# CVEs published 2021-02-22

66 CVEs were published on February 22, 2021: 1 critical, 2 high. Days are UTC.

- [CVE-2021-27189](https://cve.now/CVE-2021-27189.md): The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation. (no CVSS)
- [CVE-2021-23827](https://cve.now/CVE-2021-23827.md): Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potentially sensitive medi (no CVSS)
- [CVE-2021-21156](https://cve.now/CVE-2021-21156.md): Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-21157](https://cve.now/CVE-2021-21157.md): Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome)
- [CVE-2021-21155](https://cve.now/CVE-2021-21155.md): Heap buffer overflow in Tab Strip in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the rende (no CVSS, Google Chrome)
- [CVE-2021-21153](https://cve.now/CVE-2021-21153.md): Stack buffer overflow in GPU Process in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially perform out o (no CVSS, Google Chrome)
- [CVE-2021-21154](https://cve.now/CVE-2021-21154.md): Heap buffer overflow in Tab Strip in Google Chrome prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2021-21152](https://cve.now/CVE-2021-21152.md): Heap buffer overflow in Media in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome)
- [CVE-2021-21150](https://cve.now/CVE-2021-21150.md): Use after free in Downloads in Google Chrome on Windows prior to 88.0.4324.182 allowed a remote attacker who had compromised the renderer pr (no CVSS, Google Chrome)
- [CVE-2021-21151](https://cve.now/CVE-2021-21151.md): Use after free in Payments in Google Chrome prior to 88.0.4324.182 allowed a remote attacker to potentially perform a sandbox escape via a c (no CVSS, Google Chrome)
- [CVE-2021-21149](https://cve.now/CVE-2021-21149.md): Stack buffer overflow in Data Transfer in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to perform out of bounds m (no CVSS, Google Chrome)
- [CVE-2020-36232](https://cve.now/CVE-2020-36232.md): The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from version 4.3.2.0 before 4 (no CVSS, Atlassian Gadgets)
- [CVE-2021-26724](https://cve.now/CVE-2021-26724.md): Authenticated command injection when changing date settings or hostname in Guardian/CMC before 20.0.7.4 (CVSS 8.6, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2021-26725](https://cve.now/CVE-2021-26725.md): Authenticated command path traversal on timezone settings in Guardian/CMC before 20.0.7.4 (CVSS 7.2, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2021-27279](https://cve.now/CVE-2021-27279.md): MyBB before 1.8.25 allows stored XSS via nested \[email\] tags with MyCode (aka BBCode). (no CVSS)
- [CVE-2021-27549](https://cve.now/CVE-2021-27549.md): Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. (no CVSS)
- [CVE-2021-27228](https://cve.now/CVE-2021-27228.md): An issue was discovered in Shinobi through ocean version 1. (no CVSS)
- [CVE-2020-22475](https://cve.now/CVE-2020-22475.md): "Tasks" application version before 9.7.3 is affected by insecure permissions. (no CVSS)
- [CVE-2020-22474](https://cve.now/CVE-2020-22474.md): In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local file inclusion. (no CVSS)
- [CVE-2021-27564](https://cve.now/CVE-2021-27564.md): A stored XSS issue exists in Appspace 6.2.4. (no CVSS)
- [CVE-2020-24175](https://cve.now/CVE-2020-24175.md): Buffer overflow in Yz1 0.30 and 0.32, as used in IZArc 4.4, ZipGenius 6.3.2.3116, and Explzh (extension) 8.14, allows attackers to execute a (no CVSS)
- [CVE-2020-21224](https://cve.now/CVE-2020-21224.md): A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. (no CVSS)
- [CVE-2020-19762](https://cve.now/CVE-2020-19762.md): Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for (no CVSS)
- [CVE-2021-27368](https://cve.now/CVE-2021-27368.md): The Contact page in Monica 2.19.1 allows stored XSS via the First Name field. (no CVSS)
- [CVE-2021-27370](https://cve.now/CVE-2021-27370.md): The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field. (no CVSS)
- [CVE-2021-27371](https://cve.now/CVE-2021-27371.md): The Contact page in Monica 2.19.1 allows stored XSS via the Description field. (no CVSS)
- [CVE-2021-27559](https://cve.now/CVE-2021-27559.md): The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field. (no CVSS)
- [CVE-2021-27369](https://cve.now/CVE-2021-27369.md): The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field. (no CVSS)
- [CVE-2021-3120](https://cve.now/CVE-2021-3120.md): An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers (CVSS 9.8)
- [CVE-2020-3664](https://cve.now/CVE-2020-3664.md): Out of bound read access in hypervisor due to an invalid read access attempt by passing invalid addresses in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11297](https://cve.now/CVE-2020-11297.md): Denial of service in WLAN module due to improper check of subtypes in logic where excessive frames are dropped in Snapdragon Auto, Snapdrago (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11287](https://cve.now/CVE-2020-11287.md): Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11296](https://cve.now/CVE-2020-11296.md): Arithmetic overflow can happen while processing NOA IE due to improper error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11283](https://cve.now/CVE-2020-11283.md): A buffer overflow can occur when playing an MKV clip due to lack of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11286](https://cve.now/CVE-2020-11286.md): An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard request categories (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2020-11282](https://cve.now/CVE-2020-11282.md): Improper access control when using mmap with the kgsl driver with a special offset value that can be provided to map the memstore of the GPU (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11280](https://cve.now/CVE-2020-11280.md): Denial of service while processing fine timing measurement request (FTMR) frame with reserved bits set in the FTM parameter IE due to improp (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11281](https://cve.now/CVE-2020-11281.md): Allowing RTT frames to be linked with non randomized MAC address by comparing the sequence numbers can lead to information disclosure. (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11278](https://cve.now/CVE-2020-11278.md): Possible denial of service while handling host WMI command due to improper validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Con (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11276](https://cve.now/CVE-2020-11276.md): Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11277](https://cve.now/CVE-2020-11277.md): Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snap (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…)
- [CVE-2020-11275](https://cve.now/CVE-2020-11275.md): Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11271](https://cve.now/CVE-2020-11271.md): Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11272](https://cve.now/CVE-2020-11272.md): Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a stale version later can (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11270](https://cve.now/CVE-2020-11270.md): Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status in the FTM parameter (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11253](https://cve.now/CVE-2020-11253.md): Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11269](https://cve.now/CVE-2020-11269.md): Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdra (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11223](https://cve.now/CVE-2020-11223.md): Out of bound in camera driver due to lack of check of validation of array index before copying into array in Snapdragon Auto, Snapdragon Com (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11203](https://cve.now/CVE-2020-11203.md): Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in Snapdragon Auto, Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2020-11204](https://cve.now/CVE-2020-11204.md): Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters th (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11195](https://cve.now/CVE-2020-11195.md): Out of bound write and read in TA while processing command from NS side due to improper length check on command and response buffers in Snap (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11198](https://cve.now/CVE-2020-11198.md): Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset i (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11194](https://cve.now/CVE-2020-11194.md): Possible out of bound access in TA while processing a command from NS side due to improper length check of response buffer in Snapdragon Aut (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11177](https://cve.now/CVE-2020-11177.md): User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in Snapd (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11187](https://cve.now/CVE-2020-11187.md): Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Connectivity, Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2020-11170](https://cve.now/CVE-2020-11170.md): Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction in Snapdrag (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-11147](https://cve.now/CVE-2020-11147.md): Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of macro in Snapdragon (no CVSS, Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…)
- [CVE-2020-11163](https://cve.now/CVE-2020-11163.md): Possible buffer overflow while updating ikev2 parameters due to lack of check of input validation for certain parameters received from the e (no CVSS, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2020-35571](https://cve.now/CVE-2020-35571.md): An issue was discovered in MantisBT through 2.24.3. (no CVSS, mantisbt/mantisbt)
- [CVE-2020-35556](https://cve.now/CVE-2020-35556.md): An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. (no CVSS)
- [CVE-2020-35664](https://cve.now/CVE-2020-35664.md): An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. (no CVSS)
- [CVE-2020-35681](https://cve.now/CVE-2020-35681.md): Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. (no CVSS, channels)
- [CVE-2021-24115](https://cve.now/CVE-2021-24115.md): In Botan before 2.17.3, constant-time computations are not used for certain decoding and encoding operations (base32, base58, base64, and he (no CVSS)
- [CVE-2021-3149](https://cve.now/CVE-2021-3149.md): On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual\_ping.cgi allows OS command injection (after authentication by the atta (no CVSS)
- [CVE-2021-26120](https://cve.now/CVE-2021-26120.md): Smarty before 3.1.39 allows code injection via an unexpected function name after a {function name= substring. (no CVSS, smarty/smarty)
- [CVE-2021-26119](https://cve.now/CVE-2021-26119.md): Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template\_object can be accessed in sandbox mode. (no CVSS, smarty/smarty)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.