CVEs published February 3, 2021
63 CVEs were published on February 3, 2021: 2 critical, 2 high. 2 are now in CISA KEV.
- Published
- 63
- Critical
- 2
- High
- 2
- Medium
- 1
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 2
- Fix available
- 5
Most affected products
- Realtek RTL8195A Wi-Fi Module
- 5
- Clustered Data ONTAP
- 2
- QNAP Systems Helpdesk
- 2
- Apache Cassandra · org.apache.cassandra:cassandra-all
- 1
- Apache Shiro · org.apache.shiro:shiro-web +2
- 1
- com.squareup:connect
- 1
- Nextcloud Server
- 1
- org.jetbrains.kotlin:kotlin-stdlib
- 1
- SonicWall SMA100
- 1
- The Eclipse Foundation Eclipse Californium
- 1
Critical 2
High 2
Medium, low and unrated 59
- CVE-2021-26024The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorit
- CVE-2021-26023The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.
- CVE-2020-9389A username enumeration issue was discovered in SquaredUp before version 4.6.0.
- CVE-2021-23331Insecure Temporary Filecom.squareup:connect
- CVE-2019-16268Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do
- CVE-2020-8589Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to dClustered Data ONTAP
- CVE-2020-8588Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to dClustered Data ONTAP
- CVE-2020-18724Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attac
- CVE-2020-18723Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipie
- CVE-2021-25276In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that i
- CVE-2020-17523Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.Apache Shiro · org.apache.shiro:shiro-web +2
- CVE-2021-25274The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its pr
- CVE-2020-25853The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not vaRealtek RTL8195A Wi-Fi Module
- CVE-2020-25854The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does Realtek RTL8195A Wi-Fi Module
- CVE-2021-25275SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores databa
- CVE-2020-25855The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not Realtek RTL8195A Wi-Fi Module
- CVE-2020-25856The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does Realtek RTL8195A Wi-Fi Module
- CVE-2020-25857The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) Realtek RTL8195A Wi-Fi Module
- CVE-2020-8294A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet ExplorerNextcloud Server
- CVE-2020-17516Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryApache Cassandra · org.apache.cassandra:cassandra-all
- CVE-2020-28653Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update
- CVE-2020-28001SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
- CVE-2020-27994SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
- CVE-2020-35667JetBrains TeamCity Plugin before 2020.2.85695 SSRF.
- CVE-2021-25777In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
- CVE-2021-25778In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
- CVE-2020-35482SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
- CVE-2020-35481SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
- CVE-2020-27222In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS serThe Eclipse Foundation Eclipse Californium
- CVE-2021-25775In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
- CVE-2021-25774In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
- CVE-2021-25776In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
- CVE-2021-25772In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
- CVE-2021-25773JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
- CVE-2021-25771In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
- CVE-2021-25770In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
- CVE-2021-25769In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
- CVE-2021-25768In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
- CVE-2021-25767In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
- CVE-2021-25766In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
- CVE-2020-25208In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.
- CVE-2021-25765In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
- CVE-2021-25762In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
- CVE-2021-25763In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
- CVE-2021-25761In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
- CVE-2020-29582In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation.org.jetbrains.kotlin:kotlin-stdlib
- CVE-2021-25760In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
- CVE-2021-25759In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
- CVE-2021-25757In JetBrains Hub before 2020.1.12629, an open redirect was possible.
- CVE-2021-25758In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.
- CVE-2021-25756In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
- CVE-2021-25755In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.
- CVE-2020-28144Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 S
- CVE-2020-29166PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure
- CVE-2020-29165PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administra
- CVE-2020-29164PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).
- CVE-2020-29163PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.
- CVE-2020-9388CSRF protection was not present in SquaredUp before version 4.6.0.
- CVE-2020-9390SquaredUp allowed Stored XSS before version 4.6.0.