# CVEs published 2021-02-03

63 CVEs were published on February 3, 2021: 2 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-26024](https://cve.now/CVE-2021-26024.md): The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to Insecure Direct Object Reference: it is possible to create favorit (no CVSS)
- [CVE-2021-26023](https://cve.now/CVE-2021-26023.md): The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS. (no CVSS)
- [CVE-2021-20016](https://cve.now/CVE-2021-20016.md): A SQL-Injection vulnerability in the SonicWall SSLVPN SMA100 product allows a remote unauthenticated attacker to perform SQL query to access (CVSS 9.8, KEV, SonicWall SMA100)
- [CVE-2020-9389](https://cve.now/CVE-2020-9389.md): A username enumeration issue was discovered in SquaredUp before version 4.6.0. (no CVSS)
- [CVE-2021-23331](https://cve.now/CVE-2021-23331.md): Insecure Temporary File (CVSS 4.4, com.squareup:connect)
- [CVE-2019-16268](https://cve.now/CVE-2019-16268.md): Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do (no CVSS)
- [CVE-2020-8589](https://cve.now/CVE-2020-8589.md): Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to d (no CVSS, Clustered Data ONTAP)
- [CVE-2020-8588](https://cve.now/CVE-2020-8588.md): Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthorized tenant users to d (no CVSS, Clustered Data ONTAP)
- [CVE-2020-18724](https://cve.now/CVE-2020-18724.md): Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19.5.5 allows an attac (no CVSS)
- [CVE-2020-18723](https://cve.now/CVE-2020-18723.md): Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code on the email recipie (no CVSS)
- [CVE-2021-25276](https://cve.now/CVE-2021-25276.md): In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that i (no CVSS)
- [CVE-2020-17523](https://cve.now/CVE-2020-17523.md): Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. (no CVSS, Apache Shiro · org.apache.shiro:shiro-web +2)
- [CVE-2021-25274](https://cve.now/CVE-2021-25274.md): The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its pr (no CVSS)
- [CVE-2020-25853](https://cve.now/CVE-2020-25853.md): The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not va (no CVSS, Realtek RTL8195A Wi-Fi Module)
- [CVE-2020-25854](https://cve.now/CVE-2020-25854.md): The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does (no CVSS, Realtek RTL8195A Wi-Fi Module)
- [CVE-2021-25275](https://cve.now/CVE-2021-25275.md): SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores databa (no CVSS)
- [CVE-2020-25855](https://cve.now/CVE-2020-25855.md): The function AES\_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not (no CVSS, Realtek RTL8195A Wi-Fi Module)
- [CVE-2020-25856](https://cve.now/CVE-2020-25856.md): The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does (no CVSS, Realtek RTL8195A Wi-Fi Module)
- [CVE-2020-25857](https://cve.now/CVE-2020-25857.md): The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) (no CVSS, Realtek RTL8195A Wi-Fi Module)
- [CVE-2020-8294](https://cve.now/CVE-2020-8294.md): A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer (no CVSS, Nextcloud Server)
- [CVE-2020-17516](https://cve.now/CVE-2020-17516.md): Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode\_encry (no CVSS, Apache Cassandra · org.apache.cassandra:cassandra-all)
- [CVE-2020-28653](https://cve.now/CVE-2020-28653.md): Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update (no CVSS)
- [CVE-2020-28001](https://cve.now/CVE-2020-28001.md): SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS. (no CVSS)
- [CVE-2020-27994](https://cve.now/CVE-2020-27994.md): SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal. (no CVSS)
- [CVE-2020-2506](https://cve.now/CVE-2020-2506.md): improper access control vulnerability in Helpdesk (CVSS 7.3, KEV, QNAP Systems Helpdesk)
- [CVE-2020-35667](https://cve.now/CVE-2020-35667.md): JetBrains TeamCity Plugin before 2020.2.85695 SSRF. (no CVSS)
- [CVE-2020-2507](https://cve.now/CVE-2020-2507.md): command injection vulnerability in Helpdesk (CVSS 9.8, QNAP Systems Helpdesk)
- [CVE-2021-25777](https://cve.now/CVE-2021-25777.md): In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly. (no CVSS)
- [CVE-2021-25778](https://cve.now/CVE-2021-25778.md): In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly. (no CVSS)
- [CVE-2020-35482](https://cve.now/CVE-2020-35482.md): SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS. (no CVSS)
- [CVE-2020-35481](https://cve.now/CVE-2020-35481.md): SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection. (no CVSS)
- [CVE-2020-27222](https://cve.now/CVE-2020-27222.md): In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS ser (no CVSS, The Eclipse Foundation Eclipse Californium)
- [CVE-2021-25775](https://cve.now/CVE-2021-25775.md): In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users. (no CVSS)
- [CVE-2021-25774](https://cve.now/CVE-2021-25774.md): In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user. (no CVSS)
- [CVE-2021-25776](https://cve.now/CVE-2021-25776.md): In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters. (no CVSS)
- [CVE-2021-25772](https://cve.now/CVE-2021-25772.md): In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration. (no CVSS)
- [CVE-2021-25773](https://cve.now/CVE-2021-25773.md): JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages. (no CVSS)
- [CVE-2021-25771](https://cve.now/CVE-2021-25771.md): In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed. (no CVSS)
- [CVE-2021-25770](https://cve.now/CVE-2021-25770.md): In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution. (no CVSS)
- [CVE-2021-25769](https://cve.now/CVE-2021-25769.md): In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments. (no CVSS)
- [CVE-2021-25768](https://cve.now/CVE-2021-25768.md): In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly. (no CVSS)
- [CVE-2021-25767](https://cve.now/CVE-2021-25767.md): In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution. (no CVSS)
- [CVE-2021-25766](https://cve.now/CVE-2021-25766.md): In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made. (no CVSS)
- [CVE-2020-25208](https://cve.now/CVE-2020-25208.md): In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions. (no CVSS)
- [CVE-2021-25765](https://cve.now/CVE-2021-25765.md): In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible. (no CVSS)
- [CVE-2021-25762](https://cve.now/CVE-2021-25762.md): In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. (no CVSS)
- [CVE-2021-25763](https://cve.now/CVE-2021-25763.md): In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default. (no CVSS)
- [CVE-2021-25761](https://cve.now/CVE-2021-25761.md): In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible. (no CVSS)
- [CVE-2020-29582](https://cve.now/CVE-2020-29582.md): In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. (no CVSS, org.jetbrains.kotlin:kotlin-stdlib)
- [CVE-2021-25760](https://cve.now/CVE-2021-25760.md): In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible. (no CVSS)
- [CVE-2021-25759](https://cve.now/CVE-2021-25759.md): In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user. (no CVSS)
- [CVE-2021-25757](https://cve.now/CVE-2021-25757.md): In JetBrains Hub before 2020.1.12629, an open redirect was possible. (no CVSS)
- [CVE-2020-28895](https://cve.now/CVE-2020-28895.md): integer overflow in calloc (CVSS 7.3)
- [CVE-2021-25758](https://cve.now/CVE-2021-25758.md): In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution. (no CVSS)
- [CVE-2021-25756](https://cve.now/CVE-2021-25756.md): In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS. (no CVSS)
- [CVE-2021-25755](https://cve.now/CVE-2021-25755.md): In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic. (no CVSS)
- [CVE-2020-28144](https://cve.now/CVE-2020-28144.md): Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 S (no CVSS)
- [CVE-2020-29166](https://cve.now/CVE-2020-29166.md): PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure (no CVSS)
- [CVE-2020-29165](https://cve.now/CVE-2020-29165.md): PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administra (no CVSS)
- [CVE-2020-29164](https://cve.now/CVE-2020-29164.md): PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2020-29163](https://cve.now/CVE-2020-29163.md): PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection. (no CVSS)
- [CVE-2020-9388](https://cve.now/CVE-2020-9388.md): CSRF protection was not present in SquaredUp before version 4.6.0. (no CVSS)
- [CVE-2020-9390](https://cve.now/CVE-2020-9390.md): SquaredUp allowed Stored XSS before version 4.6.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.