# CVEs published 2021-02-08

76 CVEs were published on February 8, 2021: 4 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-3294](https://cve.now/CVE-2021-3294.md): CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. (no CVSS)
- [CVE-2021-26917](https://cve.now/CVE-2021-26917.md): PyBitmessage through 0.6.3.2 allows attackers to write screen captures to Potentially Unwanted Directories via a crafted apinotifypath value (no CVSS)
- [CVE-2020-14391](https://cve.now/CVE-2020-14391.md): A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer (no CVSS, gnome-settings-daemon)
- [CVE-2020-29021](https://cve.now/CVE-2020-29021.md): Scripting tag chars \< \> not filtered in input fields could cause Cross-Site Scripting (XSS) (CVSS 3.5, Secomea GateManager)
- [CVE-2020-8590](https://cve.now/CVE-2020-8590.md): Clustered Data ONTAP versions prior to 9.1P18 and 9.3P12 are susceptible to a vulnerability which could allow an attacker to discover node n (no CVSS, Clustered Data ONTAP)
- [CVE-2020-8578](https://cve.now/CVE-2020-8578.md): Clustered Data ONTAP versions prior to 9.3P20 are susceptible to a vulnerability which could allow an attacker to discover node names via Au (no CVSS, Clustered Data ONTAP)
- [CVE-2020-8587](https://cve.now/CVE-2020-8587.md): OnCommand System Manager 9.x versions prior to 9.3P20 and 9.4 prior to 9.4P3 are susceptible to a vulnerability that could allow HTTP client (no CVSS, OnCommand System Manager 9.x)
- [CVE-2020-13947](https://cve.now/CVE-2020-13947.md): An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp (no CVSS, Apache ActiveMQ · org.apache.activemq:activemq-parent)
- [CVE-2021-25913](https://cve.now/CVE-2021-25913.md): Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead (no CVSS, set-or-get)
- [CVE-2021-26916](https://cve.now/CVE-2021-26916.md): In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML t (no CVSS)
- [CVE-2021-21306](https://cve.now/CVE-2021-21306.md): Denial of Service in Marked (CVSS 5.3, markedjs marked · marked)
- [CVE-2021-22502](https://cve.now/CVE-2021-22502.md): Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. (CVSS 9.8, KEV, Operation Bridge Reporter.)
- [CVE-2021-26915](https://cve.now/CVE-2021-26915.md): NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of (no CVSS)
- [CVE-2021-26914](https://cve.now/CVE-2021-26914.md): NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of (no CVSS)
- [CVE-2021-26913](https://cve.now/CVE-2021-26913.md): NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of (no CVSS)
- [CVE-2021-26912](https://cve.now/CVE-2021-26912.md): NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of (no CVSS)
- [CVE-2020-36149](https://cve.now/CVE-2020-36149.md): Incorrect handling of input data in changeAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and se (no CVSS)
- [CVE-2020-36150](https://cve.now/CVE-2020-36150.md): Incorrect handling of input data in loudness function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow and access to una (no CVSS)
- [CVE-2020-36151](https://cve.now/CVE-2020-36151.md): Incorrect handling of input data in mysofa\_resampler\_reset\_mem function in the libmysofa library 0.5 - 1.1 will lead to heap buffer overflow (no CVSS)
- [CVE-2020-36152](https://cve.now/CVE-2020-36152.md): Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2021-26220](https://cve.now/CVE-2021-26220.md): The ezxml\_toxml function in ezxml 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. (no CVSS)
- [CVE-2021-26221](https://cve.now/CVE-2021-26221.md): The ezxml\_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. (no CVSS)
- [CVE-2021-26222](https://cve.now/CVE-2021-26222.md): The ezxml\_new function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool. (no CVSS)
- [CVE-2021-26528](https://cve.now/CVE-2021-26528.md): The mg\_http\_serve\_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after ex (no CVSS)
- [CVE-2021-26529](https://cve.now/CVE-2021-26529.md): The mg\_tls\_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write (no CVSS)
- [CVE-2021-26530](https://cve.now/CVE-2021-26530.md): The mg\_tls\_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via c (no CVSS)
- [CVE-2020-24944](https://cve.now/CVE-2020-24944.md): picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the pi (no CVSS)
- [CVE-2020-36148](https://cve.now/CVE-2020-36148.md): Incorrect handling of input data in verifyAttribute function in the libmysofa library 0.5 - 1.1 will lead to NULL pointer dereference and se (no CVSS)
- [CVE-2021-21290](https://cve.now/CVE-2021-21290.md): Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files (CVSS 6.2, netty · io.netty:netty-codec-http +2)
- [CVE-2021-26576](https://cve.now/CVE-2021-26576.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability i (no CVSS, HPE Apollo 70 System)
- [CVE-2021-26910](https://cve.now/CVE-2021-26910.md): Firejail before 0.9.64.4 allows attackers to bypass intended access restrictions because there is a TOCTOU race condition between a stat ope (CVSS 7.8)
- [CVE-2021-26574](https://cve.now/CVE-2021-26574.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in l (no CVSS, HPE Apollo 70 System)
- [CVE-2021-26577](https://cve.now/CVE-2021-26577.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-21240](https://cve.now/CVE-2021-21240.md): Regular Expression Denial of Service in httplib2 (CVSS 7.5, httplib2)
- [CVE-2021-26575](https://cve.now/CVE-2021-26575.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a path traversal vulnerability in l (no CVSS, HPE Apollo 70 System)
- [CVE-2021-21305](https://cve.now/CVE-2021-21305.md): Code Injection vulnerability in CarrierWave (CVSS 7.4, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2021-21288](https://cve.now/CVE-2021-21288.md): Server-side request forgery in CarrierWave (CVSS 4.3, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2021-26905](https://cve.now/CVE-2021-26905.md): 1Password SCIM Bridge before 1.6.2 mishandles validation of authenticated requests for log files, leading to disclosure of a TLS private key (no CVSS)
- [CVE-2021-26573](https://cve.now/CVE-2021-26573.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-25172](https://cve.now/CVE-2021-25172.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability i (no CVSS, HPE Apollo 70 System)
- [CVE-2021-26572](https://cve.now/CVE-2021-26572.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-26570](https://cve.now/CVE-2021-26570.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-26571](https://cve.now/CVE-2021-26571.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2020-7786](https://cve.now/CVE-2020-7786.md): Command Injection (CVSS 9.8, macfromip)
- [CVE-2021-25171](https://cve.now/CVE-2021-25171.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2020-7782](https://cve.now/CVE-2020-7782.md): Command Injection (CVSS 9.8, spritesheet-js)
- [CVE-2020-7785](https://cve.now/CVE-2020-7785.md): Command Injection (CVSS 9.8, node-ps)
- [CVE-2021-25169](https://cve.now/CVE-2021-25169.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-25170](https://cve.now/CVE-2021-25170.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-25168](https://cve.now/CVE-2021-25168.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-25835](https://cve.now/CVE-2021-25835.md): Cosmos Network Ethermint \<= v0.4.0 is affected by a cross-chain transaction replay vulnerability in the EVM module. (no CVSS, github.com/cosmos/ethermint)
- [CVE-2021-25142](https://cve.now/CVE-2021-25142.md): The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a local buffer overflow in libifc.s (no CVSS, HPE Apollo 70 System)
- [CVE-2021-25837](https://cve.now/CVE-2021-25837.md): Cosmos Network Ethermint \<= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. (no CVSS)
- [CVE-2021-25836](https://cve.now/CVE-2021-25836.md): Cosmos Network Ethermint \<= v0.4.0 is affected by cache lifecycle inconsistency in the EVM module. (no CVSS)
- [CVE-2021-25834](https://cve.now/CVE-2021-25834.md): Cosmos Network Ethermint \<= v0.4.0 is affected by a transaction replay vulnerability in the EVM module. (no CVSS, github.com/cosmos/ethermint)
- [CVE-2021-21304](https://cve.now/CVE-2021-21304.md): Prototype Pollution in Dynamoose (CVSS 7.2, dynamoose)
- [CVE-2021-26541](https://cve.now/CVE-2021-26541.md): The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability. (no CVSS, gitlog)
- [CVE-2021-26540](https://cve.now/CVE-2021-26540.md): Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when (no CVSS, sanitize-html)
- [CVE-2021-26539](https://cve.now/CVE-2021-26539.md): Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacke (no CVSS, sanitize-html)
- [CVE-2021-22122](https://cve.now/CVE-2021-22122.md): An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may al (no CVSS, Fortinet FortiWeb)
- [CVE-2020-6649](https://cve.now/CVE-2020-6649.md): An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unex (no CVSS, Fortinet FortiIsolator)
- [CVE-2021-26825](https://cve.now/CVE-2021-26825.md): An integer overflow issue exists in Godot Engine up to v3.2 that can be triggered when loading specially crafted.TGA image files. (no CVSS)
- [CVE-2021-26826](https://cve.now/CVE-2021-26826.md): A stack overflow issue exists in Godot Engine up to v3.2 and is caused by improper boundary checks when loading .TGA image files. (no CVSS)
- [CVE-2021-20359](https://cve.now/CVE-2021-20359.md): IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive informat (CVSS 6.5, IBM Cloud Pak for Automation)
- [CVE-2021-20358](https://cve.now/CVE-2021-20358.md): IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 stores potentially sensitive information in clear text in API connection log files. (CVSS 6.5, IBM Cloud Pak for Automation)
- [CVE-2020-16629](https://cve.now/CVE-2020-16629.md): PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacemen (no CVSS)
- [CVE-2021-3293](https://cve.now/CVE-2021-3293.md): emlog v5.3.1 has full path disclosure vulnerability in t/index.php, which allows an attacker to see the path to the webroot/file. (no CVSS)
- [CVE-2020-26052](https://cve.now/CVE-2020-26052.md): Online Marriage Registration System 1.0 is affected by stored cross-site scripting (XSS) vulnerabilities in multiple parameters. (no CVSS)
- [CVE-2020-26051](https://cve.now/CVE-2020-26051.md): College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdt (no CVSS)
- [CVE-2021-21436](https://cve.now/CVE-2021-21436.md): Agent is able to link customer's Config Items without permission (CVSS 3.5, OTRS AG OTRSCIsInCustomerFrontend)
- [CVE-2021-21435](https://cve.now/CVE-2021-21435.md): Information exposure in PDF export (CVSS 5.7, OTRS AG OTRS)
- [CVE-2021-21434](https://cve.now/CVE-2021-21434.md): XSS in Survey Module (CVSS 3.5, OTRS AG Survey)
- [CVE-2020-1779](https://cve.now/CVE-2020-1779.md): Dynamic templates reveal sensitive data when OTRS tags are used (CVSS 4.3, OTRS AG OTRSTicketForms)
- [CVE-2020-35700](https://cve.now/CVE-2020-35700.md): A second-order SQL injection issue in Widgets/TopDevicesController.php (aka the Top Devices dashboard widget) of LibreNMS before 21.1.0 allo (no CVSS, librenms/librenms)
- [CVE-2020-11920](https://cve.now/CVE-2020-11920.md): An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. (no CVSS)
- [CVE-2020-11915](https://cve.now/CVE-2020-11915.md): An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.