# CVEs published 2021-02-10

113 CVEs were published on February 10, 2021: 6 critical, 21 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-27874](https://cve.now/CVE-2020-27874.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18. (CVSS 8.8, Tencent WeChat)
- [CVE-2020-27871](https://cve.now/CVE-2020-27871.md): This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. (CVSS 7.2, SolarWinds Orion Platform)
- [CVE-2020-27870](https://cve.now/CVE-2020-27870.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Orion Platform 2020.2.1 (CVSS 7.5, SolarWinds Orion Platform)
- [CVE-2021-25251](https://cve.now/CVE-2021-25251.md): The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability which could allow an a (no CVSS, Trend Micro Security)
- [CVE-2020-24842](https://cve.now/CVE-2020-24842.md): PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser. (no CVSS)
- [CVE-2020-28595](https://cve.now/CVE-2020-28595.md): An out-of-bounds write vulnerability exists in the Obj.cpp load\_obj() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (commit 4 (CVSS 8.8, Prusa Research)
- [CVE-2020-28596](https://cve.now/CVE-2020-28596.md): A stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (CVSS 8.8, Prusa Research)
- [CVE-2020-13572](https://cve.now/CVE-2020-13572.md): A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-13561](https://cve.now/CVE-2020-13561.md): An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-13571](https://cve.now/CVE-2020-13571.md): An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-13585](https://cve.now/CVE-2020-13585.md): An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. (CVSS 9.8, Accusoft)
- [CVE-2020-27250](https://cve.now/CVE-2020-27250.md): In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to co (CVSS 8.8, SoftMaker)
- [CVE-2020-13583](https://cve.now/CVE-2020-13583.md): A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. (CVSS 8.6, Micrium)
- [CVE-2020-13581](https://cve.now/CVE-2020-13581.md): In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the document parser to co (CVSS 8.8, SoftMaker)
- [CVE-2021-27186](https://cve.now/CVE-2021-27186.md): Fluent Bit 1.6.10 has a NULL pointer dereference when an flb\_malloc return value is not validated by flb\_avro.c or http\_server/api/v1/metric (no CVSS)
- [CVE-2020-8355](https://cve.now/CVE-2020-8355.md): An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows OS credentials prov (CVSS 4.9, Lenovo XClarity Administrator)
- [CVE-2021-27185](https://cve.now/CVE-2021-27185.md): The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec. (no CVSS, samba-client)
- [CVE-2020-13575](https://cve.now/CVE-2020-13575.md): A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. (CVSS 7.5, Genivia gSOAP)
- [CVE-2021-21296](https://cve.now/CVE-2021-21296.md): Denial-of-service in Fleet (CVSS 2.7, fleetdm fleet)
- [CVE-2020-13565](https://cve.now/CVE-2020-13565.md): An open redirect vulnerability exists in the return\_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development v (CVSS 6.1, phpGACL)
- [CVE-2020-16120](https://cve.now/CVE-2020-16120.md): Unprivileged overlay + shiftfs read access (CVSS 5.1, Linux kernel)
- [CVE-2020-13548](https://cve.now/CVE-2020-13548.md): In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code (CVSS 8.0, Foxit)
- [CVE-2020-7021](https://cve.now/CVE-2020-7021.md): Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit\_request\_body option is (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2021-22133](https://cve.now/CVE-2021-22133.md): The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an applicatio (no CVSS, Elastic APM Agent for Go · go.elastic.co/apm)
- [CVE-2021-27139](https://cve.now/CVE-2021-27139.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27140](https://cve.now/CVE-2021-27140.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27141](https://cve.now/CVE-2021-27141.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27142](https://cve.now/CVE-2021-27142.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27143](https://cve.now/CVE-2021-27143.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27144](https://cve.now/CVE-2021-27144.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27145](https://cve.now/CVE-2021-27145.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27146](https://cve.now/CVE-2021-27146.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27147](https://cve.now/CVE-2021-27147.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27148](https://cve.now/CVE-2021-27148.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27149](https://cve.now/CVE-2021-27149.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27150](https://cve.now/CVE-2021-27150.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27151](https://cve.now/CVE-2021-27151.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27152](https://cve.now/CVE-2021-27152.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27153](https://cve.now/CVE-2021-27153.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27154](https://cve.now/CVE-2021-27154.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27155](https://cve.now/CVE-2021-27155.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27156](https://cve.now/CVE-2021-27156.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27157](https://cve.now/CVE-2021-27157.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27158](https://cve.now/CVE-2021-27158.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27159](https://cve.now/CVE-2021-27159.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27160](https://cve.now/CVE-2021-27160.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27161](https://cve.now/CVE-2021-27161.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27162](https://cve.now/CVE-2021-27162.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27163](https://cve.now/CVE-2021-27163.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27164](https://cve.now/CVE-2021-27164.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27165](https://cve.now/CVE-2021-27165.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27166](https://cve.now/CVE-2021-27166.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27167](https://cve.now/CVE-2021-27167.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27168](https://cve.now/CVE-2021-27168.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27169](https://cve.now/CVE-2021-27169.md): An issue was discovered on FiberHome AN5506-04-FA devices with firmware RP2631. (no CVSS)
- [CVE-2021-27170](https://cve.now/CVE-2021-27170.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27171](https://cve.now/CVE-2021-27171.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27172](https://cve.now/CVE-2021-27172.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27173](https://cve.now/CVE-2021-27173.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27174](https://cve.now/CVE-2021-27174.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27175](https://cve.now/CVE-2021-27175.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27176](https://cve.now/CVE-2021-27176.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27177](https://cve.now/CVE-2021-27177.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27178](https://cve.now/CVE-2021-27178.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2021-27179](https://cve.now/CVE-2021-27179.md): An issue was discovered on FiberHome HG6245D devices through RP2613. (no CVSS)
- [CVE-2020-26299](https://cve.now/CVE-2020-26299.md): File System Bounds Escape (CVSS 6.3, autovance ftp-srv · ftp-srv)
- [CVE-2021-26939](https://cve.now/CVE-2021-26939.md): An information disclosure issue exists in henriquedornas 5.2.17 because an attacker can dump phpMyAdmin SQL content. (no CVSS)
- [CVE-2021-26938](https://cve.now/CVE-2021-26938.md): A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. (no CVSS)
- [CVE-2021-26936](https://cve.now/CVE-2021-26936.md): The replay-sorcery program in ReplaySorcery 0.4.0 through 0.5.0, when using the default setuid-root configuration, allows a local attacker t (no CVSS)
- [CVE-2021-3033](https://cve.now/CVE-2021-3033.md): Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console (CVSS 9.1, Palo Alto Networks Prisma Cloud Compute)
- [CVE-2021-20353](https://cve.now/CVE-2021-20353.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML d (CVSS 8.2, IBM WebSphere Application Server)
- [CVE-2020-5023](https://cve.now/CVE-2020-5023.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.7 could allow a remote user to inject arbitrary data iwhich could cause the serivce to crash d (CVSS 7.5, IBM Spectrum Protect Plus)
- [CVE-2020-13546](https://cve.now/CVE-2020-13546.md): In SoftMaker Software GmbH SoftMaker Office TextMaker 2021 (revision 1014), a specially crafted document can cause the document parser to mi (CVSS 8.8, SoftMaker)
- [CVE-2021-0325](https://cve.now/CVE-2021-0325.md): In ih264d\_parse\_pslice of ih264d\_parse\_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0326](https://cve.now/CVE-2021-0326.md): In p2p\_copy\_client\_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0327](https://cve.now/CVE-2021-0327.md): In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored binder identities. (no CVSS, Android)
- [CVE-2021-0328](https://cve.now/CVE-2021-0328.md): In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan results without permissio (no CVSS, Android)
- [CVE-2021-0341](https://cve.now/CVE-2021-0341.md): In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used cr (no CVSS, Android · com.squareup.okhttp3:okhttp)
- [CVE-2021-0329](https://cve.now/CVE-2021-0329.md): In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0314](https://cve.now/CVE-2021-0314.md): In onCreate of UninstallerActivity, there is a possible way to uninstall an all without informed user consent due to a tapjacking/overlay at (no CVSS, Android)
- [CVE-2021-0330](https://cve.now/CVE-2021-0330.md): In add\_user\_ce and remove\_user\_ce of storaged.cpp, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2021-0331](https://cve.now/CVE-2021-0331.md): In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure default value. (no CVSS, Android)
- [CVE-2021-0332](https://cve.now/CVE-2021-0332.md): In bootFinished of SurfaceFlinger.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0333](https://cve.now/CVE-2021-0333.md): In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay that obscures the phoneb (no CVSS, Android)
- [CVE-2021-0334](https://cve.now/CVE-2021-0334.md): In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default handler for arbitrar (no CVSS, Android)
- [CVE-2021-0335](https://cve.now/CVE-2021-0335.md): In process of C2SoftHevcDec.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0336](https://cve.now/CVE-2021-0336.md): In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent. (no CVSS, Android)
- [CVE-2021-0337](https://cve.now/CVE-2021-0337.md): In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. (no CVSS, Android)
- [CVE-2021-0338](https://cve.now/CVE-2021-0338.md): In SystemSettingsValidators, there is a possible permanent denial of service due to missing bounds checks on UI settings. (no CVSS, Android)
- [CVE-2021-0302](https://cve.now/CVE-2021-0302.md): In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. (no CVSS, Android)
- [CVE-2021-0305](https://cve.now/CVE-2021-0305.md): In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. (no CVSS, Android)
- [CVE-2021-0339](https://cve.now/CVE-2021-0339.md): In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app is brought to the fo (no CVSS, Android)
- [CVE-2021-0340](https://cve.now/CVE-2021-0340.md): In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. (no CVSS, Android)
- [CVE-2021-27135](https://cve.now/CVE-2021-27135.md): xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UT (no CVSS)
- [CVE-2020-24838](https://cve.now/CVE-2020-24838.md): An integer overflow has been found in the the latest version of Issuer. (no CVSS)
- [CVE-2020-24837](https://cve.now/CVE-2020-24837.md): An integer underflow has been found in the latest version of ZCFees. (no CVSS)
- [CVE-2020-29171](https://cve.now/CVE-2020-29171.md): Cross-site scripting (XSS) vulnerability in admin/wp-security-blacklist-menu.php in the Tips and Tricks HQ All In One WP Security & Firewall (no CVSS)
- [CVE-2021-23881](https://cve.now/CVE-2021-23881.md): Stored Cross Site Scripting in ENS (CVSS 4.8, McAfee Endpoint Security (ENS) for Windows)
- [CVE-2021-23874](https://cve.now/CVE-2021-23874.md): McAfee Total Protection (MTP) privilege escalation vulnerability (CVSS 8.2, KEV, McAfee Total Protection)
- [CVE-2021-23876](https://cve.now/CVE-2021-23876.md): McAfee Total Protection (MTP) Bypass Remote Procedure call vulnerability (CVSS 7.8, McAfee Total Protection)
- [CVE-2021-23873](https://cve.now/CVE-2021-23873.md): McAfee Total Protection (MTP) privilege escalation vulnerability (CVSS 7.8, McAfee Total Protection)
- [CVE-2021-23883](https://cve.now/CVE-2021-23883.md): Null Pointer Dereference vulnerability in McAfee Endpoint Security (ENS) (CVSS 4.0, McAfee Endpoint Security (ENS) for Windows)
- [CVE-2021-23882](https://cve.now/CVE-2021-23882.md): Improper Access Control in the ENS installer (CVSS 8.2, McAfee Endpoint Security (ENS) for Windows)
- [CVE-2021-23880](https://cve.now/CVE-2021-23880.md): Improper Access Control in the ENS installer (CVSS 6.7, McAfee Endpoint Security (ENS) for Windows)
- [CVE-2021-23878](https://cve.now/CVE-2021-23878.md): Clear text storage of sensitive Information in ENS (CVSS 7.3, McAfee Endpoint Security (ENS) for Windows)
- [CVE-2021-20654](https://cve.now/CVE-2021-20654.md): Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. (no CVSS, Wekan Team Wekan)
- [CVE-2020-28870](https://cve.now/CVE-2020-28870.md): In InoERP 0.7.2, an unauthorized attacker can execute arbitrary code on the server side due to lack of validations in /modules/sys/form\_pers (no CVSS)
- [CVE-2020-13574](https://cve.now/CVE-2020-13574.md): A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. (CVSS 7.5, Genivia)
- [CVE-2020-13576](https://cve.now/CVE-2020-13576.md): A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. (CVSS 9.8, Genivia)
- [CVE-2020-13577](https://cve.now/CVE-2020-13577.md): A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. (CVSS 7.5, Genivia)
- [CVE-2020-13578](https://cve.now/CVE-2020-13578.md): A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. (CVSS 7.5, Genivia)
- [CVE-2020-28871](https://cve.now/CVE-2020-28871.md): Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an in (no CVSS)
- [CVE-2020-36244](https://cve.now/CVE-2020-36244.md): The daemon in GENIVI diagnostic log and trace (DLT), is vulnerable to a heap-based buffer overflow that could allow an attacker to remotely (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.