CVEs published February 19, 2021
44 CVEs were published on February 19, 2021: 0 critical, 6 high.
- Published
- 44
- Critical
- 0
- High
- 6
- Medium
- 5
- Low
- 2
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Mitsubishi Electric CPU Module Logging Configuration To… +37
- 2
- PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…
- 2
- @progfay/scrapbox-parser
- 1
- Apache Software Foundation Apache MyFaces Core · org.apache…
- 1
- com.hubspot.jinjava:jinjava
- 1
- Dell Cyber Recovery
- 1
- docsify
- 1
- Fuji Electric V-Server Lite
- 1
- Intel(R) Server Boards, Server Systems and Compute Modules
- 1
- Johnson Controls Metasys Reporting Engine (MRE) Web Service…
- 1
High 6
- CVE-2021-20588Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging ConfiguMitsubishi Electric CPU Module Logging Configuration To… +37
- CVE-2021-20587Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.11Mitsubishi Electric CPU Module Logging Configuration To… +37
- CVE-2020-9050Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Johnson Controls Metasys Reporting Engine (MRE) Web Service…
- CVE-2020-13549An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directorySytech
- CVE-2021-23342Cross-site Scripting (XSS)docsify
- CVE-2021-21512Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability.Dell Cyber Recovery
Medium, low and unrated 38
- CVE-2020-28248An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequenpng-img
- CVE-2020-27997An issue was discovered in SmartStoreNET before 4.1.0.
- CVE-2020-24617Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax beca
- CVE-2020-24393TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation.tweetstream
- CVE-2020-24392In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of ttwitter-stream
- CVE-2020-12873An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1.
- CVE-2020-12668Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.com.hubspot.jinjava:jinjava
- CVE-2021-3189The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.slashify
- CVE-2021-27509In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code.
- CVE-2020-35499A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c dokernel
- CVE-2021-26713A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certi
- CVE-2021-27351The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invali
- CVE-2021-27214A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows
- CVE-2021-27328Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal.
- CVE-2020-25171Fuji Electric V-Server LiteFuji Electric V-Server Lite
- CVE-2020-12374Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow a privIntel(R) Server Boards, Server Systems and Compute Modules
- CVE-2021-22701A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…
- CVE-2021-22703A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…
- CVE-2021-22702A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/8PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85x…
- CVE-2021-3204SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.
- CVE-2021-3210components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands wh
- CVE-2021-26296Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFacesApache Software Foundation Apache MyFaces Core · org.apache…
- CVE-2021-3339ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the
- CVE-2020-36248The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and con
- CVE-2020-36249The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.
- CVE-2020-36250In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the p
- CVE-2020-36251ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's acc
- CVE-2020-36252ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sendin
- CVE-2020-10252An issue was discovered in ownCloud before 10.4.
- CVE-2020-10254An issue was discovered in ownCloud before 10.4.
- CVE-2020-36247Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.
- CVE-2020-24908Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\lo
- CVE-2020-36246Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.
- CVE-2021-26746Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.
- CVE-2021-27405A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.@progfay/scrapbox-parser
- CVE-2021-27403Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.
- CVE-2021-27404Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.
- CVE-2019-25024OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_servic