CVEs published in January 2021
1,871 vulnerabilities, 212 critical, 9 exploited.
- jasper project jasper, fedoraproject fedora +1 morejp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when...5.5 Medium
- gnu glibc, debian linux, fujitsu m10-1 firmware +11 more +13 moreThe iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing...7.5 High
- apache activemq, artemis, debian linux +5 more +7 moreActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind7.5 High
htslibOSS-FuzzHeap-buffer-overflow in rans_uncompress_to_4x16No score- ftpd project ftpdOS Command Injection in ftpd9.8 Critical
- missionlabs smartagentSmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#...8.8 High
- klogserver klog serverKLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on...8.8 High
- nvidia jetson agx xavier series, jetson xavier nx, tx1, tx2, nano and nano 2gb, linux for tegra +1 moreNVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB,...5.6 Medium
- nvidia jetson agx xavier series, jetson xavier nx, tx1, tx2, nano and nano 2gb, linux for tegra +1 moreNVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions...7.1 High
- winmail project winmailA SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An...7.5 High
- winmail project winmailA reflected XSS vulnerability exists in tohtml/convert.php of Winmail 6.5, which can cause...6.1 Medium
- tendermintDenial of service in TenderMint Core6.5 Medium
- flarum stickyXSS in Flarum Sticky extension.5.4 Medium
- ckeditor, oracle agile product lifecycle management, application express +7 more +9 moreInclusion of Functionality from Untrusted Control Sphere in CKEditor 46.5 Medium
- ckeditor, oracle agile product lifecycle management, application express +4 more +6 moreCKEditor 4 ReDoS Vulnerability6.5 Medium
- diygod rsshubRisk of code injection in RSSHub8.6 High
- wekan project wekanpackages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they...8.1 High
- xen, fedoraproject fedora +1 moreAn issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest...5.5 Medium
- proofpoint insider threat managementInsider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint...7.8 High
- honeywell opc ua tunnellerThe affected product has uncontrolled resource consumption issues, which may allow an attacker to...7.5 High
- honeywell opc ua tunnellerThe affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker...9.8 Critical
- honeywell opc ua tunnellerThe affected product is vulnerable to an out-of-bounds read, which may allow an attacker to...9.1 Critical
- honeywell opc ua tunnellerSome parsing functions in the affected product do not check the return value of malloc and the...7.5 High
- silabs micrium uc-httpA denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01...8.6 High
- tibco bpm enterprise, tibco software inc. bpm enterprise distribution for tibco silver fabric, tibco bpm enterprise distribution for silver fabric +2 moreTIBCO BPM Cross Site Scripting (XSS)4.6 Medium
- egavilanmedia user registration and login system with admin panelEgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin...9.8 Critical
- newbee-mall project newbee-mallnewbee-mall all versions are affected by incorrect access control to remotely gain privileges...7.5 High
- newbee-mall project newbee-mallnewbee-mall all versions are affected by incorrect access control to remotely gain privileges...9.8 Critical
- newbee-mall project newbee-mallnewbee-mall 1.0 is affected by cross-site scripting in shop-cart/settle. Users only need to write...6.1 Medium
- hackerone nextcloud server, nextcloud server +1 moreA wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when...7.5 High
- hackerone nextcloud server, nextcloud server +1 moreA missing input validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows users to...6.5 Medium
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity...8.2 High
- ibm spectrum scaleIBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files...4.0 Medium
- apache hadoop, solr, oracle financial services crime and compliance management studio +2 moreImproper Privilege Management in Apache Hadoop8.8 High
- delta electronics tpeditorTPEditor (v1.98 and prior) is vulnerable to two out-of-bounds write instances in the way it...7.8 High
- delta electronics ispsoftA use after free issue has been identified in the way ISPSoft(v3.12 and prior) processes project...7.8 High
- delta electronics tpeditorAn untrusted pointer dereference has been identified in the way TPEditor(v1.98 and prior)...7.8 High
- reolink rlc-410 firmware, rlc-422 firmware, rlc-423 firmware +7 more +9 moreReolink P2P Cameras7.5 High
- reolink rlc-410 firmware, rlc-422 firmware, rlc-423 firmware +7 more +9 moreReolink P2P Cameras7.8 High
- apache traffic controlCache Manipulation Attack in Apache Traffic Control5.8 Medium
- messagepack-rs project messagepack-rsUse of Uninitialized Resource in messagepack-rs.9.8 Critical
- messagepack-rs project messagepack-rsUse of Uninitialized Resource in messagepack-rs.9.8 Critical
- messagepack-rs project messagepack-rsUse of Uninitialized Resource in messagepack-rs9.8 Critical
- messagepack-rs project messagepack-rsDeserialization functions pass uninitialized memory to user-provided Read9.8 Critical
- insert many project manyDouble free in insert_many7.5 High
- ms3d project ms3dUse of Uninitialized Resource in ms3d7.5 High
- marc project marcUninitialized buffer use in marc7.5 High
- jenkinsTime-of-check Time-of-use (TOCTOU) Race Condition in Jenkins5.3 Medium
- google chrome, microsoft edge +1 moreInsufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed...6.5 Medium
- google chrome, microsoft edge +1 moreUninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to...6.8 Medium
- Show moreLoading…