
- [CVE-2021-23271](https://cve.now/CVE-2021-23271.md): TIBCO EBX Cross Site Scripting (XSS) (CVSS 8.0, TIBCO Software TIBCO EBX)
- [CVE-2020-7775](https://cve.now/CVE-2020-7775.md): Command Injection (CVSS 9.8, freediskspace)
- [CVE-2021-20199](https://cve.now/CVE-2021-20199.md): Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). (no CVSS, podman · github.com/containers/podman/v3)
- [CVE-2021-21284](https://cve.now/CVE-2021-21284.md): privilege escalation in Moby (CVSS 6.8, moby · github.com/moby/moby)
- [CVE-2021-21285](https://cve.now/CVE-2021-21285.md): Docker daemon crash during image pull of malicious image (CVSS 6.5, moby · github.com/moby/moby)
- [CVE-2020-15097](https://cve.now/CVE-2020-15097.md): Path Traversal in loklak (CVSS 9.1, loklak)
- [CVE-2019-25017](https://cve.now/CVE-2019-25017.md): An issue was discovered in rcp in MIT krb5-appl through 1.0.3. (no CVSS)
- [CVE-2019-25018](https://cve.now/CVE-2019-25018.md): In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . (no CVSS)
- [CVE-2020-4934](https://cve.now/CVE-2020-4934.md): IBM Content Navigator 3.0.CD could allow a remote attacker to traverse directories on the system. (CVSS 4.3, IBM Content Navigator)
- [CVE-2021-25310](https://cve.now/CVE-2021-25310.md): The administration web interface on Belkin Linksys WRT160NL 1.0.04.002\_US\_20130619 devices allows remote authenticated attackers to execute (no CVSS)
- [CVE-2020-18568](https://cve.now/CVE-2020-18568.md): The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability, which can cause remote command execu (no CVSS)
- [CVE-2020-25506](https://cve.now/CVE-2020-25506.md): D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system\_mgr.cgi component, which can lead to remote arbitrary (CVSS 9.8, KEV)
- [CVE-2020-8101](https://cve.now/CVE-2020-8101.md): Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell (CVSS 6.9, ADT LifeShield DIY HD Video Doorbell)
- [CVE-2020-28494](https://cve.now/CVE-2020-28494.md): Command Injection (CVSS 8.6, total.js)
- [CVE-2020-28495](https://cve.now/CVE-2020-28495.md): Prototype Pollution (CVSS 7.3, total.js)
- [CVE-2020-1896](https://cve.now/CVE-2020-1896.md): A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.c (no CVSS, Facebook Hermes)
- [CVE-2021-3281](https://cve.now/CVE-2021-3281.md): In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" (no CVSS, django)
- [CVE-2020-24335](https://cve.now/CVE-2020-24335.md): An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. (no CVSS)
- [CVE-2020-25035](https://cve.now/CVE-2020-25035.md): UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole\_client's PHP call, a related issue to CVE (no CVSS)
- [CVE-2020-25036](https://cve.now/CVE-2020-25036.md): UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, and access a shell wit (no CVSS)
- [CVE-2020-25037](https://cve.now/CVE-2020-25037.md): UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted command. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.