# CVEs published 2021-05-03

19 CVEs were published on May 3, 2021: 0 critical, 1 high. Days are UTC.

- [CVE-2020-23015](https://cve.now/CVE-2020-23015.md): An open redirect issue was discovered in OPNsense through 20.1.5. (no CVSS)
- [CVE-2021-32020](https://cve.now/CVE-2021-32020.md): The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memory. (no CVSS)
- [CVE-2020-23083](https://cve.now/CVE-2020-23083.md): Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges by uploading a craft (no CVSS)
- [CVE-2020-35758](https://cve.now/CVE-2020-35758.md): An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. (no CVSS)
- [CVE-2020-35757](https://cve.now/CVE-2020-35757.md): An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. (no CVSS)
- [CVE-2020-35756](https://cve.now/CVE-2020-35756.md): An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. (no CVSS)
- [CVE-2020-35755](https://cve.now/CVE-2020-35755.md): An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. (no CVSS)
- [CVE-2020-28945](https://cve.now/CVE-2020-28945.md): OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as !\[\](http://onerror=Function.constru (no CVSS)
- [CVE-2021-21264](https://cve.now/CVE-2021-21264.md): Bypass of fix for CVE-2020-26231, Twig sandbox escape (CVSS 5.2, octobercms october · october/cms)
- [CVE-2020-20218](https://cve.now/CVE-2020-20218.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. (no CVSS)
- [CVE-2020-20247](https://cve.now/CVE-2020-20247.md): Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute process. (no CVSS)
- [CVE-2021-29242](https://cve.now/CVE-2021-29242.md): CODESYS Control Runtime system before 3.5.17.0 has improper input validation. (no CVSS)
- [CVE-2021-29239](https://cve.now/CVE-2021-29239.md): CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking (no CVSS)
- [CVE-2021-29238](https://cve.now/CVE-2021-29238.md): CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF). (no CVSS)
- [CVE-2021-29241](https://cve.now/CVE-2021-29241.md): CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). (CVSS 7.5)
- [CVE-2021-28860](https://cve.now/CVE-2021-28860.md): In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '\_\_proto\_\_' through the mutate() and merge() fun (no CVSS, mixme)
- [CVE-2021-29369](https://cve.now/CVE-2021-29369.md): The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands. (no CVSS, @rkesters/gnuplot)
- [CVE-2021-25631](https://cve.now/CVE-2021-25631.md): denylist of executable filename extensions possible to bypass under windows (no CVSS, The Document Foundation LibreOffice)
- [CVE-2021-31996](https://cve.now/CVE-2021-31996.md): An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. (no CVSS, algorithmica)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.