# CVEs published 2021-02-19

44 CVEs were published on February 19, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2020-28248](https://cve.now/CVE-2020-28248.md): An integer overflow in the PngImg::InitStorage\_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequen (no CVSS, png-img)
- [CVE-2020-27997](https://cve.now/CVE-2020-27997.md): An issue was discovered in SmartStoreNET before 4.1.0. (no CVSS)
- [CVE-2020-24617](https://cve.now/CVE-2020-24617.md): Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax beca (no CVSS)
- [CVE-2020-24393](https://cve.now/CVE-2020-24393.md): TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. (no CVSS, tweetstream)
- [CVE-2020-24392](https://cve.now/CVE-2020-24392.md): In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of t (no CVSS, twitter-stream)
- [CVE-2020-12873](https://cve.now/CVE-2020-12873.md): An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. (no CVSS)
- [CVE-2020-12668](https://cve.now/CVE-2020-12668.md): Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. (no CVSS, com.hubspot.jinjava:jinjava)
- [CVE-2021-3189](https://cve.now/CVE-2021-3189.md): The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. (no CVSS, slashify)
- [CVE-2021-27509](https://cve.now/CVE-2021-27509.md): In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. (no CVSS)
- [CVE-2021-20588](https://cve.now/CVE-2021-20588.md): Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configu (CVSS 7.5, Mitsubishi Electric CPU Module Logging Configuration To… +37)
- [CVE-2021-20587](https://cve.now/CVE-2021-20587.md): Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.11 (CVSS 7.5, Mitsubishi Electric CPU Module Logging Configuration To… +37)
- [CVE-2020-35499](https://cve.now/CVE-2020-35499.md): A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco\_sock\_getsockopt function in net/bluetooth/sco.c do (no CVSS, kernel)
- [CVE-2021-26713](https://cve.now/CVE-2021-26713.md): A stack-based buffer overflow in res\_rtp\_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certi (no CVSS)
- [CVE-2021-27351](https://cve.now/CVE-2021-27351.md): The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invali (no CVSS)
- [CVE-2021-27214](https://cve.now/CVE-2021-27214.md): A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows (no CVSS)
- [CVE-2021-27328](https://cve.now/CVE-2021-27328.md): Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. (no CVSS)
- [CVE-2020-9050](https://cve.now/CVE-2020-9050.md): Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, Johnson Controls Metasys Reporting Engine (MRE) Web Service…)
- [CVE-2020-25171](https://cve.now/CVE-2020-25171.md): Fuji Electric V-Server Lite (no CVSS, Fuji Electric V-Server Lite)
- [CVE-2020-13549](https://cve.now/CVE-2020-13549.md): An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory (CVSS 8.8, Sytech)
- [CVE-2021-23342](https://cve.now/CVE-2021-23342.md): Cross-site Scripting (XSS) (CVSS 8.6, docsify)
- [CVE-2021-21512](https://cve.now/CVE-2021-21512.md): Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. (CVSS 7.9, Dell Cyber Recovery)
- [CVE-2020-12374](https://cve.now/CVE-2020-12374.md): Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow a priv (no CVSS, Intel(R) Server Boards, Server Systems and Compute Modules)
- [CVE-2021-22701](https://cve.now/CVE-2021-22701.md): A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 (CVSS 6.1, PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…)
- [CVE-2021-22703](https://cve.now/CVE-2021-22703.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8 (CVSS 5.9, PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION865…)
- [CVE-2021-22702](https://cve.now/CVE-2021-22702.md): A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/8 (CVSS 5.9, PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85x…)
- [CVE-2021-3204](https://cve.now/CVE-2021-3204.md): SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. (no CVSS)
- [CVE-2021-3210](https://cve.now/CVE-2021-3210.md): components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound \<= 4.0.1 allows remote attackers to execute arbitrary system commands wh (no CVSS)
- [CVE-2021-26296](https://cve.now/CVE-2021-26296.md): Cross-Site Request Forgery (CSRF) vulnerability in Apache MyFaces (no CVSS, Apache Software Foundation Apache MyFaces Core · org.apache…)
- [CVE-2021-3339](https://cve.now/CVE-2021-3339.md): ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the (no CVSS)
- [CVE-2020-36248](https://cve.now/CVE-2020-36248.md): The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and con (CVSS 3.9)
- [CVE-2020-36249](https://cve.now/CVE-2020-36249.md): The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares. (no CVSS)
- [CVE-2020-36250](https://cve.now/CVE-2020-36250.md): In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the p (CVSS 6.1)
- [CVE-2020-36251](https://cve.now/CVE-2020-36251.md): ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's acc (CVSS 3.5)
- [CVE-2020-36252](https://cve.now/CVE-2020-36252.md): ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sendin (CVSS 6.8)
- [CVE-2020-10252](https://cve.now/CVE-2020-10252.md): An issue was discovered in ownCloud before 10.4. (no CVSS)
- [CVE-2020-10254](https://cve.now/CVE-2020-10254.md): An issue was discovered in ownCloud before 10.4. (no CVSS)
- [CVE-2020-36247](https://cve.now/CVE-2020-36247.md): Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF. (no CVSS)
- [CVE-2020-24908](https://cve.now/CVE-2020-24908.md): Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\\checkmk\\agent\\lo (no CVSS)
- [CVE-2020-36246](https://cve.now/CVE-2020-36246.md): Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. (no CVSS)
- [CVE-2021-26746](https://cve.now/CVE-2021-26746.md): Chamilo 1.11.14 allows XSS via a main/calendar/agenda\_list.php?type= URI. (no CVSS)
- [CVE-2021-27405](https://cve.now/CVE-2021-27405.md): A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. (no CVSS, @progfay/scrapbox-parser)
- [CVE-2021-27403](https://cve.now/CVE-2021-27403.md): Askey RTF8115VW BR\_SV\_g11.11\_RTF\_TEF001\_V6.54\_V014 devices allow cgi-bin/te\_acceso\_router.cgi curWebPage XSS. (no CVSS)
- [CVE-2021-27404](https://cve.now/CVE-2021-27404.md): Askey RTF8115VW BR\_SV\_g11.11\_RTF\_TEF001\_V6.54\_V014 devices allow injection of a Host HTTP header. (no CVSS)
- [CVE-2019-25024](https://cve.now/CVE-2019-25024.md): OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax\_system.php post\_servic (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.