CVEs published February 16, 2021
55 CVEs were published on February 16, 2021: 3 critical, 6 high. 5 are now in CISA KEV.
- Published
- 55
- Critical
- 3
- High
- 6
- Medium
- 12
- Low
- 1
- Unrated
- 33
- Now in CISA KEV
- 5
- Fix available
- 15
Most affected products
- Racom MIDGE Firmware
- 9
- Secomea GateManager
- 3
- OpenSSL · openssl-src
- 2
- Hilscher EtherNet/IP Core · Pepper+Fuchs PCV/PXV/PGV +1
- 1
- Hilscher PROFINET IO Device · Pepper+Fuchs PCV/PXV/PGV +5
- 1
- JSDom
- 1
- nfstream
- 1
- OPCFoundation.NetStandard.Opc.Ua.Core
- 1
- OpenSSL
- 1
- SAP less-openui5 · less-openui5
- 1
Critical 3
- CVE-2021-27104Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints.
- CVE-2021-27103Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html.
- CVE-2021-27101Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html.
High 6
- CVE-2021-27102Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call.
- CVE-2021-21315Command Injection Vulnerabilitysebhildebrandt systeminformation · systeminformation
- CVE-2021-23840Integer overflow in CipherUpdateOpenSSL · openssl-src
- CVE-2021-20987Hilscher: EtherNet/IP stack crash for specific CIP serviceHilscher EtherNet/IP Core · Pepper+Fuchs PCV/PXV/PGV +1
- CVE-2021-20986Hilscher: Denial of Service vulnerability in PROFINET IO DeviceHilscher PROFINET IO Device · Pepper+Fuchs PCV/PXV/PGV +5
- CVE-2020-35558SSRF in products of MB connect line and Helmholz
Medium, low and unrated 46
- CVE-2020-28918DualShield 5.9.8.0821 allows username enumeration on its login form.
- CVE-2021-27203In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbitrary memory dereferen
- CVE-2021-20066JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script eJSDom
- CVE-2021-20072Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directRacom MIDGE Firmware
- CVE-2021-20071Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs.Racom MIDGE Firmware
- CVE-2021-20070Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.phRacom MIDGE Firmware
- CVE-2021-20075Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd.Racom MIDGE Firmware
- CVE-2021-20074Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OSRacom MIDGE Firmware
- CVE-2021-20073Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries.Racom MIDGE Firmware
- CVE-2021-20069Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.pRacom MIDGE Firmware
- CVE-2021-20068Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling funRacom MIDGE Firmware
- CVE-2021-20067Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication.Racom MIDGE Firmware
- CVE-2020-11635The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with sZscaler Client Connector for Windows
- CVE-2020-29457A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connectiOPCFoundation.NetStandard.Opc.Ua.Core
- CVE-2021-27237The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.
- CVE-2021-21317Denial of Service in uap-coreua-parser uap-core · uap-core
- CVE-2021-21316Arbitrary code execution in less-openui5SAP less-openui5 · less-openui5
- CVE-2021-23841Null pointer deref in X509_issuer_and_serial_hash()OpenSSL · openssl-src
- CVE-2021-23839Incorrect SSLv2 rollback protectionOpenSSL
- CVE-2020-35561SSRF in variuos products of MB connect line and Helmholz
- CVE-2020-29027Reflected Cross Site ScriptingSecomea SiteManager
- CVE-2020-35565An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35567An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-29025DOM-based Javascript injectionSecomea SiteManager Embedded
- CVE-2020-35568Sensitive Information Exposure in products of MB connect line and Helmholz
- CVE-2020-35559An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35566Local file inclusion vulnerability in products of MB connect line and Helmholz
- CVE-2020-35569An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35564An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35563An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35560An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2.
- CVE-2020-35570Foreced Browsing vulnerability in products of MB connect line and Helmholz
- CVE-2020-35557Improper Access Validation in products of MB connect line and Helmholz
- CVE-2020-29023CSV Formula Injection possible due to improper fields escaping in GateManagerSecomea GateManager
- CVE-2020-29022Host Header Injection allowing web cache poisoning attacksSecomea GateManager
- CVE-2020-29024Missing HtppOnly and Secure flagsSecomea GateManager
- CVE-2021-25648Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features
- CVE-2021-27232The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overf
- CVE-2020-25340An issue was discovered in NFStream 5.2.0.nfstream
- CVE-2020-24841PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp.
- CVE-2021-27233An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8.
- CVE-2021-27234An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8.
- CVE-2021-27235An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8.
- CVE-2021-27236An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8.
- CVE-2021-27231Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for
- CVE-2021-27229Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text