# CVEs published 2021-02-24

41 CVEs were published on February 24, 2021: 5 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-1450](https://cve.now/CVE-2021-1450.md): Cisco AnyConnect Secure Mobility Client Denial of Service Vulnerability (CVSS 5.5, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1396](https://cve.now/CVE-2021-1396.md): Cisco Application Services Engine Unauthorized Access Vulnerabilities (CVSS 9.8, Cisco Application Services Engine Software)
- [CVE-2021-1393](https://cve.now/CVE-2021-1393.md): Cisco Application Services Engine Unauthorized Access Vulnerabilities (CVSS 9.8, Cisco Application Services Engine Software)
- [CVE-2021-1388](https://cve.now/CVE-2021-1388.md): Cisco ACI Multi-Site Orchestrator Application Services Engine Deployment Authentication Bypass Vulnerability (CVSS 10.0, Cisco ACI Multi-Site Orchestrator Software)
- [CVE-2021-1387](https://cve.now/CVE-2021-1387.md): Cisco NX-OS Software IPv6 Netstack Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2021-1368](https://cve.now/CVE-2021-1368.md): Cisco FXOS and NX-OS Software Unidirectional Link Detection Denial of Service and Arbitrary Code Execution Vulnerability (CVSS 8.8, Cisco NX-OS Software)
- [CVE-2021-1367](https://cve.now/CVE-2021-1367.md): Cisco NX-OS Software Protocol Independent Multicast Denial of Service Vulnerability (CVSS 4.3, Cisco NX-OS Software)
- [CVE-2021-1361](https://cve.now/CVE-2021-1361.md): Cisco NX-OS Software Unauthenticated Arbitrary File Actions Vulnerability (CVSS 9.8, Cisco NX-OS Software)
- [CVE-2021-1231](https://cve.now/CVE-2021-1231.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Link Layer Discovery Protocol Port Denial of Service Vulnerability (CVSS 4.7, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1230](https://cve.now/CVE-2021-1230.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode BGP Route Installation Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1228](https://cve.now/CVE-2021-1228.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Fabric Infrastructure VLAN Unauthorized Access Vulnerability (CVSS 7.4, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1229](https://cve.now/CVE-2021-1229.md): Cisco NX-OS Software ICMP Version 6 Memory Leak Denial of Service Vulnerability (CVSS 5.8, Cisco NX-OS Software)
- [CVE-2021-1227](https://cve.now/CVE-2021-1227.md): Cisco NX-OS Software NX-API Cross-Site Request Forgery Vulnerability (CVSS 8.1, Cisco NX-OS Software)
- [CVE-2020-4931](https://cve.now/CVE-2020-4931.md): IBM MQ 9.1 LTS, 9.2 LTS, and 9.1 CD AMQP Channels could allow an authenticated user to cause a denial of service due to an issue processing (CVSS 6.5, IBM MQ Appliance)
- [CVE-2020-11988](https://cve.now/CVE-2020-11988.md): Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParse (no CVSS, Apache XmlGraphics Commons · org.apache.xmlgraphics:xmlgrap…)
- [CVE-2021-21974](https://cve.now/CVE-2021-21974.md): OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflo (CVSS 8.8, VMware ESXi · VMware Cloud Foundation)
- [CVE-2021-21972](https://cve.now/CVE-2021-21972.md): The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. (CVSS 9.8, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2021-21973](https://cve.now/CVE-2021-21973.md): The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Serv (CVSS 5.3, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2020-27224](https://cve.now/CVE-2020-27224.md): In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code. (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/preview)
- [CVE-2020-7836](https://cve.now/CVE-2020-7836.md): VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking pa (CVSS 7.8, VOICEYE WSActiveBridgeES)
- [CVE-2021-22667](https://cve.now/CVE-2021-22667.md): BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain un (no CVSS, BB-ESWGP506-2SFP-T)
- [CVE-2020-28599](https://cve.now/CVE-2020-28599.md): A stack-based buffer overflow vulnerability exists in the import\_stl.cc:import\_stl() functionality of Openscad openscad-2020.12-RC2. (CVSS 8.8, Openscad)
- [CVE-2020-7846](https://cve.now/CVE-2020-7846.md): Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. (CVSS 8.0, Cnesty Helpcom)
- [CVE-2021-21622](https://cve.now/CVE-2021-21622.md): Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions, resulting in a stored cross (no CVSS, Jenkins project Jenkins Artifact Repository Parameter Plugi…)
- [CVE-2021-21620](https://cve.now/CVE-2021-21620.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims. (no CVSS, Jenkins project Jenkins Claim Plugin · org.jenkins-ci.plugi…)
- [CVE-2021-21621](https://cve.now/CVE-2021-21621.md): Jenkins Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the "About user (basic authentication de (no CVSS, Jenkins project Jenkins Support Core Plugin · org.jenkins-c…)
- [CVE-2021-21619](https://cve.now/CVE-2021-21619.md): Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting (XSS) vulnerabilit (no CVSS, Jenkins project Jenkins Claim Plugin · org.jenkins-ci.plugi…)
- [CVE-2021-21617](https://cve.now/CVE-2021-21617.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Configuration Slicing Plugin 1.51 and earlier allows attackers to apply differe (no CVSS, Jenkins project Jenkins Configuration Slicing Plugin · org.…)
- [CVE-2021-21618](https://cve.now/CVE-2021-21618.md): Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a store (no CVSS, Jenkins project Jenkins Repository Connector Plugin · org.j…)
- [CVE-2021-21616](https://cve.now/CVE-2021-21616.md): Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) (no CVSS, Jenkins project Jenkins Active Choices Plugin · org.biouno:…)
- [CVE-2021-3355](https://cve.now/CVE-2021-3355.md): A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/S (no CVSS)
- [CVE-2020-12702](https://cve.now/CVE-2020-12702.md): Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 (no CVSS)
- [CVE-2021-20662](https://cve.now/CVE-2021-20662.md): Missing authentication for critical function in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to alter the setting info (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20661](https://cve.now/CVE-2021-20661.md): Directory traversal vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows authenticated attackers to delete arbitrary file (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20659](https://cve.now/CVE-2021-20659.md): SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to upload arbitrary files via unspecified vectors. (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20660](https://cve.now/CVE-2021-20660.md): Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an arbitrary script via u (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20658](https://cve.now/CVE-2021-20658.md): SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspec (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20656](https://cve.now/CVE-2021-20656.md): Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obt (no CVSS, Contec Co. SolarView Compact)
- [CVE-2021-20657](https://cve.now/CVE-2021-20657.md): Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacker to obtain and/or a (no CVSS, Contec Co. SolarView Compact)
- [CVE-2020-11987](https://cve.now/CVE-2020-11987.md): Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. (no CVSS, Apache Batik · org.apache.xmlgraphics:batik-svgbrowser)
- [CVE-2021-27645](https://cve.now/CVE-2021-27645.md): The nameserver caching daemon (nscd) in the GNU C Library (aka glibc or libc6) 2.29 through 2.33, when processing a request for netgroup loo (CVSS 2.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.