# CVEs published 2021-02-11

96 CVEs were published on February 11, 2021: 7 critical, 39 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-27869](https://cve.now/CVE-2020-27869.md): This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 H (CVSS 8.8, SolarWinds Network Performance Monitor)
- [CVE-2020-27868](https://cve.now/CVE-2020-27868.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. (CVSS 9.8, Qognify Ocularis)
- [CVE-2020-27867](https://cve.now/CVE-2020-27867.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R62 (CVSS 6.8, NETGEAR Multiple Routers)
- [CVE-2020-27865](https://cve.now/CVE-2020-27865.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version (CVSS 8.8, D-Link DAP-1860)
- [CVE-2020-27866](https://cve.now/CVE-2020-27866.md): This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R622 (CVSS 8.8, NETGEAR Multiple Routers)
- [CVE-2020-27864](https://cve.now/CVE-2020-27864.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version (CVSS 8.8, D-Link DAP-1860)
- [CVE-2020-27863](https://cve.now/CVE-2020-27863.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL- (CVSS 6.5, D-Link Multiple Routers)
- [CVE-2020-27861](https://cve.now/CVE-2020-27861.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. (CVSS 8.8, NETGEAR Orbi)
- [CVE-2020-27862](https://cve.now/CVE-2020-27862.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A ro (CVSS 8.8, D-Link Multiple Routers)
- [CVE-2020-27860](https://cve.now/CVE-2020-27860.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. (CVSS 7.8, Foxit Reader)
- [CVE-2021-21310](https://cve.now/CVE-2021-21310.md): Token verification bug in next-auth (CVSS 6.1, nextauthjs next-auth · next-auth)
- [CVE-2021-21311](https://cve.now/CVE-2021-21311.md): SSRF in adminer (CVSS 7.2, KEV, vrana adminer · vrana/adminer)
- [CVE-2021-21976](https://cve.now/CVE-2021-21976.md): vSphere Replication 8.3.x prior to 8.3.1.2, 8.2.x prior to 8.2.1.1, 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authent (no CVSS, vSphere Replication)
- [CVE-2020-9307](https://cve.now/CVE-2020-9307.md): Hirschmann OS2, RSP, and RSPE devices before HiOS 08.3.00 allow a denial of service. (no CVSS)
- [CVE-2021-21014](https://cve.now/CVE-2021-21014.md): Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21053](https://cve.now/CVE-2021-21053.md): Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-21054](https://cve.now/CVE-2021-21054.md): Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-21055](https://cve.now/CVE-2021-21055.md): Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure (CVSS 6.2, Adobe Dreamweaver)
- [CVE-2021-21052](https://cve.now/CVE-2021-21052.md): Adobe Animate Out-of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Animate)
- [CVE-2021-21049](https://cve.now/CVE-2021-21049.md): Adobe Photoshop Out-Of-Bounds Read Vulnerability Could Lead To Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21048](https://cve.now/CVE-2021-21048.md): Adobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21050](https://cve.now/CVE-2021-21050.md): Adobe Photoshop Out-Of-Bounds Read Vulnerability Could Lead To Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21047](https://cve.now/CVE-2021-21047.md): Adobe Photoshop Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-21051](https://cve.now/CVE-2021-21051.md): Adobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2019-19005](https://cve.now/CVE-2019-19005.md): A bitmap double free in main.c in autotrace 0.31.1 allows attackers to cause an unspecified impact via a malformed bitmap image. (no CVSS)
- [CVE-2019-19004](https://cve.now/CVE-2019-19004.md): A biWidth\*biBitCnt integer overflow in input-bmp.c in autotrace 0.31.1 allows attackers to provide an unexpected input value to malloc via a (no CVSS)
- [CVE-2021-21063](https://cve.now/CVE-2021-21063.md): Acrobat Reader DC Buffer Overflow Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21062](https://cve.now/CVE-2021-21062.md): Acrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21059](https://cve.now/CVE-2021-21059.md): Acrobat Reader DC Buffer Overflow Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21058](https://cve.now/CVE-2021-21058.md): Acrobat Reader DC Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21036](https://cve.now/CVE-2021-21036.md): Acrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21034](https://cve.now/CVE-2021-21034.md): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 4.3, Adobe Acrobat Reader)
- [CVE-2021-21039](https://cve.now/CVE-2021-21039.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21041](https://cve.now/CVE-2021-21041.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21033](https://cve.now/CVE-2021-21033.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-21021](https://cve.now/CVE-2021-21021.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-21035](https://cve.now/CVE-2021-21035.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-21038](https://cve.now/CVE-2021-21038.md): Acrobat Reader DC Out-Of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21040](https://cve.now/CVE-2021-21040.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21028](https://cve.now/CVE-2021-21028.md): Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution (CVSS 8.8, Adobe Acrobat Reader · com.adobe.acs:acs-aem-commons)
- [CVE-2021-21037](https://cve.now/CVE-2021-21037.md): Acrobat Reader DC Path Traversal Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21057](https://cve.now/CVE-2021-21057.md): Acrobat Reader DC Invalid Memory Read Due To An Uninitialized Pointer (CVSS 6.6, Adobe Acrobat Reader)
- [CVE-2021-21046](https://cve.now/CVE-2021-21046.md): Acrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-21044](https://cve.now/CVE-2021-21044.md): Acrobat Reader DC Out-Of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-21061](https://cve.now/CVE-2021-21061.md): Acrobat Pro DC Use-After-Free Vulnerability Could Lead to Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-21045](https://cve.now/CVE-2021-21045.md): Acrobat Reader DC Improper Installer Access Control Vulnerability Could Lead To Privilege Escalation (CVSS 8.2, Adobe Acrobat Reader)
- [CVE-2021-21017](https://cve.now/CVE-2021-21017.md): Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution (CVSS 8.8, KEV, Adobe Acrobat Reader)
- [CVE-2021-21042](https://cve.now/CVE-2021-21042.md): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 6.5, Adobe Acrobat Reader)
- [CVE-2021-21060](https://cve.now/CVE-2021-21060.md): Acrobat Pro DC Improper File Parsing Could Lead to Information Disclosure (CVSS 4.6, Adobe Acrobat Reader)
- [CVE-2021-21016](https://cve.now/CVE-2021-21016.md): Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21025](https://cve.now/CVE-2021-21025.md): Magento Commerce XML Injection Could Lead To Arbitrary Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21018](https://cve.now/CVE-2021-21018.md): Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21032](https://cve.now/CVE-2021-21032.md): Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access (CVSS 5.6, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21029](https://cve.now/CVE-2021-21029.md): Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution (CVSS 4.8, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21015](https://cve.now/CVE-2021-21015.md): Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution (CVSS 8.0, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21019](https://cve.now/CVE-2021-21019.md): Magento Commerce XML Injection Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21020](https://cve.now/CVE-2021-21020.md): Magento Commerce Improper Access Control Vulnerability (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21024](https://cve.now/CVE-2021-21024.md): Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access (CVSS 9.1, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21026](https://cve.now/CVE-2021-21026.md): Magento Commerce Incorrect permissions Could Lead To Unauthorized Access (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21023](https://cve.now/CVE-2021-21023.md): Magento Commerce Stored Cross Site Scripting Vulnerability Could Lead To Arbitrary Code Execution (CVSS 4.8, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21022](https://cve.now/CVE-2021-21022.md): Magento Commerce Incorrect permissions Could Lead To Unauthorized Access (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21030](https://cve.now/CVE-2021-21030.md): Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution (CVSS 8.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21027](https://cve.now/CVE-2021-21027.md): Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification (CVSS 4.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21031](https://cve.now/CVE-2021-21031.md): Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access (CVSS 5.6, Adobe Magento.com · magento/community-edition +1)
- [CVE-2021-21307](https://cve.now/CVE-2021-21307.md): Remote Code Exploit in Lucee Admin (CVSS 8.6, Lucee)
- [CVE-2021-21301](https://cve.now/CVE-2021-21301.md): Video feed was captured while user has disabled video (CVSS 2.6, wireapp wire-ios)
- [CVE-2021-21299](https://cve.now/CVE-2021-21299.md): Multiple Transfer-Encoding headers misinterprets request payload (CVSS 4.8, hyperium hyper · hyper)
- [CVE-2020-25493](https://cve.now/CVE-2020-25493.md): Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. (no CVSS)
- [CVE-2021-20405](https://cve.now/CVE-2021-20405.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized activities due to improper encoding of outp (CVSS 3.1, IBM Security Verify Information Queue)
- [CVE-2021-20404](https://cve.now/CVE-2021-20404.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cooki (CVSS 2.6, IBM Security Verify Information Queue)
- [CVE-2021-20403](https://cve.now/CVE-2021-20403.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an attacker to execute m (CVSS 3.1, IBM Security Verify Information Queue)
- [CVE-2021-20402](https://cve.now/CVE-2021-20402.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when a detailed technica (CVSS 2.7, IBM Security Verify Information Queue)
- [CVE-2020-4768](https://cve.now/CVE-2020-4768.md): IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scripting. (CVSS 4.4, IBM Business Automation Workflow · IBM Case Manager)
- [CVE-2021-27191](https://cve.now/CVE-2021-27191.md): The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. (no CVSS, get-ip-range)
- [CVE-2021-22881](https://cve.now/CVE-2021-22881.md): The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22880](https://cve.now/CVE-2021-22880.md): The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnera (no CVSS, https://github.com/rails/rails · activerecord)
- [CVE-2020-8027](https://cve.now/CVE-2020-8027.md): openldap uses fixed paths in /tmp (CVSS 7.3, SUSE Linux Enterprise Server 15-LTSS · SUSE Linux Enterp… +1)
- [CVE-2021-22652](https://cve.now/CVE-2021-22652.md): Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attac (no CVSS, Advantech iView)
- [CVE-2021-22656](https://cve.now/CVE-2021-22656.md): Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files. (no CVSS, Advantech iView)
- [CVE-2021-22658](https://cve.now/CVE-2021-22658.md): Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Adm (no CVSS, Advantech iView)
- [CVE-2021-22654](https://cve.now/CVE-2021-22654.md): Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose infor (no CVSS, Advantech iView)
- [CVE-2020-8030](https://cve.now/CVE-2020-8030.md): skuba: Insecure /tmp usage when joining node to cluster (CVSS 3.6, SUSE CaaS Platform)
- [CVE-2020-8029](https://cve.now/CVE-2020-8029.md): skuba: Insecure handling of private key (CVSS 2.9, SUSE CaaS Platform)
- [CVE-2021-20188](https://cve.now/CVE-2021-20188.md): A flaw was found in podman before 1.7.0. (no CVSS, podman · github.com/containers/libpod)
- [CVE-2020-10734](https://cve.now/CVE-2020-10734.md): A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. (no CVSS, keycloak · org.keycloak:keycloak-oidc-client-adapter-pom)
- [CVE-2020-1717](https://cve.now/CVE-2020-1717.md): A flaw was found in Keycloak 7.0.1. (no CVSS, keycloak · org.keycloak:keycloak-parent)
- [CVE-2021-25688](https://cve.now/CVE-2021-25688.md): Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21 (no CVSS, - PCoIP Standard Agent for Windows - PCoIP Standard Agent f…)
- [CVE-2021-25689](https://cve.now/CVE-2021-25689.md): An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remotely execute code. (no CVSS, - PCoIP Soft Client for Windows - PCoIP Soft Client for Lin…)
- [CVE-2021-25690](https://cve.now/CVE-2021-25690.md): A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the software. (no CVSS, - PCoIP Soft Client for Windows - PCoIP Soft Client for Lin…)
- [CVE-2020-13186](https://cve.now/CVE-2020-13186.md): An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed a (no CVSS, - Cloud Access Connector - Cloud Access Connector Legacy)
- [CVE-2020-13185](https://cve.now/CVE-2020-13185.md): Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the n (no CVSS, - Cloud Access Connector - Cloud Access Connector Legacy)
- [CVE-2020-8031](https://cve.now/CVE-2020-8031.md): obs: Stored XSS (CVSS 6.3, openSUSE Open Build Service)
- [CVE-2021-23335](https://cve.now/CVE-2021-23335.md): LDAP Injection (CVSS 7.5, is-user-valid)
- [CVE-2021-20335](https://cve.now/CVE-2021-20335.md): SSL may be unexpectedly disabled during upgrade of multiple-server MongoDB Ops Manager (CVSS 6.7, MongoDB Ops Manager)
- [CVE-2021-27184](https://cve.now/CVE-2021-27184.md): Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter entities technique), r (no CVSS)
- [CVE-2020-35498](https://cve.now/CVE-2020-35498.md): A vulnerability was found in openvswitch. (CVSS 7.5, openvswitch)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.