# CVEs published 2021-02-16

55 CVEs were published on February 16, 2021: 3 critical, 6 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2021-27104](https://cve.now/CVE-2021-27104.md): Accellion FTA 9\_12\_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. (CVSS 9.8, KEV)
- [CVE-2021-27103](https://cve.now/CVE-2021-27103.md): Accellion FTA 9\_12\_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. (CVSS 9.8, KEV)
- [CVE-2021-27102](https://cve.now/CVE-2021-27102.md): Accellion FTA 9\_12\_411 and earlier is affected by OS command execution via a local web service call. (CVSS 7.8, KEV)
- [CVE-2021-27101](https://cve.now/CVE-2021-27101.md): Accellion FTA 9\_12\_370 and earlier is affected by SQL injection via a crafted Host header in a request to document\_root.html. (CVSS 9.8, KEV)
- [CVE-2020-28918](https://cve.now/CVE-2020-28918.md): DualShield 5.9.8.0821 allows username enumeration on its login form. (CVSS 5.3)
- [CVE-2021-27203](https://cve.now/CVE-2021-27203.md): In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD\_NEITHER results in arbitrary memory dereferen (no CVSS)
- [CVE-2021-20066](https://cve.now/CVE-2021-20066.md): JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script e (no CVSS, JSDom)
- [CVE-2021-20072](https://cve.now/CVE-2021-20072.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated direct (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20071](https://cve.now/CVE-2021-20071.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs. (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20070](https://cve.now/CVE-2021-20070.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.ph (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20075](https://cve.now/CVE-2021-20075.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20074](https://cve.now/CVE-2021-20074.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20073](https://cve.now/CVE-2021-20073.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20069](https://cve.now/CVE-2021-20069.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.p (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20068](https://cve.now/CVE-2021-20068.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling fun (no CVSS, Racom MIDGE Firmware)
- [CVE-2021-20067](https://cve.now/CVE-2021-20067.md): Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication. (no CVSS, Racom MIDGE Firmware)
- [CVE-2020-11635](https://cve.now/CVE-2020-11635.md): The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with s (no CVSS, Zscaler Client Connector for Windows)
- [CVE-2020-29457](https://cve.now/CVE-2020-29457.md): A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 could allow a rogue application to establish a secure connecti (no CVSS, OPCFoundation.NetStandard.Opc.Ua.Core)
- [CVE-2021-27237](https://cve.now/CVE-2021-27237.md): The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax\_save.php. (no CVSS)
- [CVE-2021-21317](https://cve.now/CVE-2021-21317.md): Denial of Service in uap-core (CVSS 5.3, ua-parser uap-core · uap-core)
- [CVE-2021-21316](https://cve.now/CVE-2021-21316.md): Arbitrary code execution in less-openui5 (CVSS 6.3, SAP less-openui5 · less-openui5)
- [CVE-2021-21315](https://cve.now/CVE-2021-21315.md): Command Injection Vulnerability (CVSS 7.1, KEV, sebhildebrandt systeminformation · systeminformation)
- [CVE-2021-23841](https://cve.now/CVE-2021-23841.md): Null pointer deref in X509\_issuer\_and\_serial\_hash() (no CVSS, OpenSSL · openssl-src)
- [CVE-2021-23840](https://cve.now/CVE-2021-23840.md): Integer overflow in CipherUpdate (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2021-23839](https://cve.now/CVE-2021-23839.md): Incorrect SSLv2 rollback protection (no CVSS, OpenSSL)
- [CVE-2021-20987](https://cve.now/CVE-2021-20987.md): Hilscher: EtherNet/IP stack crash for specific CIP service (CVSS 8.6, Hilscher EtherNet/IP Core · Pepper+Fuchs PCV/PXV/PGV +1)
- [CVE-2021-20986](https://cve.now/CVE-2021-20986.md): Hilscher: Denial of Service vulnerability in PROFINET IO Device (CVSS 7.5, Hilscher PROFINET IO Device · Pepper+Fuchs PCV/PXV/PGV +5)
- [CVE-2020-35561](https://cve.now/CVE-2020-35561.md): SSRF in variuos products of MB connect line and Helmholz (CVSS 5.3)
- [CVE-2020-29027](https://cve.now/CVE-2020-29027.md): Reflected Cross Site Scripting (CVSS 5.4, Secomea SiteManager)
- [CVE-2020-35565](https://cve.now/CVE-2020-35565.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35567](https://cve.now/CVE-2020-35567.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-29025](https://cve.now/CVE-2020-29025.md): DOM-based Javascript injection (CVSS 5.4, Secomea SiteManager Embedded)
- [CVE-2020-35568](https://cve.now/CVE-2020-35568.md): Sensitive Information Exposure in products of MB connect line and Helmholz (CVSS 4.3)
- [CVE-2020-35559](https://cve.now/CVE-2020-35559.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35566](https://cve.now/CVE-2020-35566.md): Local file inclusion vulnerability in products of MB connect line and Helmholz (CVSS 5.3)
- [CVE-2020-35569](https://cve.now/CVE-2020-35569.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35564](https://cve.now/CVE-2020-35564.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35563](https://cve.now/CVE-2020-35563.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35560](https://cve.now/CVE-2020-35560.md): An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. (no CVSS)
- [CVE-2020-35558](https://cve.now/CVE-2020-35558.md): SSRF in products of MB connect line and Helmholz (CVSS 7.5)
- [CVE-2020-35570](https://cve.now/CVE-2020-35570.md): Foreced Browsing vulnerability in products of MB connect line and Helmholz (CVSS 5.3)
- [CVE-2020-35557](https://cve.now/CVE-2020-35557.md): Improper Access Validation in products of MB connect line and Helmholz (CVSS 6.5)
- [CVE-2020-29023](https://cve.now/CVE-2020-29023.md): CSV Formula Injection possible due to improper fields escaping in GateManager (CVSS 3.5, Secomea GateManager)
- [CVE-2020-29022](https://cve.now/CVE-2020-29022.md): Host Header Injection allowing web cache poisoning attacks (CVSS 5.3, Secomea GateManager)
- [CVE-2020-29024](https://cve.now/CVE-2020-29024.md): Missing HtppOnly and Secure flags (CVSS 5.3, Secomea GateManager)
- [CVE-2021-25648](https://cve.now/CVE-2021-25648.md): Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features (no CVSS)
- [CVE-2021-27232](https://cve.now/CVE-2021-27232.md): The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overf (no CVSS)
- [CVE-2020-25340](https://cve.now/CVE-2020-25340.md): An issue was discovered in NFStream 5.2.0. (no CVSS, nfstream)
- [CVE-2020-24841](https://cve.now/CVE-2020-24841.md): PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. (no CVSS)
- [CVE-2021-27233](https://cve.now/CVE-2021-27233.md): An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. (no CVSS)
- [CVE-2021-27234](https://cve.now/CVE-2021-27234.md): An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. (no CVSS)
- [CVE-2021-27235](https://cve.now/CVE-2021-27235.md): An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. (no CVSS)
- [CVE-2021-27236](https://cve.now/CVE-2021-27236.md): An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. (no CVSS)
- [CVE-2021-27231](https://cve.now/CVE-2021-27231.md): Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for (no CVSS)
- [CVE-2021-27229](https://cve.now/CVE-2021-27229.md): Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.