CVEs published February 18, 2021
38 CVEs were published on February 18, 2021: 1 critical, 5 high.
- Published
- 38
- Critical
- 1
- High
- 5
- Medium
- 8
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- IBM Maximo for Civil Infrastructure
- 4
- HMI/SCADA iFIX
- 2
- async-git
- 1
- Atlassian Bitbucket Server · Atlassian Bitbucket Data Center
- 1
- Atlassian Confluence Server · Atlassian Confluence Data Cen…
- 1
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- Atlassian Jira Server for Slack
- 1
- com.fasterxml.jackson.dataformat:jackson-dataformat-cbor
- 1
- IBM Jazz Reporting Service
- 1
- IBM WebSphere Application Server
- 1
Critical 1
High 5
- CVE-2020-28499Prototype Pollutionmerge
- CVE-2021-23341Regular Expression Denial of Service (ReDoS)prismjs
- CVE-2020-28491Denial of Service (DoS)com.fasterxml.jackson.dataformat:jackson-dataformat-cbor
- CVE-2021-23340Local File Inclusionpimcore/pimcore
- CVE-2020-28496Regular Expression Denial of Service (ReDoS)three
Medium, low and unrated 32
- CVE-2020-19513Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a crafted input that will
- CVE-2021-26747Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execut
- CVE-2021-26712Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a r
- CVE-2020-35776A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash
- CVE-2021-26906An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1
- CVE-2021-26717An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16
- CVE-2020-35592Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI.
- CVE-2020-35591Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation.
- CVE-2021-27335KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCo
- CVE-2021-27329Friendica 2021.01 allows SSRF via parse_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names.
- CVE-2021-21318Removing access may not effect published seriesopencast
- CVE-2020-28463Server-side Request Forgery (SSRF)reportlab
- CVE-2021-26068An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary Atlassian Jira Server for Slack
- CVE-2020-36233The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7Atlassian Bitbucket Server · Atlassian Bitbucket Data Center
- CVE-2021-20446IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting.IBM Maximo for Civil Infrastructure
- CVE-2021-20445IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credIBM Maximo for Civil Infrastructure
- CVE-2021-20444IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting.IBM Maximo for Civil Infrastructure
- CVE-2021-20443IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intendeIBM Maximo for Civil Infrastructure
- CVE-2021-20354IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories.IBM WebSphere Application Server
- CVE-2020-4933IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting.IBM Jazz Reporting Service
- CVE-2020-29453The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2020-29448The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7Atlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2021-27379An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possib
- CVE-2019-18243HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry.HMI/SCADA iFIX
- CVE-2019-18255HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects.HMI/SCADA iFIX
- CVE-2020-35577In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file
- CVE-2020-29664A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a mal
- CVE-2021-27376An issue was discovered in the nb-connect crate before 1.0.3 for Rust.nb-connect
- CVE-2021-27377An issue was discovered in the yottadb crate before 1.2.0 for Rust.yottadb
- CVE-2021-27378An issue was discovered in the rand_core crate before 0.6.2 for Rust.rand_core
- CVE-2021-27124SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump
- CVE-2021-27375Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.