# CVEs published 2021-02-23

62 CVEs were published on February 23, 2021: 0 critical, 5 high. Days are UTC.

- [CVE-2021-21323](https://cve.now/CVE-2021-21323.md): Regression in DNS leakage from Tor windows (CVSS 4.3, brave-browser)
- [CVE-2021-20194](https://cve.now/CVE-2021-20194.md): There is a vulnerability in the linux kernel versions higher than 5.2 (if kernel compiled with config params CONFIG\_BPF\_SYSCALL=y , CONFIG\_B (no CVSS, kernel)
- [CVE-2021-20256](https://cve.now/CVE-2021-20256.md): A flaw was found in Red Hat Satellite. (no CVSS, Red Hat Satellite)
- [CVE-2021-20252](https://cve.now/CVE-2021-20252.md): A flaw was found in Red Hat 3scale API Management Platform 2. (no CVSS, 3scale/backend)
- [CVE-2021-3410](https://cve.now/CVE-2021-3410.md): A flaw was found in libcaca v0.99.beta19. (no CVSS, libcaca)
- [CVE-2021-3407](https://cve.now/CVE-2021-3407.md): A flaw was found in mupdf 1.18.0. (CVSS 7.8, mupdf)
- [CVE-2021-20182](https://cve.now/CVE-2021-20182.md): A privilege escalation flaw was found in openshift4/ose-docker-builder. (no CVSS, openshift)
- [CVE-2021-3405](https://cve.now/CVE-2021-3405.md): A flaw was found in libebml before 1.4.2. (no CVSS, libebml)
- [CVE-2021-26927](https://cve.now/CVE-2021-26927.md): A flaw was found in jasper before 2.0.25. (no CVSS, jasper)
- [CVE-2021-26595](https://cve.now/CVE-2021-26595.md): In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP version used by the site, (no CVSS)
- [CVE-2021-26594](https://cve.now/CVE-2021-26594.md): In Directus 8.x through 8.8.1, an attacker can switch to the administrator role (via the PATCH method) without any control by the back end. (no CVSS)
- [CVE-2021-26593](https://cve.now/CVE-2021-26593.md): In Directus 8.x through 8.8.1, an attacker can see all users in the CMS using the API /users/{id}. (no CVSS)
- [CVE-2021-27583](https://cve.now/CVE-2021-27583.md): In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password reset feature. (no CVSS)
- [CVE-2021-22112](https://cve.now/CVE-2021-22112.md): Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2021-20247](https://cve.now/CVE-2021-20247.md): A flaw was found in mbsync before v1.3.5 and v1.4.1. (no CVSS, isync/mbsync)
- [CVE-2020-27782](https://cve.now/CVE-2020-27782.md): A flaw was found in the Undertow AJP connector. (no CVSS, Undertow · io.undertow:undertow-core)
- [CVE-2020-8297](https://cve.now/CVE-2020-8297.md): Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users with a duplicate user i (no CVSS, Nextcloud Deck)
- [CVE-2021-22882](https://cve.now/CVE-2021-22882.md): UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protec (no CVSS, UniFi Protect)
- [CVE-2020-28587](https://cve.now/CVE-2020-28587.md): A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an o (CVSS 8.8, Softmaker)
- [CVE-2020-7120](https://cve.now/CVE-2020-7120.md): A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26677](https://cve.now/CVE-2021-26677.md): A local authenticated escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26679](https://cve.now/CVE-2021-26679.md): A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26680](https://cve.now/CVE-2021-26680.md): A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-27582](https://cve.now/CVE-2021-27582.md): org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains (no CVSS, org.mitre:openid-connect-parent)
- [CVE-2021-26678](https://cve.now/CVE-2021-26678.md): A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-22651](https://cve.now/CVE-2021-22651.md): When loading a specially crafted file, Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot N (no CVSS, Luxion KeyShot versions · Luxion KeyShot Viewer +2)
- [CVE-2021-20198](https://cve.now/CVE-2021-20198.md): A flaw was found in the OpenShift Installer before version v0.9.0-master.0.20210125200451-95101da940b0. (no CVSS, openshift/installer)
- [CVE-2021-26926](https://cve.now/CVE-2021-26926.md): A flaw was found in jasper before 2.0.25. (no CVSS, jasper)
- [CVE-2021-20229](https://cve.now/CVE-2021-20229.md): A flaw was found in PostgreSQL in versions before 13.2. (no CVSS, PostgreSQL)
- [CVE-2021-26684](https://cve.now/CVE-2021-26684.md): A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-20220](https://cve.now/CVE-2021-20220.md): A flaw was found in Undertow. (no CVSS, undertow · io.undertow:undertow-core)
- [CVE-2021-26682](https://cve.now/CVE-2021-26682.md): A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26681](https://cve.now/CVE-2021-26681.md): A remote authenticated command Injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26683](https://cve.now/CVE-2021-26683.md): A remote authenticated command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-26686](https://cve.now/CVE-2021-26686.md): A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-27579](https://cve.now/CVE-2021-27579.md): Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an (no CVSS)
- [CVE-2021-26685](https://cve.now/CVE-2021-26685.md): A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.9.5, 6.8.8-HF1, (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2020-26609](https://cve.now/CVE-2020-26609.md): fastadmin V1.0.0.20200506\_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator crede (no CVSS)
- [CVE-2021-20226](https://cve.now/CVE-2021-20226.md): A use-after-free flaw was found in the io\_uring in Linux kernel, where a local attacker with a user privilege could cause a denial of servic (no CVSS, kernel)
- [CVE-2021-20230](https://cve.now/CVE-2021-20230.md): A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and ve (no CVSS, stunnel)
- [CVE-2020-16243](https://cve.now/CVE-2020-16243.md): Multiple buffer overflow vulnerabilities exist when LeviStudioU (Version 2019-09-21 and prior) processes project files. (no CVSS, LeviStudioU)
- [CVE-2020-25161](https://cve.now/CVE-2020-25161.md): The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operatio (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2021-22113](https://cve.now/CVE-2021-22113.md): Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vulnerable to bypassing (no CVSS, Spring Cloud Netflix Zuul · org.springframework.cloud:sprin…)
- [CVE-2020-7847](https://cve.now/CVE-2020-7847.md): The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain (CVSS 7.4, EFM Networks ipTIME NAS)
- [CVE-2021-25630](https://cve.now/CVE-2021-25630.md): "loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. (no CVSS, Collabora Productivity Collabora Online · The Document Foun…)
- [CVE-2020-4953](https://cve.now/CVE-2020-4953.md): IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's internal structure by e (CVSS 4.3, IBM Planning Analytics)
- [CVE-2020-28429](https://cve.now/CVE-2020-28429.md): Command Injection (CVSS 7.3, geojson2kml)
- [CVE-2021-27550](https://cve.now/CVE-2021-27550.md): Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a local denial of servi (no CVSS)
- [CVE-2021-3252](https://cve.now/CVE-2021-3252.md): KACO New Energy XP100U Up to XP-JAVA 2.0 is affected by incorrect access control. (no CVSS)
- [CVE-2020-14359](https://cve.now/CVE-2020-14359.md): A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass o (no CVSS, keycloak · github.com/keycloak/keycloak-gatekeeper)
- [CVE-2020-8902](https://cve.now/CVE-2020-8902.md): SSRF in Rendertron (CVSS 3.5, Google Rendertron · rendertron)
- [CVE-2020-13697](https://cve.now/CVE-2020-13697.md): An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. (no CVSS, org.nanohttpd:nanohttpd-nanolets)
- [CVE-2020-25690](https://cve.now/CVE-2020-25690.md): An out-of-bounds write flaw was found in FontForge in versions before 20200314 while parsing SFD files containing certain LayerCount tokens. (no CVSS, fontforge)
- [CVE-2020-27819](https://cve.now/CVE-2020-27819.md): An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. (no CVSS, libxls)
- [CVE-2020-29075](https://cve.now/CVE-2020-29075.md): PDF Injection BlackHat Talk (CVSS 7.1, Adobe Acrobat Reader DC)
- [CVE-2021-22647](https://cve.now/CVE-2021-22647.md): Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 (no CVSS, Luxion KeyShot · Luxion KeyVR)
- [CVE-2021-22643](https://cve.now/CVE-2021-22643.md): Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 (no CVSS, Luxion KeyShot · Luxion KeyVR)
- [CVE-2021-22645](https://cve.now/CVE-2021-22645.md): Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 (no CVSS, Luxion KeyShot · Luxion KeyVR)
- [CVE-2021-22649](https://cve.now/CVE-2021-22649.md): Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer versions prior to 10.1, Luxion KeyShot Network Rendering versions prior to 10.1 (no CVSS, Luxion KeyShot · Luxion KeyVR)
- [CVE-2021-27568](https://cve.now/CVE-2021-27568.md): An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. (no CVSS, net.minidev:json-smart · net.minidev:json-smart-mini)
- [CVE-2020-35852](https://cve.now/CVE-2020-35852.md): Chatbox is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2020-27768](https://cve.now/CVE-2020-27768.md): In ImageMagick, there is an outside the range of representable values of type 'unsigned int' at MagickCore/quantum-private.h. (no CVSS, ImageMagick)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.