# CVEs published 2021-02-09

145 CVEs were published on February 9, 2021: 4 critical, 18 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-26951](https://cve.now/CVE-2021-26951.md): An issue was discovered in the calamine crate before 0.17.0 for Rust. (no CVSS, calamine)
- [CVE-2021-26952](https://cve.now/CVE-2021-26952.md): An issue was discovered in the ms3d crate before 0.1.3 for Rust. (no CVSS, ms3d)
- [CVE-2021-26954](https://cve.now/CVE-2021-26954.md): An issue was discovered in the qwutils crate before 0.3.1 for Rust. (no CVSS, qwutils)
- [CVE-2021-26955](https://cve.now/CVE-2021-26955.md): An issue was discovered in the xcb crate through 2021-02-04 for Rust. (no CVSS, xcb)
- [CVE-2021-26957](https://cve.now/CVE-2021-26957.md): An issue was discovered in the xcb crate through 2021-02-04 for Rust. (no CVSS, xcb)
- [CVE-2021-26958](https://cve.now/CVE-2021-26958.md): An issue was discovered in the xcb crate through 2021-02-04 for Rust. (no CVSS, xcb)
- [CVE-2021-26956](https://cve.now/CVE-2021-26956.md): An issue was discovered in the xcb crate through 2021-02-04 for Rust. (no CVSS, xcb)
- [CVE-2021-26953](https://cve.now/CVE-2021-26953.md): An issue was discovered in the postscript crate before 0.14.0 for Rust. (no CVSS, postscript)
- [CVE-2020-35125](https://cve.now/CVE-2020-35125.md): A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaSc (no CVSS, mautic/core)
- [CVE-2021-21502](https://cve.now/CVE-2021-21502.md): Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. (CVSS 9.8, Dell PowerScale OneFS)
- [CVE-2020-26196](https://cve.now/CVE-2020-26196.md): Dell EMC PowerScale OneFS versions 8.1.0-9.1.0 contain a Backup/Restore Privilege implementation issue. (CVSS 5.5, Dell PowerScale OneFS)
- [CVE-2020-26195](https://cve.now/CVE-2020-26195.md): Dell EMC PowerScale OneFS versions 8.1.2 – 9.1.0 contain an issue where the OneFS SMB directory auto-create may erroneously create a directo (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2020-26194](https://cve.now/CVE-2020-26194.md): Dell EMC PowerScale OneFS versions 8.1.2 and 8.2.2 contain an Incorrect Permission Assignment for a Critical Resource vulnerability. (CVSS 7.0, Dell PowerScale OneFS)
- [CVE-2020-26193](https://cve.now/CVE-2020-26193.md): Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain an improper input validation vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2020-26192](https://cve.now/CVE-2020-26192.md): Dell EMC PowerScale OneFS versions 8.2.0 - 9.1.0 contain a privilege escalation vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2020-26191](https://cve.now/CVE-2020-26191.md): Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2021-21479](https://cve.now/CVE-2021-21479.md): In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity o (CVSS 8.1, SAP SE SCIMono · com.sap.scimono:scimono-server)
- [CVE-2021-21478](https://cve.now/CVE-2021-21478.md): SAP Web Dynpro ABAP allow an attacker to redirect users to a malicious site due to Reverse Tabnabbing vulnerabilities. (CVSS 4.7, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2021-21476](https://cve.now/CVE-2021-21476.md): SAP UI5 versions before 1.38.49, 1.52.49, 1.60.34, 1.71.31, 1.78.18, 1.84.5, 1.85.4, 1.86.1 allows an unauthenticated attacker to redirect u (CVSS 4.7, SAP SE SAP UI5)
- [CVE-2021-21444](https://cve.now/CVE-2021-21444.md): SAP Business Objects BI Platform, versions - 410, 420, 430, allows multiple X-Frame-Options headers entries in the response headers, which m (CVSS 5.4, SAP SE SAP Business Objects Business Intelligence Platform)
- [CVE-2021-21474](https://cve.now/CVE-2021-21474.md): SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Ass (no CVSS, SAP SE SAP HANA Database)
- [CVE-2021-21477](https://cve.now/CVE-2021-21477.md): SAP Commerce Cloud, versions - 1808,1811,1905,2005,2011, enables certain users with required privileges to edit drools rules, an authenticat (CVSS 9.9, SAP SE SAP Commerce)
- [CVE-2021-21475](https://cve.now/CVE-2021-21475.md): Under specific circumstances SAP Master Data Management, versions - 710, 710.750, allows an unauthorized attacker to exploit insufficient va (CVSS 6.8, SAP SE SAP NetWeaver Master Data Management Server)
- [CVE-2021-21472](https://cve.now/CVE-2021-21472.md): SAP Software Provisioning Manager 1.0 (SAP NetWeaver Master Data Management Server 7.1) does not have an option to set password during its i (CVSS 6.3, SAP SE SAP Software Provisioning Manager)
- [CVE-2020-22839](https://cve.now/CVE-2020-22839.md): Reflected cross-site scripting vulnerability (XSS) in the evoadm.php file in b2evolution cms version 6.11.6-stable allows remote attackers t (no CVSS)
- [CVE-2021-26937](https://cve.now/CVE-2021-26937.md): encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or (no CVSS)
- [CVE-2021-26551](https://cve.now/CVE-2021-26551.md): An issue was discovered in SmartFoxServer 2.17.0. (no CVSS)
- [CVE-2021-26550](https://cve.now/CVE-2021-26550.md): An issue was discovered in SmartFoxServer 2.17.0. (no CVSS)
- [CVE-2021-26549](https://cve.now/CVE-2021-26549.md): An XSS issue was discovered in SmartFoxServer 2.17.0. (no CVSS)
- [CVE-2020-18215](https://cve.now/CVE-2020-18215.md): Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad\_id, (2) menu\_id, and (3) cashout\_id parameters, whic (no CVSS)
- [CVE-2020-13117](https://cve.now/CVE-2020-13117.md): Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key paramete (no CVSS)
- [CVE-2020-28645](https://cve.now/CVE-2020-28645.md): Deleting users with certain names caused system files to be deleted. (no CVSS)
- [CVE-2021-22267](https://cve.now/CVE-2021-22267.md): Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0 (no CVSS)
- [CVE-2020-28644](https://cve.now/CVE-2020-28644.md): The CSRF (Cross Site Request Forgery) token check was improperly implemented on cookie authenticated requests against some ocs API endpoints (no CVSS)
- [CVE-2021-3191](https://cve.now/CVE-2021-3191.md): Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows Remote Unauthorized Access for T0320L01^ABY and T0320L01^ACD, T0 (no CVSS)
- [CVE-2019-17582](https://cve.now/CVE-2019-17582.md): A use-after-free in the \_zip\_dirent\_read function of zip\_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempti (no CVSS)
- [CVE-2020-16144](https://cve.now/CVE-2020-16144.md): When using an object storage like S3 as the file store, when a user creates a public link to a folder where anonymous users can upload files (no CVSS)
- [CVE-2020-35572](https://cve.now/CVE-2020-35572.md): Adminer through 4.7.8 allows XSS via the history parameter to the default URI. (no CVSS, vrana/adminer)
- [CVE-2020-35943](https://cve.now/CVE-2020-35943.md): A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload. (no CVSS)
- [CVE-2020-35942](https://cve.now/CVE-2020-35942.md): A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusi (no CVSS)
- [CVE-2021-22663](https://cve.now/CVE-2021-22663.md): Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. (no CVSS, Cscape)
- [CVE-2021-25141](https://cve.now/CVE-2021-25141.md): A security vulnerability has been identified in in certain HPE and Aruba L2/L3 switch firmware. (no CVSS, Aruba 5400R zl2 Switch Series; Aruba 2930F Switch Series; A…)
- [CVE-2021-25140](https://cve.now/CVE-2021-25140.md): A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. (no CVSS, HPE Moonshot Provisioning Manager)
- [CVE-2021-25139](https://cve.now/CVE-2021-25139.md): A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. (no CVSS, HPE Moonshot Provisioning Manager)
- [CVE-2021-26676](https://cve.now/CVE-2021-26676.md): gdhcp in ConnMan before 1.39 could be used by network-adjacent attackers to leak sensitive stack information, allowing further exploitation (no CVSS)
- [CVE-2021-26675](https://cve.now/CVE-2021-26675.md): A stack-based buffer overflow in dnsproxy in ConnMan before 1.39 could be used by network adjacent attackers to execute code. (no CVSS)
- [CVE-2020-27857](https://cve.now/CVE-2020-27857.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-27855](https://cve.now/CVE-2020-27855.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-27856](https://cve.now/CVE-2020-27856.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17436](https://cve.now/CVE-2020-17436.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17434](https://cve.now/CVE-2020-17434.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17435](https://cve.now/CVE-2020-17435.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17433](https://cve.now/CVE-2020-17433.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17431](https://cve.now/CVE-2020-17431.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17432](https://cve.now/CVE-2020-17432.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17430](https://cve.now/CVE-2020-17430.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17428](https://cve.now/CVE-2020-17428.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17429](https://cve.now/CVE-2020-17429.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17427](https://cve.now/CVE-2020-17427.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17425](https://cve.now/CVE-2020-17425.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17426](https://cve.now/CVE-2020-17426.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17424](https://cve.now/CVE-2020-17424.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17422](https://cve.now/CVE-2020-17422.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17423](https://cve.now/CVE-2020-17423.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17420](https://cve.now/CVE-2020-17420.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 3.3, Foxit Studio Photo)
- [CVE-2020-17421](https://cve.now/CVE-2020-17421.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17419](https://cve.now/CVE-2020-17419.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2020-17418](https://cve.now/CVE-2020-17418.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. (CVSS 7.8, Foxit Studio Photo)
- [CVE-2021-25666](https://cve.now/CVE-2021-25666.md): A vulnerability has been identified in SCALANCE W780 and W740 (IEEE 802.11n) family (All versions \< V6.3). (no CVSS, Siemens SCALANCE W780 and W740 (IEEE 802.11n) family)
- [CVE-2020-27007](https://cve.now/CVE-2020-27007.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27008](https://cve.now/CVE-2020-27008.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-28392](https://cve.now/CVE-2020-28392.md): A vulnerability has been identified in SIMARIS configuration (All versions \< V4.0.1). (no CVSS, Siemens SIMARIS configuration)
- [CVE-2020-28394](https://cve.now/CVE-2020-28394.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26998](https://cve.now/CVE-2020-26998.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.2), Teamcenter Visualization (All versions \< V13.1.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-26999](https://cve.now/CVE-2020-26999.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.2), Teamcenter Visualization (All versions \< V13.1.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27000](https://cve.now/CVE-2020-27000.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27001](https://cve.now/CVE-2020-27001.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.2), Teamcenter Visualization (All versions \< V13.1.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27002](https://cve.now/CVE-2020-27002.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.2), Teamcenter Visualization (All versions \< V13.1.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27003](https://cve.now/CVE-2020-27003.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27004](https://cve.now/CVE-2020-27004.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27005](https://cve.now/CVE-2020-27005.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-27006](https://cve.now/CVE-2020-27006.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.1), Teamcenter Visualization (All versions \< V13.1.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2020-25238](https://cve.now/CVE-2020-25238.md): A vulnerability has been identified in PCS neo (Administration Console) (All versions \< V3.1), TIA Portal (V15, V15.1 and V16). (no CVSS, Siemens PCS neo · Siemens TIA Portal)
- [CVE-2020-25245](https://cve.now/CVE-2020-25245.md): A vulnerability has been identified in DIGSI 4 (All versions \< V4.94 SP1 HF 1). (no CVSS, Siemens DIGSI)
- [CVE-2020-10048](https://cve.now/CVE-2020-10048.md): A vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC WinCC (All versions \< V7.5 SP2). (no CVSS, Siemens SIMATIC PCS · Siemens SIMATIC WinCC)
- [CVE-2020-15798](https://cve.now/CVE-2020-15798.md): A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. (CVSS 9.8, Siemens SIMATIC HMI Comfort Panels · Siemens SIMATIC HMI… +8)
- [CVE-2020-25237](https://cve.now/CVE-2020-25237.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP1 Update 1), SINEMA Server (All versions \< V14.0 SP2 Update 2). (no CVSS, Siemens SINEC NMS · Siemens SINEMA Server)
- [CVE-2021-21148](https://cve.now/CVE-2021-21148.md): Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-21147](https://cve.now/CVE-2021-21147.md): Inappropriate implementation in Skia in Google Chrome prior to 88.0.4324.146 allowed a local attacker to spoof the contents of the Omnibox ( (no CVSS, Google Chrome)
- [CVE-2021-21145](https://cve.now/CVE-2021-21145.md): Use after free in Fonts in Google Chrome prior to 88.0.4324.146 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-21146](https://cve.now/CVE-2021-21146.md): Use after free in Navigation in Google Chrome prior to 88.0.4324.146 allowed a remote attacker who had compromised the renderer process to p (no CVSS, Google Chrome)
- [CVE-2021-21144](https://cve.now/CVE-2021-21144.md): Heap buffer overflow in Tab Groups in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious e (no CVSS, Google Chrome)
- [CVE-2021-21142](https://cve.now/CVE-2021-21142.md): Use after free in Payments in Google Chrome on Mac prior to 88.0.4324.146 allowed a remote attacker to potentially perform a sandbox escape (no CVSS, Google Chrome)
- [CVE-2021-21143](https://cve.now/CVE-2021-21143.md): Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious e (no CVSS, Google Chrome)
- [CVE-2021-3394](https://cve.now/CVE-2021-3394.md): Millennium Millewin (also known as "Cartella clinica") 13.39.028, 13.39.28.3342, and 13.39.146.1 has insecure folder permissions allowing a (no CVSS)
- [CVE-2020-4996](https://cve.now/CVE-2020-4996.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screen (CVSS 6.5, IBM Security Identity Governance and Intelligence)
- [CVE-2020-4995](https://cve.now/CVE-2020-4995.md): IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitiv (CVSS 4.0, IBM Security Identity Governance and Intelligence)
- [CVE-2020-4795](https://cve.now/CVE-2020-4795.md): IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially craft (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2020-4791](https://cve.now/CVE-2020-4791.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle att (CVSS 6.9, IBM Security Identity Governance and Intelligence)
- [CVE-2020-4790](https://cve.now/CVE-2020-4790.md): IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a suppl (CVSS 5.3, IBM Security Identity Governance and Intelligence)
- [CVE-2020-27257](https://cve.now/CVE-2020-27257.md): Omron CX-One (no CVSS, Omron CX-One · Omron CX-Protocol +2)
- [CVE-2020-27261](https://cve.now/CVE-2020-27261.md): Omron CX-One (no CVSS, Omron CX-One · Omron CX-Protocol +2)
- [CVE-2020-27259](https://cve.now/CVE-2020-27259.md): Omron CX-One (no CVSS, Omron CX-One · Omron CX-Protocol +2)
- [CVE-2021-26921](https://cve.now/CVE-2021-26921.md): In util/session/sessionmanager.go in Argo CD before 1.8.4, tokens continue to work even when the user account is disabled. (no CVSS)
- [CVE-2021-21141](https://cve.now/CVE-2021-21141.md): Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension (no CVSS, Google Chrome)
- [CVE-2021-21140](https://cve.now/CVE-2021-21140.md): Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access (no CVSS, Google Chrome)
- [CVE-2021-21138](https://cve.now/CVE-2021-21138.md): Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform a sandbox escape via a cra (no CVSS, Google Chrome)
- [CVE-2021-21139](https://cve.now/CVE-2021-21139.md): Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restric (no CVSS, Google Chrome)
- [CVE-2021-21137](https://cve.now/CVE-2021-21137.md): Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive in (no CVSS, Google Chrome)
- [CVE-2021-21135](https://cve.now/CVE-2021-21135.md): Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data v (no CVSS, Google Chrome)
- [CVE-2021-21136](https://cve.now/CVE-2021-21136.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin (no CVSS, Google Chrome)
- [CVE-2021-21134](https://cve.now/CVE-2021-21134.md): Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafte (no CVSS, Google Chrome)
- [CVE-2021-21132](https://cve.now/CVE-2021-21132.md): Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox e (no CVSS, Google Chrome)
- [CVE-2021-21133](https://cve.now/CVE-2021-21133.md): Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download fil (no CVSS, Google Chrome)
- [CVE-2021-21131](https://cve.now/CVE-2021-21131.md): Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem res (no CVSS, Google Chrome)
- [CVE-2021-21129](https://cve.now/CVE-2021-21129.md): Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem res (no CVSS, Google Chrome)
- [CVE-2021-21130](https://cve.now/CVE-2021-21130.md): Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem res (no CVSS, Google Chrome)
- [CVE-2021-21128](https://cve.now/CVE-2021-21128.md): Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-21126](https://cve.now/CVE-2021-21126.md): Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via (no CVSS, Google Chrome)
- [CVE-2021-21127](https://cve.now/CVE-2021-21127.md): Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security po (no CVSS, Google Chrome)
- [CVE-2021-21125](https://cve.now/CVE-2021-21125.md): Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass fil (no CVSS, Google Chrome)
- [CVE-2021-21123](https://cve.now/CVE-2021-21123.md): Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restri (no CVSS, Google Chrome)
- [CVE-2021-21124](https://cve.now/CVE-2021-21124.md): Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially pe (no CVSS, Google Chrome)
- [CVE-2021-21122](https://cve.now/CVE-2021-21122.md): Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2021-21120](https://cve.now/CVE-2021-21120.md): Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-21121](https://cve.now/CVE-2021-21121.md): Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape (no CVSS, Google Chrome)
- [CVE-2021-21119](https://cve.now/CVE-2021-21119.md): Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potenti (no CVSS, Google Chrome)
- [CVE-2021-21117](https://cve.now/CVE-2021-21117.md): Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local attacker to perform OS-level privilege (no CVSS, Google Chrome)
- [CVE-2021-21118](https://cve.now/CVE-2021-21118.md): Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds mem (no CVSS, Google Chrome)
- [CVE-2020-16044](https://cve.now/CVE-2020-16044.md): Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-26719](https://cve.now/CVE-2021-26719.md): A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin (no CVSS)
- [CVE-2020-22841](https://cve.now/CVE-2020-22841.md): Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name (no CVSS)
- [CVE-2020-22840](https://cve.now/CVE-2020-22840.md): Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker (no CVSS)
- [CVE-2021-26925](https://cve.now/CVE-2021-26925.md): Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. (no CVSS)
- [CVE-2021-23327](https://cve.now/CVE-2021-23327.md): Cross-site Scripting (XSS) (CVSS 6.3, apexcharts)
- [CVE-2020-13462](https://cve.now/CVE-2020-13462.md): Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. (no CVSS)
- [CVE-2020-13461](https://cve.now/CVE-2020-13461.md): Username enumeration in present in Tufin SecureTrack. (no CVSS)
- [CVE-2020-13460](https://cve.now/CVE-2020-13460.md): Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA. (no CVSS)
- [CVE-2020-13407](https://cve.now/CVE-2020-13407.md): Tufin SecureTrack \< R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the (no CVSS)
- [CVE-2020-13409](https://cve.now/CVE-2020-13409.md): Tufin SecureTrack \< R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the (no CVSS)
- [CVE-2020-13408](https://cve.now/CVE-2020-13408.md): Tufin SecureTrack \< R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the (no CVSS)
- [CVE-2020-24685](https://cve.now/CVE-2020-24685.md): AC500 V2 unauthenticated crafter packet vulnerability (CVSS 8.6, ABB AC500 V2 products with onboard Ethernet)
- [CVE-2021-26918](https://cve.now/CVE-2021-26918.md): The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user (CVSS 9.8)
- [CVE-2020-14343](https://cve.now/CVE-2020-14343.md): A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it pro (no CVSS, PyYAML)
- [CVE-2020-28388](https://cve.now/CVE-2020-28388.md): A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions \< V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions \< (CVSS 6.5, Siemens APOGEE PXC Compact · Siemens APOGEE PXC Modular +6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.