Skip to content
OpenAdvisories

Archive

14 January 2021

Vulnerabilities first published on this day (UTC), newest first.

← December 2020 2021 / January /14 February 2021 →
  1. 119
  2. 22
  3. 38
  4. 445
  5. 548
  6. 660
  7. 757
  8. 895
  9. 92
  10. 10 
  11. 1184
  12. 12178
  13. 13172
  14. 1429
  15. 1552
  16. 16 
  17. 172
  18. 1814
  19. 1948
  20. 20242
  21. 2172
  22. 2254
  23. 231
  24. 242
  25. 2539
  26. 2653
  27. 2744
  28. 2831
  29. 2969
  30. 304
  31. 311
All Critical High Medium Low Exploited only Public exploit

29 results · Feed

  • Unscored —
    CVE-2020-27220

    The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to …

    The Eclipse Foundation Eclipse Hono
  • Medium 6.1
    CVE-2020-27219 Public exploit

    Cross-site Scripting in Eclipse Hawkbit

    In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from …

    The Eclipse Foundation Eclipse hawkBit org.eclipse.hawkbit:hawkbit-parent Maven
  • Critical 10.0
    CVE-2020-29495

    DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A…

    Dell Avamar
  • High 8.7
    CVE-2020-29494

    Dell EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Path Traversal Vulnerability in PDM. A remote user could p…

    Dell Avamar
  • Critical 10.0
    CVE-2020-29493

    DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote …

    Dell Avamar
  • Unscored —
    CVE-2020-16046

    Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrar…

    Google Chrome Browsers
  • High 8.8
    CVE-2020-6572 Exploited EPSS 11%

    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via …

    Google Chrome chromium chromium-browser Browsers Debian Ubuntu
    KEV Jan 10, 2022
  • Unscored —
    CVE-2020-16045

    Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromi…

    Google Chrome Browsers
  • High 7.3
    CVE-2021-21261

    Flatpak sandbox escape via spawn portal

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). Th…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine
  • Medium 4.8
    CVE-2021-22132

    Insufficiently Protected Credentials in Elasticsearch

    Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensi…

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Unscored —
    CVE-2020-29015

    A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unaut…

  • Unscored —
    CVE-2020-29018

    A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the c…

    Fortinet Fortinet FortiWeb Network devices
  • Unscored —
    CVE-2020-29016

    A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6.2.4 may allow an unaut…

    Fortinet Fortinet FortiWeb Network devices
  • Unscored —
    CVE-2020-29017

    An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to…

  • Unscored —
    CVE-2020-29019

    A stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow a remote…

  • Unscored —
    CVE-2021-21722

    A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers…

  • Unscored —
    CVE-2020-27368 Public exploit

    Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /i…

  • Unscored —
    CVE-2020-26733 Public exploit

    Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16…

  • Medium 4.8
    CVE-2020-6777

    Stored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface

    A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an authenticated remote attacker with admin privileges to mount a stored Cross-Site-Scripting…

    Bosch PRAESENSA PRAESIDEO
  • High 8.8
    CVE-2020-6776

    CSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface

    A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an unauthenticated remote attacker to trigger actions on an affected system on behalf of anot…

    Bosch PRAESENSA PRAESIDEO
  • Unscored —
    CVE-2020-29587

    SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap …

  • Medium 5.9
    CVE-2021-24122 EPSS 23%

    Apache Tomcat information disclosure

    When serving resources from a network location using the NTFS file system, Apache Tomcat versions 10.0.0-M1 to 10.0.0-M9, 9.0.0.M1 to 9.0.39, 8.5.0 to 8.5.59 and 7.0.0 to 7.0.106 were susceptible to JSP source code disclosure in some configurations. The root …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • Critical 9.1
    CVE-2021-23926

    XMLBeans XML Entity Expansion

    The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

    Apache Software Foundation Apache XMLBeans xmlbeans xmlbeans Debian Ubuntu Maven
  • High 7.3
    CVE-2020-28470

    Cross-site Scripting (XSS)

    This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.

    @scullyio/scully @scullyio/ng-lib npm
  • Unscored —
    CVE-2021-20618

    Privilege chaining vulnerability in acmailer ver. 4.0.2 and earlier, and acmailer DB ver. 1.1.4 and earlier allows remo…

    Seeds acmailer and acmailer DB
  • Unscored —
    CVE-2021-20617

    Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows…

    Seeds acmailer and acmailer DB
  • Unscored —
    CVE-2021-3138 Public exploit

    In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

  • Medium 6.3
    CVE-2020-16119

    DCCP CCID structure use-after-free

    Use-after-free vulnerability in the Linux kernel exploitable by a local attacker due to reuse of a DCCP socket with an attached dccps_hc_tx_ccid object as a listener after being released. Fixed in Ubuntu Linux kernel 5.4.0-51.56, 5.3.0-68.63, 4.15.0-121.123, …

    Canonical Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.5
    CVE-2020-26732 Public exploit

    SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 does not set the Secure flag for the session cookie…