# CVEs published 2021-05-04

13 CVEs were published on May 4, 2021: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-26804](https://cve.now/CVE-2021-26804.md): Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validation by changing any fi (no CVSS)
- [CVE-2021-29478](https://cve.now/CVE-2021-29478.md): Vulnerability in the COPY command for large intsets (CVSS 7.5, redis)
- [CVE-2020-4987](https://cve.now/CVE-2020-4987.md): The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and (CVSS 6.4, IBM FlashSystem)
- [CVE-2020-21999](https://cve.now/CVE-2020-21999.md): iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. (no CVSS)
- [CVE-2021-21551](https://cve.now/CVE-2021-21551.md): Dell dbutil\_2\_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of servi (CVSS 8.8, KEV, Dell dbutil)
- [CVE-2021-29477](https://cve.now/CVE-2021-29477.md): Vulnerability in the STRALGO LCS command (CVSS 7.5, redis)
- [CVE-2020-27518](https://cve.now/CVE-2020-27518.md): All versions of Windscribe VPN for Mac and Windows \<= v2.02.10 contain a local privilege escalation vulnerability in the WindscribeService c (no CVSS)
- [CVE-2021-22547](https://cve.now/CVE-2021-22547.md): Buffer overrun in Google Cloud IoT Device SDK for Embedded C (CVSS 6.3, Google Cloud IoT Device SDK for Embedded C)
- [CVE-2021-3154](https://cve.now/CVE-2021-3154.md): An issue was discovered in SolarWinds Serv-U before 15.2.2. (no CVSS)
- [CVE-2021-29240](https://cve.now/CVE-2021-29240.md): The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be u (no CVSS)
- [CVE-2021-23383](https://cve.now/CVE-2021-23383.md): Prototype Pollution (CVSS 5.6, handlebars)
- [CVE-2021-23343](https://cve.now/CVE-2021-23343.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, path-parse)
- [CVE-2021-31164](https://cve.now/CVE-2021-31164.md): Apache Unomi log injection (no CVSS, Apache Software Foundation Apache Unomi · org.apache.unomi:…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.