CVEs published February 8, 2021
76 CVEs were published on February 8, 2021: 4 critical, 4 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 4
- High
- 4
- Medium
- 8
- Low
- 3
- Unrated
- 57
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- HPE Apollo 70 System
- 14
- carrierwaveuploader carrierwave · carrierwave
- 2
- Clustered Data ONTAP
- 2
- github.com/cosmos/ethermint
- 2
- IBM Cloud Pak for Automation
- 2
- sanitize-html
- 2
- Apache ActiveMQ · org.apache.activemq:activemq-parent
- 1
- dynamoose
- 1
- Fortinet FortiIsolator
- 1
- Fortinet FortiWeb
- 1
Critical 4
High 4
- CVE-2021-26910Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat ope
- CVE-2021-21240Regular Expression Denial of Service in httplib2httplib2
- CVE-2021-21305Code Injection vulnerability in CarrierWavecarrierwaveuploader carrierwave · carrierwave
- CVE-2021-21304Prototype Pollution in Dynamoosedynamoose
Medium, low and unrated 68
- CVE-2021-3294CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php.
- CVE-2021-26917PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value
- CVE-2020-14391A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer gnome-settings-daemon
- CVE-2020-29021Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS)Secomea GateManager
- CVE-2020-8590Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node nClustered Data ONTAP
- CVE-2020-8578Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via AuClustered Data ONTAP
- CVE-2020-8587OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP clientOnCommand System Manager 9.x
- CVE-2020-13947An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp Apache ActiveMQ · org.apache.activemq:activemq-parent
- CVE-2021-25913Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead set-or-get
- CVE-2021-26916In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML t
- CVE-2021-21306Denial of Service in Markedmarkedjs marked · marked
- CVE-2021-26915NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of
- CVE-2021-26914NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of
- CVE-2021-26913NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of
- CVE-2021-26912NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of
- CVE-2020-36149Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and se
- CVE-2020-36150Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to una
- CVE-2020-36151Incorrect handling of input data in mysofa_resampler_reset_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow
- CVE-2020-36152Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted
- CVE-2021-26220The ezxml_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
- CVE-2021-26221The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
- CVE-2021-26222The ezxml_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool.
- CVE-2021-26528The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after ex
- CVE-2021-26529The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write
- CVE-2021-26530The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via c
- CVE-2020-24944picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the pi
- CVE-2020-36148Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and se
- CVE-2021-21290Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary filesnetty · io.netty:netty-codec-http +2
- CVE-2021-26576The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability iHPE Apollo 70 System
- CVE-2021-26574The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in lHPE Apollo 70 System
- CVE-2021-26577The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-26575The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in lHPE Apollo 70 System
- CVE-2021-21288Server-side request forgery in CarrierWavecarrierwaveuploader carrierwave · carrierwave
- CVE-2021-269051Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key
- CVE-2021-26573The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25172The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability iHPE Apollo 70 System
- CVE-2021-26572The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-26570The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-26571The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25171The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25169The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25170The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25168The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25835Cosmos Network Ethermint <= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module.github.com/cosmos/ethermint
- CVE-2021-25142The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.sHPE Apollo 70 System
- CVE-2021-25837Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module.
- CVE-2021-25836Cosmos Network Ethermint <= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module.
- CVE-2021-25834Cosmos Network Ethermint <= v0.4.0 is affected by a transaction replay vulnerability in the EVM module.github.com/cosmos/ethermint
- CVE-2021-26541The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.gitlog
- CVE-2021-26540Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when sanitize-html
- CVE-2021-26539Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attackesanitize-html
- CVE-2021-22122An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may alFortinet FortiWeb
- CVE-2020-6649An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexFortinet FortiIsolator
- CVE-2021-26825An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files.
- CVE-2021-26826A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files.
- CVE-2021-20359IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive informatIBM Cloud Pak for Automation
- CVE-2021-20358IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files.IBM Cloud Pak for Automation
- CVE-2020-16629PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacemen
- CVE-2021-3293emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file.
- CVE-2020-26052Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters.
- CVE-2020-26051College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdt
- CVE-2021-21436Agent is able to link customer's Config Items without permissionOTRS AG OTRSCIsInCustomerFrontend
- CVE-2021-21435Information exposure in PDF exportOTRS AG OTRS
- CVE-2021-21434XSS in Survey ModuleOTRS AG Survey
- CVE-2020-1779Dynamic templates reveal sensitive data when OTRS tags are usedOTRS AG OTRSTicketForms
- CVE-2020-35700A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allolibrenms/librenms
- CVE-2020-11920An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14.
- CVE-2020-11915An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14.