# CVEs published 2021-02-18

38 CVEs were published on February 18, 2021: 1 critical, 5 high. Days are UTC.

- [CVE-2020-19513](https://cve.now/CVE-2020-19513.md): Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a crafted input that will (no CVSS)
- [CVE-2021-26747](https://cve.now/CVE-2021-26747.md): Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execut (no CVSS)
- [CVE-2021-26712](https://cve.now/CVE-2021-26712.md): Incorrect access controls in res\_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a r (no CVSS)
- [CVE-2020-35776](https://cve.now/CVE-2020-35776.md): A buffer overflow in res\_pjsip\_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash (no CVSS)
- [CVE-2021-26906](https://cve.now/CVE-2021-26906.md): An issue was discovered in res\_pjsip\_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1 (no CVSS)
- [CVE-2021-26717](https://cve.now/CVE-2021-26717.md): An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16 (no CVSS)
- [CVE-2020-35592](https://cve.now/CVE-2020-35592.md): Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. (no CVSS)
- [CVE-2020-35591](https://cve.now/CVE-2020-35591.md): Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. (no CVSS)
- [CVE-2021-27335](https://cve.now/CVE-2021-27335.md): KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCo (no CVSS)
- [CVE-2021-27329](https://cve.now/CVE-2021-27329.md): Friendica 2021.01 allows SSRF via parse\_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names. (no CVSS)
- [CVE-2021-21318](https://cve.now/CVE-2021-21318.md): Removing access may not effect published series (CVSS 5.4, opencast)
- [CVE-2020-28499](https://cve.now/CVE-2020-28499.md): Prototype Pollution (CVSS 7.3, merge)
- [CVE-2021-23341](https://cve.now/CVE-2021-23341.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, prismjs)
- [CVE-2020-28463](https://cve.now/CVE-2020-28463.md): Server-side Request Forgery (SSRF) (CVSS 6.5, reportlab)
- [CVE-2020-28491](https://cve.now/CVE-2020-28491.md): Denial of Service (DoS) (CVSS 7.5, com.fasterxml.jackson.dataformat:jackson-dataformat-cbor)
- [CVE-2021-26068](https://cve.now/CVE-2021-26068.md): An endpoint in Atlassian Jira Server for Slack plugin from version 0.0.3 before version 2.0.15 allows remote attackers to execute arbitrary (no CVSS, Atlassian Jira Server for Slack)
- [CVE-2020-36233](https://cve.now/CVE-2020-36233.md): The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7 (no CVSS, Atlassian Bitbucket Server · Atlassian Bitbucket Data Center)
- [CVE-2021-20446](https://cve.now/CVE-2021-20446.md): IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo for Civil Infrastructure)
- [CVE-2021-20445](https://cve.now/CVE-2021-20445.md): IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication cred (CVSS 6.5, IBM Maximo for Civil Infrastructure)
- [CVE-2021-20444](https://cve.now/CVE-2021-20444.md): IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Maximo for Civil Infrastructure)
- [CVE-2021-20443](https://cve.now/CVE-2021-20443.md): IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intende (CVSS 6.3, IBM Maximo for Civil Infrastructure)
- [CVE-2021-20354](https://cve.now/CVE-2021-20354.md): IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2020-4933](https://cve.now/CVE-2020-4933.md): IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz Reporting Service)
- [CVE-2020-29453](https://cve.now/CVE-2020-29453.md): The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 before 8.13.3, and from 8 (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-29448](https://cve.now/CVE-2020-29448.md): The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18, from 6.14.0 before 7 (no CVSS, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2021-27379](https://cve.now/CVE-2021-27379.md): An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possib (no CVSS)
- [CVE-2019-18243](https://cve.now/CVE-2019-18243.md): HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. (no CVSS, HMI/SCADA iFIX)
- [CVE-2019-18255](https://cve.now/CVE-2019-18255.md): HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. (no CVSS, HMI/SCADA iFIX)
- [CVE-2021-23340](https://cve.now/CVE-2021-23340.md): Local File Inclusion (CVSS 7.1, pimcore/pimcore)
- [CVE-2020-28496](https://cve.now/CVE-2020-28496.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, three)
- [CVE-2020-28490](https://cve.now/CVE-2020-28490.md): Command Injection (CVSS 9.1, async-git)
- [CVE-2020-35577](https://cve.now/CVE-2020-35577.md): In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file (no CVSS)
- [CVE-2020-29664](https://cve.now/CVE-2020-29664.md): A command injection issue in dji\_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a mal (no CVSS)
- [CVE-2021-27376](https://cve.now/CVE-2021-27376.md): An issue was discovered in the nb-connect crate before 1.0.3 for Rust. (no CVSS, nb-connect)
- [CVE-2021-27377](https://cve.now/CVE-2021-27377.md): An issue was discovered in the yottadb crate before 1.2.0 for Rust. (no CVSS, yottadb)
- [CVE-2021-27378](https://cve.now/CVE-2021-27378.md): An issue was discovered in the rand\_core crate before 0.6.2 for Rust. (no CVSS, rand\_core)
- [CVE-2021-27124](https://cve.now/CVE-2021-27124.md): SQL injection in the expertise parameter in search\_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump (no CVSS)
- [CVE-2021-27375](https://cve.now/CVE-2021-27375.md): Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.