CVEs published in January 2021
1,871 vulnerabilities, 212 critical, 9 exploited.
- fortinet fortiwebA format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote...8.8 High
- fortinet fortiwebA stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.5 and version before 6...9.8 Critical
- fortinet fortideceptorAn OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote...8.8 High
- fortinet fortiwebA stack-based buffer overflow vulnerability in FortiWeb 6.3.0 through 6.3.7 and version before 6...5.3 Medium
- zte zxv10 b860a, zxv10 b860a firmware +1 moreA ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify...4.4 Medium
- totolink a702r firmwareDirectory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows...5.5 Medium
- skyworth gn542vf firmwareCross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and...5.4 Medium
- bosch praesensa, praesideo, praesensa firmware +1 more +3 moreStored XSS in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface4.8 Medium
- bosch praesensa, praesideo, praesensa firmware +1 more +3 moreCSRF in Bosch PRAESIDEO and Bosch PRAESENSA Management Interface8.8 High
- simplcommerceSimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog...5.4 Medium
- apache tomcat, debian linux, oracle agile product lifecycle management +2 moreApache Tomcat information disclosure5.9 Medium
- apache xmlbeans, debian linux, netapp oncommand unified manager core package +4 more +6 moreXMLBeans XML Entity Expansion9.1 Critical
- scullyCross-site Scripting (XSS)7.3 High
open-iscsiSUSESecurity update for open-iscsiNo score- php, debian linux, netapp clustered data ontap +2 moreFILTER_VALIDATE_URL accepts URLs with invalid userinfo5.3 Medium
- acmailer, acmailer db, seeds co.,ltd. acmailer and acmailer db +2 morePrivilege chaining vulnerability in acmailer ver. 4.0.2 and earlier, and acmailer DB ver. 1.1.4...9.8 Critical
- acmailer, acmailer db, seeds co.,ltd. acmailer and acmailer db +2 moreImproper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1...9.8 Critical
- discourseIn Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement...7.5 High
- debian linux, flatpak +1 moreFlatpak sandbox escape via spawn portal7.3 High
- skyworth gn542vf, gn542vf boa firmware +1 moreSkyworth GN542VF Boa version 0.94.13 does not set the Secure flag for the session cookie in an...7.5 High
- ge industrial gateway server, ptc opc-aggregator, thingworx industrial connectivity +4 more +6 moreKEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial...9.8 Critical
- ge industrial gateway server, ptc ge digital industrial gateway server, opc-aggregator +6 more +8 moreKEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial...9.1 Critical
- ge industrial gateway server, ptc ge digital industrial gateway server, opc-aggregator +6 more +8 moreKEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial...9.1 Critical
- canonical remote-login-serviceInsecure crypto for storing passwords5.5 Medium
- adobe illustratorUncontrolled search path element vulnerability in Illustrator 25.0 could lead to arbitrary code execution7.0 High
- adobe photoshopHeap buffer overflow when handling crafted font file could lead to arbitrary code execution8.6 High
- adobe animateUncontrolled Search Path Element vulnerability in Animate 21.07.0 High
- adobe campaignServer-side request forgery (SSRF) in Campaign Classic could lead to sensitive information disclosure8.6 High
- adobe incopyUncontrolled search path element in Adobe InCopy7.0 High
- adobe captivateUncontrolled Search Path Element in Adobe Captivate 20197.0 High
- adobe magento, magento commerce +1 moreMagento Commerce Insecure Direct Object Reference Could Lead To Information Disclosure8.1 High
- adobe magento commerce, magento open source +1 moreMagento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure5.3 Medium
- mi ax1800 firmware, rm1800 firmware +1 moreThere is command injection when ddns processes the hostname, which causes the administrator user...7.2 High
- mi ax1800 firmware, rm1800 firmware +1 moreThe login verification can be bypassed by using the problem that the time is not synchronized...7.5 High
- mi redmi ax6 firmwareWrong nginx configuration, causing specific paths to be downloaded without authorization. This...7.5 High
- mi ax1800 firmware, rm1800 firmware +1 moreThe data collection SDK of the router web management interface caused the leakage of the token....7.5 High
- huawei nip6800 firmware, s12700 firmware, s2700 firmware +6 more +8 moreThere is an out-of-bounds read vulnerability in several products. The software reads data past...6.5 Medium
- huawei cloudengine 12800 firmware, cloudengine 5800 firmware, cloudengine 6800 firmware +1 more +3 moreThere is an out-of-bounds read vulnerability in Huawei CloudEngine products. The software reads...6.5 Medium
- huawei smc2.0, smc2.0 firmware +1 moreThere is a privilege escalation vulnerability in SMC2.0 product. Some files in a directory of a...6.7 Medium
- huawei p30, p30 firmware +1 moreThere is a resource management errors vulnerability in Huawei P30. Local attackers construct...3.3 Low
- huawei emui, magic ui +1 moreThere is a heap-based buffer overflow vulnerability in some Huawei Smartphone, Successful exploit...5.3 Medium
- huawei emui, magic ui +1 moreThere is a improper input validation vulnerability in some Huawei Smartphone.Successful exploit...9.1 Critical
openthreadOSS-FuzzStack-buffer-overflow in ot::MeshCoP::CommissionerSessionIdTlv::GetCommissionerSessionIdNo scoreunrarOSS-FuzzUse-of-uninitialized-value in CharToWideNo scorematioOSS-FuzzHeap-buffer-overflow in H5MM_memcpyNo scorelibrawspeedOSS-FuzzUse-after-poison in rawspeed::OrfDecoder::decodeCompressedNo scoreunrarOSS-FuzzUse-of-uninitialized-value in __gxx_personality_v0No scoreunrarOSS-FuzzUse-of-uninitialized-value in CommandData::IsProcessFileNo scoreunrarOSS-FuzzUse-of-uninitialized-value in ExtractUnixLink30No scoreunrarOSS-FuzzUse-of-uninitialized-value in Unpack::MakeDecodeTablesNo score- Show moreLoading…