CVE-2020-20294 - An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands.
Published: February 01, 2021; 1:15:13 PM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-21180 - Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
Published: February 01, 2021; 1:15:13 PM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-21179 - Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.
Published: February 01, 2021; 1:15:13 PM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-35217 - Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is store... read CVE-2020-35217
Published: January 20, 2021; 8:15:12 AM -0500

V3.1: 8.8 HIGH
V2.0: 6.8 MEDIUM

CVE-2020-20949 - Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by ... read CVE-2020-20949
Published: January 20, 2021; 11:15:14 AM -0500

V3.1: 5.9 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2021-3164 - ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php.
Published: January 26, 2021; 1:16:27 PM -0500

V3.1: 8.8 HIGH
V2.0: 6.5 MEDIUM

CVE-2020-26278 - Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to tak... read CVE-2020-26278
Published: January 20, 2021; 5:15:11 PM -0500

V3.1: 8.0 HIGH
V2.0: 7.9 HIGH

CVE-2021-3309 - packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
Published: January 26, 2021; 4:15:13 PM -0500

V3.1: 8.1 HIGH
V2.0: 6.8 MEDIUM

CVE-2021-21253 - OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passwords without a salt, which is vulnerable to dictionary attacks. Therefore there is a threat of security breach in the voting sy... read CVE-2021-21253
Published: January 21, 2021; 10:15:14 AM -0500

V3.1: 5.3 MEDIUM
V2.0: 5.0 MEDIUM

CVE-2021-22873 - Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers t... read CVE-2021-22873
Published: January 26, 2021; 1:16:19 PM -0500

V3.1: 6.1 MEDIUM
V2.0: 5.8 MEDIUM

CVE-2020-23359 - WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.
Published: January 27, 2021; 11:15:13 AM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-35459 - An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of pr... read CVE-2020-35459
Published: January 12, 2021; 10:15:13 AM -0500

V3.1: 7.8 HIGH
V2.0: 7.2 HIGH

CVE-2020-6104 - An exploitable information disclosure vulnerability exists in the get_dnode_of_data functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause information disclosure resulting in a information disclosure. An attacker... read CVE-2020-6104
Published: October 15, 2020; 11:15:11 AM -0400

V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-6105 - An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a mal... read CVE-2020-6105
Published: October 15, 2020; 11:15:11 AM -0400

V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM

CVE-2020-6106 - An exploitable information disclosure vulnerability exists in the init_node_manager functionality of F2fs-Tools F2fs.Fsck 1.12 and 1.13. A specially crafted filesystem can be used to disclose information. An attacker can provide a malicious file t... read CVE-2020-6106
Published: October 15, 2020; 11:15:11 AM -0400

V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2020-28487 - This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
Published: January 22, 2021; 1:15:12 PM -0500

V3.1: 6.8 MEDIUM
V2.0: 6.0 MEDIUM

CVE-2020-23360 - oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php
Published: January 27, 2021; 11:15:13 AM -0500

V3.1: 9.8 CRITICAL
V2.0: 7.5 HIGH

CVE-2020-6107 - An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitialized read resulting in an information disclosure. An attacker can prov... read CVE-2020-6107
Published: October 15, 2020; 11:15:11 AM -0400

V3.1: 5.5 MEDIUM
V2.0: 4.3 MEDIUM

CVE-2021-21272 - ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. ... read CVE-2021-21272
Published: January 25, 2021; 2:15:12 PM -0500

V3.1: 7.7 HIGH
V2.0: 4.0 MEDIUM

CVE-2020-6108 - An exploitable code execution vulnerability exists in the fsck_chk_orphan_node functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause a heap buffer overflow resulting in a code execution. An attacker can provide ... read CVE-2020-6108
Published: October 15, 2020; 11:15:11 AM -0400

V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM