# CVEs published 2021-05-05

88 CVEs were published on May 5, 2021: 0 critical, 7 high. Days are UTC.

- [CVE-2021-3501](https://cve.now/CVE-2021-3501.md): A flaw was found in the Linux kernel in versions before 5.12. (no CVSS, Linux kernel)
- [CVE-2021-22211](https://cve.now/CVE-2021-22211.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. (CVSS 3.1, GitLab)
- [CVE-2020-19114](https://cve.now/CVE-2020-19114.md): SQL Injection vulnerability in Online Book Store v1.0 via the publisher parameter to edit\_book.php, which could let a remote malicious user (no CVSS)
- [CVE-2020-23128](https://cve.now/CVE-2020-23128.md): Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user (no CVSS)
- [CVE-2020-19113](https://cve.now/CVE-2020-19113.md): Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin\_add.php, which may lead to remote code execution. (no CVSS)
- [CVE-2020-23127](https://cve.now/CVE-2020-23127.md): Chamilo LMS 1.11.10 is affected by Cross Site Request Forgery (CSRF) via the edit\_user function by targeting an admin user. (no CVSS)
- [CVE-2020-19112](https://cve.now/CVE-2020-19112.md): SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin\_delete.php, which could let a remote malicious use (no CVSS)
- [CVE-2020-19111](https://cve.now/CVE-2020-19111.md): Incorrect Access Control vulnerability in Online Book Store v1.0 via admin\_verify.php, which could let a remote mailicious user bypass authe (no CVSS)
- [CVE-2020-19110](https://cve.now/CVE-2020-19110.md): SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to book.php parameter, which could let a remote malicious u (no CVSS)
- [CVE-2020-19109](https://cve.now/CVE-2020-19109.md): SQL Injection vulnerability in Online Book Store v1.0 via the bookisbn parameter to admin\_edit.php, which could let a remote malicious user (no CVSS)
- [CVE-2020-19108](https://cve.now/CVE-2020-19108.md): SQL Injection vulnerability in Online Book Store v1.0 via the pubid parameter to bookPerPub.php, which could let a remote malicious user exe (no CVSS)
- [CVE-2020-19107](https://cve.now/CVE-2020-19107.md): SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to edit\_book.php, which could let a remote malicious user execu (no CVSS)
- [CVE-2021-31409](https://cve.now/CVE-2021-31409.md): Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 (CVSS 7.5, Vaadin · vaadin-compatibility-server +1)
- [CVE-2021-24254](https://cve.now/CVE-2021-24254.md): College Publisher Import \<= 0.1 - Arbitrary File Upload to RCE (no CVSS, College publisher Import)
- [CVE-2021-24246](https://cve.now/CVE-2021-24246.md): WorkScout Core \< 1.3.4 - Authenticated Stored XSS & XFS (no CVSS, PureThemes Workscout Core · PureThemes WorkScout)
- [CVE-2021-24247](https://cve.now/CVE-2021-24247.md): Contact Form Check Tester \<= 1.0.2 - Broken Access Control to Cross-Site Scripting (XSS) (no CVSS, MooveAgency Contact Form Check Tester)
- [CVE-2021-24248](https://cve.now/CVE-2021-24248.md): Business Directory Plugin \< 5.11.1 - Authenticated PHP4 Upload to RCE (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24249](https://cve.now/CVE-2021-24249.md): Business Directory Plugin \< 5.11.2 - Arbitrary Listing Export (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24250](https://cve.now/CVE-2021-24250.md): Business Directory Plugin \< 5.11.2 - Authenticated Stored Cross-Site Scripting (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24251](https://cve.now/CVE-2021-24251.md): Business Directory Plugin \< 5.11.2 - Arbitrary Payment History Update (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24252](https://cve.now/CVE-2021-24252.md): Event Banner \<= 1.3 - Arbitrary File Upload to RCE (no CVSS, Event Banner)
- [CVE-2021-24253](https://cve.now/CVE-2021-24253.md): Classyfrieds \<= 3.8 - Authenticated Arbitrary File Upload to RCE (no CVSS, Classyfrieds)
- [CVE-2021-24178](https://cve.now/CVE-2021-24178.md): Business Directory Plugin \< 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSS (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24179](https://cve.now/CVE-2021-24179.md): Business Directory Plugin \< 5.11 - Arbitrary File Upload to RCE (no CVSS, Business Directory Team Business Directory Plugin – Easy Li…)
- [CVE-2021-24214](https://cve.now/CVE-2021-24214.md): OpenID Connect Generic Client 3.8.0-3.8.1 - Reflected Cross Site Scripting (XSS) via Login Error (no CVSS, daggerhart OpenID Connect Generic Client)
- [CVE-2021-24236](https://cve.now/CVE-2021-24236.md): Imagements \<= 1.2.5 - Unauthenticated Arbitrary File Upload to RCE (no CVSS, williewonka Imagements)
- [CVE-2021-24243](https://cve.now/CVE-2021-24243.md): WPBakery Page Builder Clipboard \< 4.5.6 - Subscriber+ Stored Cross-Site Scripting (XSS) (no CVSS, bitorbit WPBakery Page Builder (Visual Composer) Clipboard)
- [CVE-2021-24244](https://cve.now/CVE-2021-24244.md): WPBakery Page Builder Clipboard \< 4.5.8 - Unauthorised Arbitrary License Options Update (no CVSS, bitorbit WPBakery Page Builder (Visual Composer) Clipboard)
- [CVE-2021-24245](https://cve.now/CVE-2021-24245.md): Stop Spammers \< 2021.9 - Reflected Cross-Site Scripting (XSS) (no CVSS, Trumani Stop Spammers)
- [CVE-2021-32062](https://cve.now/CVE-2021-32062.md): MapServer before 7.0.8, 7.1.x and 7.2.x before 7.2.3, 7.3.x and 7.4.x before 7.4.5, and 7.5.x and 7.6.x before 7.6.3 does not properly enfor (no CVSS)
- [CVE-2021-24274](https://cve.now/CVE-2021-24274.md): Ultimate Maps by Supsystic \< 1.2.5 - Reflected Cross-Site scripting (XSS) (no CVSS, Ultimate Maps by Supsystic)
- [CVE-2021-24275](https://cve.now/CVE-2021-24275.md): Popup by Supsystic \< 1.10.5 - Reflected Cross-Site scripting (XSS) (no CVSS, Popup by Supsystic)
- [CVE-2021-24276](https://cve.now/CVE-2021-24276.md): Contact Form by Supsystic \< 1.7.15 - Reflected Cross-Site scripting (XSS) (no CVSS, Contact Form by Supsystic)
- [CVE-2021-24293](https://cve.now/CVE-2021-24293.md): NextGEN Gallery Pro \< 3.1.11 - Reflected Cross-Site Scripting (XSS) (no CVSS, NextGen Gallery Pro)
- [CVE-2021-24265](https://cve.now/CVE-2021-24265.md): Rife Elementor Extensions & Templates \< 1.1.6 - Contributor+ Stored XSS (no CVSS, Rife Elementor Extensions & Templates)
- [CVE-2021-24266](https://cve.now/CVE-2021-24266.md): The Plus Addons for Elementor Page Builder Lite \< 2.0.6 - Contributor+ Stored XSS (no CVSS, The Plus Addons for Elementor Page Builder Lite)
- [CVE-2021-24267](https://cve.now/CVE-2021-24267.md): All-in-One Addons for Elementor - WidgetKit \< 2.3.10 - Contributor+ Stored XSS (no CVSS, All-in-One Addons for Elementor – WidgetKit)
- [CVE-2021-24268](https://cve.now/CVE-2021-24268.md): JetWidgets For Elementor \< 1.0.9 - Contributor+ Stored XSS (no CVSS, JetWidgets For Elementor)
- [CVE-2021-24269](https://cve.now/CVE-2021-24269.md): Sina Extension for Elementor \< 3.3.12 - Contributor+ Stored XSS (no CVSS, Sina Extension for Elementor)
- [CVE-2021-24270](https://cve.now/CVE-2021-24270.md): DethemeKit For Elementor \< 1.5.5.5 - Contributor+ Stored XSS (no CVSS, DethemeKit For Elementor)
- [CVE-2021-24271](https://cve.now/CVE-2021-24271.md): Ultimate Addons for Elementor \< 1.30.0 - Contributor+ Stored XSS (no CVSS, Ultimate Addons for Elementor)
- [CVE-2021-24272](https://cve.now/CVE-2021-24272.md): Fitness Calculators \< 1.9.6 - Cross-Site Request Forgery to Cross-Site Scripting (XSS) (no CVSS, fitness calculators)
- [CVE-2021-24273](https://cve.now/CVE-2021-24273.md): Clever Addons for Elementor \< 2.1.0 - Contributor+ Stored XSS (no CVSS, CleverSoft Clever Addons for Elementor)
- [CVE-2021-24257](https://cve.now/CVE-2021-24257.md): Premium Addons for Elementor \< 4.2.8 - Contributor+ Stored Cross-Site Scripting (XSS) (no CVSS, Premium Addons for Elementor)
- [CVE-2021-24258](https://cve.now/CVE-2021-24258.md): ElementsKit and ElementsKit Pro \< 2.2.0 - Contributor+ Stored XSS (no CVSS, Wpmet Elements Kit Lite · Wpmet Elements Kit Pro)
- [CVE-2021-24259](https://cve.now/CVE-2021-24259.md): Elementor Addon Elements \< 1.11.2 - Contributor+ Stored XSS (no CVSS, Elementor Addon Elements)
- [CVE-2021-24260](https://cve.now/CVE-2021-24260.md): Livemesh Addons for Elementor \< 6.8 - Contributor+ Stored XSS (no CVSS, Livemesh Addons for Elementor)
- [CVE-2021-24261](https://cve.now/CVE-2021-24261.md): HT Mega - Absolute Addons for Elementor Page Builder \< 1.5.7 - Contributor+ Stored XSS (no CVSS, HT Mega – Absolute Addons for Elementor Page Builder)
- [CVE-2021-24262](https://cve.now/CVE-2021-24262.md): WooLentor - WooCommerce Elementor Addons + Builder \< 1.8.6 - Contributor+ Stored XSS (no CVSS, WooLentor – WooCommerce Elementor Addons + Builder)
- [CVE-2021-24263](https://cve.now/CVE-2021-24263.md): PowerPack Addons for Elementor \< 2.3.2 - Contributor+ Stored XSS (no CVSS, PowerPack Addons for Elementor)
- [CVE-2021-24264](https://cve.now/CVE-2021-24264.md): Image Hover Effects - Elementor Addon \< 1.3.4 - Contributor+ Stored XSS (no CVSS, Image Hover Effects – Elementor Addon)
- [CVE-2021-24255](https://cve.now/CVE-2021-24255.md): Essential Addons for Elementor \< 4.5.4 - Contributor+ Stored Cross-Site Scripting (XSS) (no CVSS, Essential Addons for Elementor)
- [CVE-2021-24256](https://cve.now/CVE-2021-24256.md): Elementor - Header, Footer & Blocks Template \< 1.5.8 - Contributor+ Stored XSS (no CVSS, Elementor – Header, Footer & Blocks Template)
- [CVE-2021-29490](https://cve.now/CVE-2021-29490.md): Unauthenticated GET requests through Remote Image endpoints (CVSS 5.8, jellyfin)
- [CVE-2021-29101](https://cve.now/CVE-2021-29101.md): ArcGIS GeoEvent Server has a Directory Traversal security vulnerability. (CVSS 8.6, Esri ArcGIS GeoEvent Server)
- [CVE-2021-31411](https://cve.now/CVE-2021-31411.md): Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 (CVSS 6.3, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-20401](https://cve.now/CVE-2021-20401.md): IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound auth (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2021-20397](https://cve.now/CVE-2021-20397.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 6.1, IBM QRadar SIEM)
- [CVE-2020-5013](https://cve.now/CVE-2020-5013.md): IBM QRadar SIEM 7.3 and 7.4 may vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM QRadar SIEM)
- [CVE-2020-4993](https://cve.now/CVE-2020-4993.md): IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path tr (CVSS 4.9, IBM QRadar SIEM)
- [CVE-2020-4979](https://cve.now/CVE-2020-4979.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to insecure inter-deployment communication. (CVSS 7.5, IBM QRadar SIEM)
- [CVE-2020-4932](https://cve.now/CVE-2020-4932.md): IBM QRadar SIEM 7.3 and 7.4 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound auth (CVSS 6.2, IBM QRadar SIEM)
- [CVE-2020-4929](https://cve.now/CVE-2020-4929.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2020-4883](https://cve.now/CVE-2020-4883.md): IBM QRadar SIEM 7.3 and 7.4 could disclose sensitive information about other domains which could be used in further attacks against the syst (CVSS 4.3, IBM QRadar SIEM)
- [CVE-2021-29489](https://cve.now/CVE-2021-29489.md): Options structure open to XSS if passed unfiltered (CVSS 7.6, highcharts)
- [CVE-2021-29100](https://cve.now/CVE-2021-29100.md): ArcGIS Earth has a File Parsing Directory Traversal Vulnerability (CVSS 7.8, Esri ArcGIS Earth)
- [CVE-2021-32055](https://cve.now/CVE-2021-32055.md): Mutt 1.11.0 through 2.0.x before 2.0.7 (and NeoMutt 2019-10-25 through 2021-05-04) has a $imap\_qresync issue in which imap/util.c has an out (no CVSS)
- [CVE-2021-31518](https://cve.now/CVE-2021-31518.md): Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit (no CVSS, Trend Micro Home Network Security)
- [CVE-2021-31517](https://cve.now/CVE-2021-31517.md): Trend Micro Home Network Security 6.5.599 and earlier is vulnerable to a file-parsing vulnerability which could allow an attacker to exploit (no CVSS, Trend Micro Home Network Security)
- [CVE-2020-13664](https://cve.now/CVE-2020-13664.md): Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-13662](https://cve.now/CVE-2020-13662.md): Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to a (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-13665](https://cve.now/CVE-2020-13665.md): Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2020-13666](https://cve.now/CVE-2020-13666.md): Cross-site scripting vulnerability in Drupal Core. (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2016-20010](https://cve.now/CVE-2016-20010.md): EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is un (no CVSS)
- [CVE-2021-20254](https://cve.now/CVE-2021-20254.md): A flaw was found in samba. (no CVSS, samba)
- [CVE-2021-29250](https://cve.now/CVE-2021-29250.md): BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. (no CVSS)
- [CVE-2021-29248](https://cve.now/CVE-2021-29248.md): BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the Secure flag for a (no CVSS)
- [CVE-2021-29247](https://cve.now/CVE-2021-29247.md): BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set the HTTPOnly flag for (no CVSS)
- [CVE-2021-29246](https://cve.now/CVE-2021-29246.md): BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution. (no CVSS)
- [CVE-2021-29245](https://cve.now/CVE-2021-29245.md): BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. (no CVSS)
- [CVE-2021-31800](https://cve.now/CVE-2021-31800.md): Multiple path traversal vulnerabilities exist in smbserver.py in Impacket through 0.9.22. (no CVSS, impacket)
- [CVE-2021-25317](https://cve.now/CVE-2021-25317.md): cups: ownership of /var/log/cups allows the lp user to create files as root (CVSS 3.3, SUSE Linux Enterprise Server 11-SP4-LTSS · SUSE Manager… +3)
- [CVE-2021-25319](https://cve.now/CVE-2021-25319.md): virtualbox: missing sticky bit for /etc/vbox allows local root exploit for members of vboxusers group (CVSS 7.8, openSUSE Factory)
- [CVE-2020-36333](https://cve.now/CVE-2020-36333.md): themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset\_wizard\_actions hook. (no CVSS)
- [CVE-2020-36334](https://cve.now/CVE-2020-36334.md): themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database. (no CVSS)
- [CVE-2020-22428](https://cve.now/CVE-2020-22428.md): SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an admin) containing a J (no CVSS)
- [CVE-2021-25179](https://cve.now/CVE-2021-25179.md): SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header. (no CVSS)
- [CVE-2021-31542](https://cve.now/CVE-2021-31542.md): In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversa (no CVSS, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.