CVEs published February 15, 2021
38 CVEs were published on February 15, 2021: 1 critical, 7 high. 3 are now in CISA KEV.
- Published
- 38
- Critical
- 1
- High
- 7
- Medium
- 7
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 3
- Fix available
- 11
Most affected products
- IBM Spectrum Protect Operations Center
- 3
- Atlassian Jira Server · Atlassian Jira Data Center
- 2
- Lodash · lodash-es +3
- 2
- PHP Group PHP
- 2
- Secomea GateManager
- 2
- D-Bus Development branch · dbus-1.12.x stable branch +1
- 1
- Dell Avamar
- 1
- microweber/microweber
- 1
- python/cpython · django +3
- 1
- qlib · pyqlib
- 1
Critical 1
High 7
- CVE-2021-21511Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI.Dell Avamar
- CVE-2020-29031Insecure Direct Object Reference in GateManager WebUI can cause privilege escalationSecomea GateManager
- CVE-2020-4955IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper IBM Spectrum Protect Operations Center
- CVE-2021-23337Command InjectionLodash · lodash-es +3
- CVE-2021-25296Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25297Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25298Nagios XI version xi-5.7.5 is affected by OS command injection.
Medium, low and unrated 30
- CVE-2021-26822Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php.
- CVE-2020-35734Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input field
- CVE-2021-26201The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass.
- CVE-2021-26200The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user.
- CVE-2021-3239E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code o
- CVE-2020-29143A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to exec
- CVE-2020-29139A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote
- CVE-2020-29140A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker
- CVE-2020-29142A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to
- CVE-2020-28337A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execmicroweber/microweber
- CVE-2021-27211steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
- CVE-2021-27201Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a b
- CVE-2021-3375ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execut
- CVE-2020-24899Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability.
- CVE-2020-22427NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability.
- CVE-2020-22425Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perf
- CVE-2021-27219An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3.
- CVE-2021-27218An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4.
- CVE-2020-35512A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branD-Bus Development branch · dbus-1.12.x stable branch +1
- CVE-2021-23338Deserialization of Untrusted Dataqlib · pyqlib
- CVE-2020-4956IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values toIBM Spectrum Protect Operations Center
- CVE-2020-4954IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper sIBM Spectrum Protect Operations Center
- CVE-2020-35775CITSmart before 9.1.2.23 allows LDAP Injection.
- CVE-2021-25299Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).
- CVE-2021-23336Web Cache Poisoningpython/cpython · django +3
- CVE-2020-28500Regular Expression Denial of Service (ReDoS)Lodash · lodash-es +3
- CVE-2021-21702Null Dereference in SoapClientPHP Group PHP
- CVE-2020-7071FILTER_VALIDATE_URL accepts URLs with invalid userinfoPHP Group PHP
- CVE-2020-29451Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2020-36234Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site ScAtlassian Jira Server · Atlassian Jira Data Center