# CVEs published 2021-02-12

49 CVEs were published on February 12, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-26751](https://cve.now/CVE-2021-26751.md): NeDi 1.9C allows an authenticated user to perform a SQL Injection in the Monitoring History function on the endpoint /Monitoring-History.php (no CVSS)
- [CVE-2021-26752](https://cve.now/CVE-2021-26752.md): NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php (no CVSS)
- [CVE-2021-26753](https://cve.now/CVE-2021-26753.md): NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP PO (no CVSS)
- [CVE-2021-22504](https://cve.now/CVE-2021-22504.md): Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, (no CVSS, Operations Bridge Manager.)
- [CVE-2020-13949](https://cve.now/CVE-2020-13949.md): In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potential (no CVSS, Apache Thrift · org.apache.thrift:libthrift)
- [CVE-2021-22977](https://cve.now/CVE-2021-22977.md): On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to (no CVSS, BIG-IP)
- [CVE-2021-22984](https://cve.now/CVE-2021-22984.md): On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1. (no CVSS, BIG-IP Advanced WAF & BIG-IP ASM)
- [CVE-2021-22978](https://cve.now/CVE-2021-22978.md): On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x vers (no CVSS, BIG-IP)
- [CVE-2021-22983](https://cve.now/CVE-2021-22983.md): On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configurat (no CVSS, BIG-IP AFM)
- [CVE-2021-22979](https://cve.now/CVE-2021-22979.md): On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a ref (no CVSS, BIG-IP)
- [CVE-2021-22980](https://cve.now/CVE-2021-22980.md): In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerabilit (no CVSS, Edge Client)
- [CVE-2021-22981](https://cve.now/CVE-2021-22981.md): On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigate (no CVSS, BIG-IP)
- [CVE-2021-22985](https://cve.now/CVE-2021-22985.md): On BIG-IP APM version 16.0.x before 16.0.1.1, under certain conditions, when processing VPN traffic with APM, TMM consumes excessive memory. (no CVSS, BIG-IP APM)
- [CVE-2021-22982](https://cve.now/CVE-2021-22982.md): On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certai (no CVSS, BIG-IP DNS and GTM)
- [CVE-2021-22976](https://cve.now/CVE-2021-22976.md): On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all (no CVSS, BIG-IP Advanced WAF & BIG-IP ASM)
- [CVE-2021-20412](https://cve.now/CVE-2021-20412.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 contains hard-coded credentials, such as a password or cryptographic key, which it use (CVSS 5.9, IBM Security Verify Information Queue)
- [CVE-2021-20411](https://cve.now/CVE-2021-20411.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updati (CVSS 7.5, IBM Security Verify Information Queue)
- [CVE-2021-20410](https://cve.now/CVE-2021-20410.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 sends user credentials in plain clear text which can be read by an authenticated user (CVSS 5.3, IBM Security Verify Information Queue)
- [CVE-2021-20409](https://cve.now/CVE-2021-20409.md): IBM Security Verify Information Queue information disclosure (CVSS 5.9, IBM Security Verify Information Queue)
- [CVE-2021-20408](https://cve.now/CVE-2021-20408.md): IBM Security Verify Information Queue 1.0.6 and 1.0.7 could disclose highly sensitive information to a local user due to inproper storage of (CVSS 7.1, IBM Security Verify Information Queue)
- [CVE-2021-20407](https://cve.now/CVE-2021-20407.md): IBM Security Verify Information Queue information disclosure (CVSS 5.3, IBM Security Verify Information Queue)
- [CVE-2021-20406](https://cve.now/CVE-2021-20406.md): IBM Security Verify Information Queue information disclosure (CVSS 2.2, IBM Security Verify Information Queue)
- [CVE-2021-22974](https://cve.now/CVE-2021-22974.md): On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-I (no CVSS, BIG-IP, BIG-IQ)
- [CVE-2021-22973](https://cve.now/CVE-2021-22973.md): On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSO (no CVSS, BIG-IP)
- [CVE-2021-22975](https://cve.now/CVE-2021-22975.md): On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management M (no CVSS, BIG-IP)
- [CVE-2021-27197](https://cve.now/CVE-2021-27197.md): DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. (no CVSS)
- [CVE-2021-27188](https://cve.now/CVE-2021-27188.md): The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five (no CVSS)
- [CVE-2021-27187](https://cve.now/CVE-2021-27187.md): The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Sav (no CVSS)
- [CVE-2021-27204](https://cve.now/CVE-2021-27204.md): Telegram before 7.4 (212543) Stable on macOS stores the local passcode in cleartext, leading to information disclosure. (no CVSS)
- [CVE-2021-27205](https://cve.now/CVE-2021-27205.md): Telegram before 7.4 (212543) Stable on macOS stores the local copy of self-destructed messages in a sandbox path, leading to sensitive infor (no CVSS)
- [CVE-2021-20651](https://cve.now/CVE-2021-20651.md): Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an ex (no CVSS, ELECOM CO. ELECOM File Manager)
- [CVE-2021-20650](https://cve.now/CVE-2021-20650.md): Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administra (no CVSS, ELECOM CO. NCC-EWF100RMWH2)
- [CVE-2021-20648](https://cve.now/CVE-2021-20648.md): ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. (no CVSS, ELECOM CO. WRC-300FEBK-S)
- [CVE-2021-20649](https://cve.now/CVE-2021-20649.md): ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. (no CVSS, ELECOM CO. WRC-300FEBK-S)
- [CVE-2021-20647](https://cve.now/CVE-2021-20647.md): Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrato (no CVSS, ELECOM CO. WRC-300FEBK-S)
- [CVE-2021-20645](https://cve.now/CVE-2021-20645.md): Cross-site scripting vulnerability in ELECOM WRC-300FEBK-A allows remote authenticated attackers to inject arbitrary script via unspecified (no CVSS, ELECOM CO. WRC-300FEBK-A)
- [CVE-2021-20646](https://cve.now/CVE-2021-20646.md): Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrato (no CVSS, ELECOM CO. WRC-300FEBK-A)
- [CVE-2021-20644](https://cve.now/CVE-2021-20644.md): ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web se (no CVSS, ELECOM CO. WRC-1467GHBK-A)
- [CVE-2021-20643](https://cve.now/CVE-2021-20643.md): Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected devic (no CVSS, ELECOM CO. LD-PS/U1)
- [CVE-2021-20641](https://cve.now/CVE-2021-20641.md): Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrato (no CVSS, LOGITEC LAN-W300N/RS)
- [CVE-2021-20642](https://cve.now/CVE-2021-20642.md): Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) con (no CVSS, LOGITEC LAN-W300N/RS)
- [CVE-2021-20640](https://cve.now/CVE-2021-20640.md): Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command (no CVSS, LOGITEC LAN-W300N/PGRB)
- [CVE-2021-20638](https://cve.now/CVE-2021-20638.md): LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. (no CVSS, LOGITEC LAN-W300N/PGRB)
- [CVE-2021-20639](https://cve.now/CVE-2021-20639.md): LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. (no CVSS, LOGITEC LAN-W300N/PGRB)
- [CVE-2021-20637](https://cve.now/CVE-2021-20637.md): Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) c (no CVSS, LOGITEC LAN-W300N/PR5B)
- [CVE-2021-20635](https://cve.now/CVE-2021-20635.md): Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to (no CVSS, LOGITEC LAN-WH450N/GR)
- [CVE-2021-20636](https://cve.now/CVE-2021-20636.md): Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administra (no CVSS, LOGITEC LAN-W300N/PR5B)
- [CVE-2021-27190](https://cve.now/CVE-2021-27190.md): A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. (no CVSS)
- [CVE-2013-20001](https://cve.now/CVE-2013-20001.md): An issue was discovered in OpenZFS through 2.0.3. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.