# CVEs published 2021-02-15

38 CVEs were published on February 15, 2021: 1 critical, 7 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-21511](https://cve.now/CVE-2021-21511.md): Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. (CVSS 8.1, Dell Avamar)
- [CVE-2021-26822](https://cve.now/CVE-2021-26822.md): Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. (no CVSS)
- [CVE-2020-35734](https://cve.now/CVE-2020-35734.md): Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input field (no CVSS)
- [CVE-2021-26201](https://cve.now/CVE-2021-26201.md): The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. (no CVSS)
- [CVE-2021-26200](https://cve.now/CVE-2021-26200.md): The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user. (no CVSS)
- [CVE-2021-3239](https://cve.now/CVE-2021-3239.md): E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code o (no CVSS)
- [CVE-2020-29143](https://cve.now/CVE-2020-29143.md): A SQL injection vulnerability in interface/reports/non\_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to exec (no CVSS)
- [CVE-2020-29139](https://cve.now/CVE-2020-29139.md): A SQL injection vulnerability in interface/main/finder/patient\_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote (no CVSS)
- [CVE-2020-29140](https://cve.now/CVE-2020-29140.md): A SQL injection vulnerability in interface/reports/immunization\_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker (no CVSS)
- [CVE-2020-29142](https://cve.now/CVE-2020-29142.md): A SQL injection vulnerability in interface/usergroup/usergroup\_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to (no CVSS)
- [CVE-2020-28337](https://cve.now/CVE-2020-28337.md): A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code exec (no CVSS, microweber/microweber)
- [CVE-2021-27211](https://cve.now/CVE-2021-27211.md): steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. (no CVSS)
- [CVE-2021-27201](https://cve.now/CVE-2021-27201.md): Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a b (no CVSS)
- [CVE-2021-3375](https://cve.now/CVE-2021-3375.md): ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execut (no CVSS)
- [CVE-2020-24899](https://cve.now/CVE-2020-24899.md): Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. (no CVSS)
- [CVE-2020-22427](https://cve.now/CVE-2020-22427.md): NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. (no CVSS)
- [CVE-2020-22425](https://cve.now/CVE-2020-22425.md): Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perf (no CVSS)
- [CVE-2021-27219](https://cve.now/CVE-2021-27219.md): An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. (no CVSS)
- [CVE-2021-27218](https://cve.now/CVE-2021-27218.md): An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. (no CVSS)
- [CVE-2020-35512](https://cve.now/CVE-2020-35512.md): A use-after-free flaw was found in D-Bus Development branch \<= 1.13.16, dbus-1.12.x stable branch \<= 1.12.18, and dbus-1.10.x and older bran (no CVSS, D-Bus Development branch · dbus-1.12.x stable branch +1)
- [CVE-2020-29031](https://cve.now/CVE-2020-29031.md): Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation (CVSS 7.1, Secomea GateManager)
- [CVE-2021-23338](https://cve.now/CVE-2021-23338.md): Deserialization of Untrusted Data (CVSS 6.6, qlib · pyqlib)
- [CVE-2020-29026](https://cve.now/CVE-2020-29026.md): A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with adminis (CVSS 9.0, Secomea GateManager)
- [CVE-2020-4956](https://cve.now/CVE-2020-4956.md): IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to (CVSS 4.8, IBM Spectrum Protect Operations Center)
- [CVE-2020-4955](https://cve.now/CVE-2020-4955.md): IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper (CVSS 8.0, IBM Spectrum Protect Operations Center)
- [CVE-2020-4954](https://cve.now/CVE-2020-4954.md): IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper s (CVSS 4.2, IBM Spectrum Protect Operations Center)
- [CVE-2020-35775](https://cve.now/CVE-2020-35775.md): CITSmart before 9.1.2.23 allows LDAP Injection. (no CVSS)
- [CVE-2021-25299](https://cve.now/CVE-2021-25299.md): Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2021-23336](https://cve.now/CVE-2021-23336.md): Web Cache Poisoning (CVSS 5.9, python/cpython · django +3)
- [CVE-2021-23337](https://cve.now/CVE-2021-23337.md): Command Injection (CVSS 7.2, Lodash · lodash-es +3)
- [CVE-2020-28500](https://cve.now/CVE-2020-28500.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, Lodash · lodash-es +3)
- [CVE-2021-21702](https://cve.now/CVE-2021-21702.md): Null Dereference in SoapClient (CVSS 5.3, PHP Group PHP)
- [CVE-2020-7071](https://cve.now/CVE-2020-7071.md): FILTER\_VALIDATE\_URL accepts URLs with invalid userinfo (CVSS 5.3, PHP Group PHP)
- [CVE-2020-29451](https://cve.now/CVE-2020-29451.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure v (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-36234](https://cve.now/CVE-2020-36234.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Sc (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-25296](https://cve.now/CVE-2021-25296.md): Nagios XI version xi-5.7.5 is affected by OS command injection. (CVSS 8.8, KEV)
- [CVE-2021-25297](https://cve.now/CVE-2021-25297.md): Nagios XI version xi-5.7.5 is affected by OS command injection. (CVSS 8.8, KEV)
- [CVE-2021-25298](https://cve.now/CVE-2021-25298.md): Nagios XI version xi-5.7.5 is affected by OS command injection. (CVSS 8.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.