# CVEs published 2021-02-19

44 CVEs were published on February 19, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2020-28248](https://cve.now/CVE-2020-28248.md): An integer overflow in the PngImg::InitStorage\_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and… (no CVSS, png-img)
- [CVE-2020-27997](https://cve.now/CVE-2020-27997.md): An issue was discovered in SmartStoreNET before 4.1.0. (no CVSS)
- [CVE-2020-24617](https://cve.now/CVE-2020-24617.md): Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax… (no CVSS)
- [CVE-2020-24393](https://cve.now/CVE-2020-24393.md): TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. (no CVSS, tweetstream)
- [CVE-2020-24392](https://cve.now/CVE-2020-24392.md): In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of… (no CVSS, twitter-stream)
- [CVE-2020-12873](https://cve.now/CVE-2020-12873.md): An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. (no CVSS)
- [CVE-2020-12668](https://cve.now/CVE-2020-12668.md): Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. (no CVSS, com.hubspot.jinjava:jinjava)
- [CVE-2021-3189](https://cve.now/CVE-2021-3189.md): The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. (no CVSS, slashify)
- [CVE-2021-27509](https://cve.now/CVE-2021-27509.md): In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. (no CVSS)
- [CVE-2021-20588](https://cve.now/CVE-2021-20588.md): Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging… (CVSS 7.5, Mitsubishi Electric CPU Module Logging Configuration To… +37)
- [CVE-2021-20587](https://cve.now/CVE-2021-20587.md): Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions… (CVSS 7.5, Mitsubishi Electric CPU Module Logging Configuration To… +37)
- [CVE-2020-35499](https://cve.now/CVE-2020-35499.md): A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco\_sock\_getsockopt function in net/bluetooth/sco.c… (no CVSS, kernel)
- [CVE-2021-26713](https://cve.now/CVE-2021-26713.md): A stack-based buffer overflow in res\_rtp\_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and… (no CVSS)
- [CVE-2021-27351](https://cve.now/CVE-2021-27351.md): The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to… (no CVSS)
- [CVE-2021-27214](https://cve.now/CVE-2021-27214.md): A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013… (no CVSS)
- [CVE-2021-27328](https://cve.now/CVE-2021-27328.md): Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. (no CVSS)
- [CVE-2020-9050](https://cve.now/CVE-2020-9050.md): Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, Johnson Controls Metasys Reporting Engine (MRE) Web Service…)
- [CVE-2020-25171](https://cve.now/CVE-2020-25171.md): Fuji Electric V-Server Lite (no CVSS, Fuji Electric V-Server Lite)
- [CVE-2020-13549](https://cve.now/CVE-2020-13549.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install… (CVSS 8.8, Sytech)
- [CVE-2021-23342](https://cve.now/CVE-2021-23342.md): Cross-site Scripting (XSS) (CVSS 8.6, docsify)
- [CVE-2021-21512](https://cve.now/CVE-2021-21512.md): Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. (CVSS 7.9, Dell Cyber Recovery)
- [CVE-2020-12374](https://cve.now/CVE-2020-12374.md): Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow a… (no CVSS, Intel(R) Server Boards, Server Systems and Compute Modules)
- [CVE-2021-22701](https://cve.now/CVE-2021-22701.md): A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800… (CVSS 6.1, PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…)
- [CVE-2021-22703](https://cve.now/CVE-2021-22703.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600… (CVSS 5.9, PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…)
- [CVE-2021-22702](https://cve.now/CVE-2021-22702.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx… (CVSS 5.9, PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85x…)
- [CVE-2021-3204](https://cve.now/CVE-2021-3204.md): SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. (no CVSS)
- [CVE-2021-3210](https://cve.now/CVE-2021-3210.md): components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound \<= 4.0.1 allows remote attackers to execute arbitrary system commands… (no CVSS)
- [CVE-2021-26296](https://cve.now/CVE-2021-26296.md): Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces (no CVSS, Apache Software Foundation Apache MyFaces Core · org.apache…)
- [CVE-2021-3339](https://cve.now/CVE-2021-3339.md): ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and… (no CVSS)
- [CVE-2020-36248](https://cve.now/CVE-2020-36248.md): The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and… (CVSS 3.9)
- [CVE-2020-36249](https://cve.now/CVE-2020-36249.md): The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares. (no CVSS)
- [CVE-2020-36250](https://cve.now/CVE-2020-36250.md): In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the… (CVSS 6.1)
- [CVE-2020-36251](https://cve.now/CVE-2020-36251.md): ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's… (CVSS 3.5)
- [CVE-2020-36252](https://cve.now/CVE-2020-36252.md): ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by… (CVSS 6.8)
- [CVE-2020-10252](https://cve.now/CVE-2020-10252.md): An issue was discovered in ownCloud before 10.4. (no CVSS)
- [CVE-2020-10254](https://cve.now/CVE-2020-10254.md): An issue was discovered in ownCloud before 10.4. (no CVSS)
- [CVE-2020-36247](https://cve.now/CVE-2020-36247.md): Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF. (no CVSS)
- [CVE-2020-24908](https://cve.now/CVE-2020-24908.md): Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the… (no CVSS)
- [CVE-2020-36246](https://cve.now/CVE-2020-36246.md): Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. (no CVSS)
- [CVE-2021-26746](https://cve.now/CVE-2021-26746.md): Chamilo 1.11.14 allows XSS via a main/calendar/agenda\_list.php?type= URI. (no CVSS)
- [CVE-2021-27405](https://cve.now/CVE-2021-27405.md): A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. (no CVSS, @progfay/scrapbox-parser)
- [CVE-2021-27403](https://cve.now/CVE-2021-27403.md): Askey RTF8115VW BR\_SV\_g11.11\_RTF\_TEF001\_V6.54\_V014 devices allow cgi-bin/te\_acceso\_router.cgi curWebPage XSS. (no CVSS)
- [CVE-2021-27404](https://cve.now/CVE-2021-27404.md): Askey RTF8115VW BR\_SV\_g11.11\_RTF\_TEF001\_V6.54\_V014 devices allow injection of a Host HTTP header. (no CVSS)
- [CVE-2019-25024](https://cve.now/CVE-2019-25024.md): OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax\_system.php… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.