# CVEs published 2021-02-26

74 CVEs were published on February 26, 2021: 4 critical, 8 high. Days are UTC.

- [CVE-2021-27198](https://cve.now/CVE-2021-27198.md): An issue was discovered in Visualware MyConnection Server before v11.1a. (no CVSS)
- [CVE-2020-36079](https://cve.now/CVE-2020-36079.md): Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. (no CVSS)
- [CVE-2021-27803](https://cve.now/CVE-2021-27803.md): A vulnerability was discovered in how p2p/p2p\_pd.c in wpa\_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision discovery requests. (CVSS 7.5)
- [CVE-2020-27223](https://cve.now/CVE-2020-27223.md): In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept (CVSS 5.2, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2021-21309](https://cve.now/CVE-2021-21309.md): Integer overflow on 32-bit systems (CVSS 5.4, redis)
- [CVE-2021-26567](https://cve.now/CVE-2021-26567.md): Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute arbitrary code via fil (no CVSS, github/knik0 faad2)
- [CVE-2021-26566](https://cve.now/CVE-2021-26566.md): Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 all (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2021-26565](https://cve.now/CVE-2021-26565.md): Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allow (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2021-26564](https://cve.now/CVE-2021-26564.md): Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allow (CVSS 8.3, Synology DiskStation Manager)
- [CVE-2021-26563](https://cve.now/CVE-2021-26563.md): Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 allows local users to e (CVSS 8.2, Synology DiskStation Manager)
- [CVE-2021-26562](https://cve.now/CVE-2021-26562.md): Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the-middle (CVSS 9.0, Synology DiskStation Manager)
- [CVE-2021-26561](https://cve.now/CVE-2021-26561.md): Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows man-in-the (CVSS 9.0, Synology DiskStation Manager)
- [CVE-2021-26560](https://cve.now/CVE-2021-26560.md): Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426 (CVSS 9.0, Synology DiskStation Manager)
- [CVE-2021-27799](https://cve.now/CVE-2021-27799.md): ean\_leading\_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachable from the C API th (no CVSS)
- [CVE-2021-0366](https://cve.now/CVE-2021-0366.md): In vpu, there is a possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0367](https://cve.now/CVE-2021-0367.md): In vpu, there is a possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0401](https://cve.now/CVE-2021-0401.md): In vow, there is a possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0402](https://cve.now/CVE-2021-0402.md): In jpeg, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2021-0403](https://cve.now/CVE-2021-0403.md): In netdiag, there is a possible information disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0404](https://cve.now/CVE-2021-0404.md): In mobile\_log\_d, there is a possible information disclosure due to improper input validation. (no CVSS, Android)
- [CVE-2021-0405](https://cve.now/CVE-2021-0405.md): In performance driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0406](https://cve.now/CVE-2021-0406.md): In cameraisp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-21308](https://cve.now/CVE-2021-21308.md): Improper session management for soft logout (CVSS 6.1, PrestaShop)
- [CVE-2021-21302](https://cve.now/CVE-2021-21302.md): CSV Injection via csv export (CVSS 6.8, PrestaShop)
- [CVE-2021-21273](https://cve.now/CVE-2021-21273.md): Open redirects on some federation and push requests (CVSS 3.1, matrix-org synapse · matrix-synapse)
- [CVE-2021-21274](https://cve.now/CVE-2021-21274.md): Denial of service attack via .well-known lookups (CVSS 4.3, matrix-org synapse · matrix-synapse)
- [CVE-2021-23345](https://cve.now/CVE-2021-23345.md): Server-side Request Forgery (SSRF) (CVSS 5.3, github.com/thecodingmachine/gotenberg)
- [CVE-2021-21298](https://cve.now/CVE-2021-21298.md): Path traversal in Node-Red (CVSS 3.5, node-red · @node-red/runtime)
- [CVE-2021-21297](https://cve.now/CVE-2021-21297.md): Prototype Pollution in Node-Red (CVSS 7.7, node-red · @node-red/runtime)
- [CVE-2021-23964](https://cve.now/CVE-2021-23964.md): Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23965](https://cve.now/CVE-2021-23965.md): Mozilla developers reported memory safety bugs present in Firefox 84. (no CVSS, Mozilla Firefox)
- [CVE-2021-23979](https://cve.now/CVE-2021-23979.md): Mozilla developers reported memory safety bugs present in Firefox 85. (no CVSS, Mozilla Firefox)
- [CVE-2021-23978](https://cve.now/CVE-2021-23978.md): Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2020-24686](https://cve.now/CVE-2020-24686.md): AC500 V2 webserver denial of service vulnerability (CVSS 7.5, ABB AC500 V2 products with onboard Ethernet)
- [CVE-2019-11684](https://cve.now/CVE-2019-11684.md): Improper Access Control in Bosch Video Recording Manager (CVSS 9.9)
- [CVE-2020-28199](https://cve.now/CVE-2020-28199.md): best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor. (no CVSS)
- [CVE-2020-28646](https://cve.now/CVE-2020-28646.md): ownCloud owncloud/client before 2.7 allows DLL Injection. (no CVSS)
- [CVE-2021-22661](https://cve.now/CVE-2021-22661.md): Changing the password on the module webpage does not require the user to type in the current password first. (no CVSS, ICX35-HWC-A, ICX35-HWC-E)
- [CVE-2021-26903](https://cve.now/CVE-2021-26903.md): LMA ISIDA Retriever 5.2 is vulnerable to XSS via query\['text'\]. (no CVSS)
- [CVE-2021-26904](https://cve.now/CVE-2021-26904.md): LMA ISIDA Retriever 5.2 allows SQL Injection. (no CVSS)
- [CVE-2021-3010](https://cve.now/CVE-2021-3010.md): There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server Version 20.3. (no CVSS)
- [CVE-2020-26200](https://cve.now/CVE-2020-26200.md): A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. (no CVSS, Kaspersky Rescue Disk Version · Kaspersky Endpoint Security…)
- [CVE-2019-18943](https://cve.now/CVE-2019-18943.md): XML External Entity processing (CVSS 6.1, Micro Focus Solutions Business Manager)
- [CVE-2019-18942](https://cve.now/CVE-2019-18942.md): Stored cross site scripting (CVSS 5.5, Micro Focus Solutions Business Manager)
- [CVE-2019-18944](https://cve.now/CVE-2019-18944.md): Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS. (CVSS 4.9, Micro Focus Solutions Business Manager)
- [CVE-2019-18945](https://cve.now/CVE-2019-18945.md): privilege escalation (CVSS 7.3, Micro Focus Solutions Business Manager)
- [CVE-2019-18947](https://cve.now/CVE-2019-18947.md): information disclosure (CVSS 3.5, Micro Focus Solutions Business Manager)
- [CVE-2019-18946](https://cve.now/CVE-2019-18946.md): Session fixation (CVSS 4.8, Micro Focus Solutions Business Manager)
- [CVE-2020-24455](https://cve.now/CVE-2020-24455.md): Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation of privilege via loc (no CVSS, TPM2 source)
- [CVE-2021-21724](https://cve.now/CVE-2021-21724.md): A ZTE product has a memory leak vulnerability. (no CVSS, ZXR10)
- [CVE-2021-21330](https://cve.now/CVE-2021-21330.md): Open redirect vulnerability in aiohttp (CVSS 3.1, aio-libs aiohttp · aiohttp)
- [CVE-2021-23977](https://cve.now/CVE-2021-23977.md): Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read sensitive data from (no CVSS, Mozilla Firefox)
- [CVE-2021-23963](https://cve.now/CVE-2021-23963.md): When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user interface, leading to (no CVSS, Mozilla Firefox)
- [CVE-2021-23953](https://cve.now/CVE-2021-23953.md): If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said informa (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23954](https://cve.now/CVE-2021-23954.md): Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corrupti (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23955](https://cve.now/CVE-2021-23955.md): The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to clickjacking attacks. (no CVSS, Mozilla Firefox)
- [CVE-2021-23956](https://cve.now/CVE-2021-23956.md): An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. (no CVSS, Mozilla Firefox)
- [CVE-2021-23957](https://cve.now/CVE-2021-23957.md): Navigations through the Android-specific \`intent\` URL scheme could have been misused to escape iframe sandbox. (no CVSS, Mozilla Firefox)
- [CVE-2021-23958](https://cve.now/CVE-2021-23958.md): The browser could have been confused into transferring a screen sharing state into another tab, which would leak unintended information. (no CVSS, Mozilla Firefox)
- [CVE-2021-23959](https://cve.now/CVE-2021-23959.md): An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the address bar. (no CVSS, Mozilla Firefox)
- [CVE-2021-23960](https://cve.now/CVE-2021-23960.md): Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23961](https://cve.now/CVE-2021-23961.md): Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hos (no CVSS, Mozilla Firefox)
- [CVE-2021-23962](https://cve.now/CVE-2021-23962.md): Incorrect use of the '\<RowCountChanged\>' method could have led to a user-after-poison and a potentially exploitable crash. (no CVSS, Mozilla Firefox)
- [CVE-2021-23968](https://cve.now/CVE-2021-23968.md): If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation re (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23969](https://cve.now/CVE-2021-23969.md): As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23970](https://cve.now/CVE-2021-23970.md): Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm code. (no CVSS, Mozilla Firefox)
- [CVE-2021-23971](https://cve.now/CVE-2021-23971.md): When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy. (no CVSS, Mozilla Firefox)
- [CVE-2021-23972](https://cve.now/CVE-2021-23972.md): One phishing tactic on the web is to provide a link with HTTP Auth. (no CVSS, Mozilla Firefox)
- [CVE-2021-23973](https://cve.now/CVE-2021-23973.md): When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that error may (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-23974](https://cve.now/CVE-2021-23974.md): The DOMParser API did not properly process '\<noscript\>' elements for escaping. (no CVSS, Mozilla Firefox)
- [CVE-2021-23975](https://cve.now/CVE-2021-23975.md): The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. (no CVSS, Mozilla Firefox)
- [CVE-2021-23976](https://cve.now/CVE-2021-23976.md): When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed de (no CVSS, Mozilla Firefox)
- [CVE-2021-21328](https://cve.now/CVE-2021-21328.md): Denial of Service (CVSS 5.3, vapor)
- [CVE-2020-27618](https://cve.now/CVE-2020-27618.md): The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364 (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.