CVE-2020-27221

In Eclipse OpenJ9 up to version 0.23, there is potential for a stack-based buffer overflow when the virtual machine or JNI natives are converting from UTF-8 characters to platform encoding.

Source: CVE-2020-27221

CVE-2021-1068

NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVDEC component, in which an attacker can read from or write to a memory location that is outside the intended boundary of the buffer, which may lead to denial of service or escalation of privileges.

Source: CVE-2021-1068

CVE-2021-1067

NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the implementation of the RPMB command status, in which an attacker can write to the Write Protect Configuration Block, which may lead to denial of service or escalation of privileges.

Source: CVE-2021-1067

CVE-2021-1069

NVIDIA SHIELD TV, all versions prior to 8.2.2, contains a vulnerability in the NVHost function, which may lead to abnormal reboot due to a null pointer reference, causing data loss.

Source: CVE-2021-1069

CVE-2020-26278

Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster.

Weave Net is supplied with a manifest that runs pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods in the cluster. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power.
It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. This setting was not necessary, and is being removed.

You are only vulnerable if you have an additional vulnerability (e.g. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod,
No such bug is known at the time of release, and there are no known instances of this being exploited.

Weave Net 2.8.0 removes the hostPID setting and moves CNI plugin install to an init container.

Users who do not update to 2.8.0 can edit the hostPID line in their existing DaemonSet manifest to say false instead of true,
arrange some other way to install CNI plugins (e.g. Ansible) and remove those mounts from the DaemonSet manifest.

Source: CVE-2020-26278

CVE-2020-26252

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution.

In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml.

The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.

Source: CVE-2020-26252

CVE-2021-1250

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack against a user of the interface.
For more information about these vulnerabilities, see the Details section of this advisory.

Source: CVE-2021-1250

CVE-2021-1248

Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device.
For more information about these vulnerabilities, see the Details section of this advisory.

Source: CVE-2021-1248

CVE-2021-1249

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a remote attacker with network-operator privileges to conduct a cross-site scripting (XSS) attack or a reflected file download (RFD) attack against a user of the interface.
For more information about these vulnerabilities, see the Details section of this advisory.

Source: CVE-2021-1249

CVE-2021-1235

A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to read sensitive database files on an affected system.
The vulnerability is due to insufficient user authorization. An attacker could exploit this vulnerability by accessing the vshell of an affected system. A successful exploit could allow the attacker to read database files from the filesystem of the underlying operating system.

Source: CVE-2021-1235