# CVEs published 2021-05-06

103 CVEs were published on May 6, 2021: 9 critical, 18 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-32077](https://cve.now/CVE-2021-32077.md): Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number (no CVSS)
- [CVE-2020-23264](https://cve.now/CVE-2020-23264.md): Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators. (no CVSS, forkcms/forkcms)
- [CVE-2020-23263](https://cve.now/CVE-2020-23263.md): Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the (no CVSS, forkcms/forkcms)
- [CVE-2021-27941](https://cve.now/CVE-2021-27941.md): Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2 (no CVSS)
- [CVE-2021-29203](https://cve.now/CVE-2021-29203.md): A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Managemen (no CVSS, HPE Edgeline Infrastructure Management Software)
- [CVE-2021-31737](https://cve.now/CVE-2021-31737.md): emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php. (no CVSS)
- [CVE-2021-29493](https://cve.now/CVE-2021-29493.md): Kennnyshiwa-cogs vulnerable to Remote Code Execution in Tickets Module (CVSS 6.5, kennnyshiwa-cogs)
- [CVE-2021-28665](https://cve.now/CVE-2021-28665.md): Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive c (no CVSS)
- [CVE-2020-28198](https://cve.now/CVE-2020-28198.md): The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to a (no CVSS)
- [CVE-2021-31828](https://cve.now/CVE-2021-31828.md): An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or (no CVSS)
- [CVE-2020-18888](https://cve.now/CVE-2020-18888.md): Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php. (no CVSS)
- [CVE-2020-18890](https://cve.now/CVE-2020-18890.md): Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via (no CVSS)
- [CVE-2020-18889](https://cve.now/CVE-2020-18889.md): Cross Site Request Forgery (CSRF) vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php. (no CVSS)
- [CVE-2021-31793](https://cve.now/CVE-2021-31793.md): An issue exists on NightOwl WDB-20-V2 WDB-20-V2\_20190314 devices that allows an unauthenticated user to gain access to snapshots and video s (no CVSS)
- [CVE-2019-25043](https://cve.now/CVE-2019-25043.md): ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process cr (no CVSS)
- [CVE-2021-31918](https://cve.now/CVE-2021-31918.md): A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. (no CVSS, tripleo-ansible)
- [CVE-2021-31916](https://cve.now/CVE-2021-31916.md): An out-of-bounds (OOB) memory write flaw was found in list\_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux k (no CVSS, kernel)
- [CVE-2021-32052](https://cve.now/CVE-2021-32052.md): In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (no CVSS, django)
- [CVE-2021-31829](https://cve.now/CVE-2021-31829.md): kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via (no CVSS)
- [CVE-2021-3507](https://cve.now/CVE-2021-3507.md): A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). (no CVSS, QEMU)
- [CVE-2021-28149](https://cve.now/CVE-2021-28149.md): Hongdian H8922 3.0.5 devices allow Directory Traversal. (no CVSS)
- [CVE-2021-28150](https://cve.now/CVE-2021-28150.md): Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) v (no CVSS)
- [CVE-2021-28152](https://cve.now/CVE-2021-28152.md): Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser. (no CVSS)
- [CVE-2021-28151](https://cve.now/CVE-2021-28151.md): Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg (no CVSS)
- [CVE-2021-32030](https://cve.now/CVE-2021-32030.md): The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4\_384\_46630 allows authenticatio (CVSS 9.8, KEV)
- [CVE-2021-20204](https://cve.now/CVE-2021-20204.md): A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databas (CVSS 9.8, getdata)
- [CVE-2020-35519](https://cve.now/CVE-2020-35519.md): An out-of-bounds (OOB) memory access flaw was found in x25\_bind in net/x25/af\_x25.c in the Linux kernel version v5.12-rc5. (no CVSS, kernel)
- [CVE-2021-28128](https://cve.now/CVE-2021-28128.md): In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. (no CVSS, strapi)
- [CVE-2021-22209](https://cve.now/CVE-2021-22209.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. (CVSS 7.5, GitLab)
- [CVE-2021-22208](https://cve.now/CVE-2021-22208.md): An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. (CVSS 4.3, GitLab)
- [CVE-2021-22206](https://cve.now/CVE-2021-22206.md): An issue has been discovered in GitLab affecting all versions starting from 11.6. (CVSS 6.8, GitLab)
- [CVE-2021-22210](https://cve.now/CVE-2021-22210.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. (CVSS 5.3, GitLab)
- [CVE-2021-1535](https://cve.now/CVE-2021-1535.md): Cisco SD-WAN vManage Information Disclosure Vulnerability (CVSS 5.3, Cisco SD-WAN vManage)
- [CVE-2021-1532](https://cve.now/CVE-2021-1532.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Read Vulnerability (CVSS 6.5, Cisco TelePresence Endpoint Software)
- [CVE-2021-1530](https://cve.now/CVE-2021-1530.md): Cisco BroadWorks Messaging Server XML External Entity Injection Vulnerability (CVSS 5.4, Cisco BroadWorks)
- [CVE-2021-1521](https://cve.now/CVE-2021-1521.md): Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Denial of Service Vulnerability (CVSS 6.5, Cisco Video Surveillance 8000 Series IP Cameras)
- [CVE-2021-1520](https://cve.now/CVE-2021-1520.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability (CVSS 6.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1519](https://cve.now/CVE-2021-1519.md): Cisco AnyConnect Secure Mobility Client Profile Modification Vulnerability (CVSS 4.7, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1516](https://cve.now/CVE-2021-1516.md): Cisco Content Security Management Appliance, Email Security Appliance, and Web Security Appliance Information Disclosure Vulnerability (CVSS 4.3, Cisco Web Security Appliance)
- [CVE-2021-1515](https://cve.now/CVE-2021-1515.md): Cisco SD-WAN vManage Information Disclosure Vulnerability (CVSS 4.3, Cisco SD-WAN vManage)
- [CVE-2021-1514](https://cve.now/CVE-2021-1514.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 4.4, Cisco SD-WAN Solution)
- [CVE-2021-1513](https://cve.now/CVE-2021-1513.md): Cisco SD-WAN Software vDaemon Denial of Service Vulnerability (CVSS 7.5, Cisco SD-WAN Solution)
- [CVE-2021-1275](https://cve.now/CVE-2021-1275.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 9.8, Cisco SD-WAN vManage)
- [CVE-2021-1284](https://cve.now/CVE-2021-1284.md): Cisco SD-WAN vManage Software Authentication Bypass Vulnerability (CVSS 8.8, Cisco SD-WAN vManage)
- [CVE-2021-1363](https://cve.now/CVE-2021-1363.md): Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities (CVSS 7.1, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2021-1365](https://cve.now/CVE-2021-1365.md): Cisco Unified Communications Manager IM & Presence Service SQL Injection Vulnerabilities (CVSS 7.1, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2021-1397](https://cve.now/CVE-2021-1397.md): Cisco Integrated Management Controller Open Redirect Vulnerability (CVSS 4.7, Cisco Unified Computing System)
- [CVE-2021-1400](https://cve.now/CVE-2021-1400.md): Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities (CVSS 8.8, Cisco Business Wireless Access Point Software)
- [CVE-2021-1401](https://cve.now/CVE-2021-1401.md): Cisco Small Business 100, 300, and 500 Series Wireless Access Points Vulnerabilities (CVSS 8.8, Cisco Business Wireless Access Point Software)
- [CVE-2021-1421](https://cve.now/CVE-2021-1421.md): Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability (CVSS 7.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2021-1426](https://cve.now/CVE-2021-1426.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1427](https://cve.now/CVE-2021-1427.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1512](https://cve.now/CVE-2021-1512.md): Cisco SD-WAN Software Arbitrary File Corruption Vulnerability (CVSS 4.4, Cisco SD-WAN Solution)
- [CVE-2021-1511](https://cve.now/CVE-2021-1511.md): Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities (CVSS 7.5, Cisco SD-WAN vEdge router)
- [CVE-2021-1510](https://cve.now/CVE-2021-1510.md): Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities (CVSS 7.5, Cisco SD-WAN vEdge router)
- [CVE-2021-1509](https://cve.now/CVE-2021-1509.md): Cisco SD-WAN vEdge Software Buffer Overflow Vulnerabilities (CVSS 7.5, Cisco SD-WAN vEdge router)
- [CVE-2021-1508](https://cve.now/CVE-2021-1508.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 9.8, Cisco SD-WAN vManage)
- [CVE-2021-1507](https://cve.now/CVE-2021-1507.md): Cisco SD-WAN vManage API Stored Cross-Site Scripting Vulnerability (CVSS 6.4, Cisco SD-WAN vManage)
- [CVE-2021-1506](https://cve.now/CVE-2021-1506.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 9.8, Cisco SD-WAN vManage)
- [CVE-2021-1505](https://cve.now/CVE-2021-1505.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 9.8, Cisco SD-WAN vManage)
- [CVE-2021-1499](https://cve.now/CVE-2021-1499.md): Cisco HyperFlex HX Data Platform File Upload Vulnerability (CVSS 5.3, Cisco HyperFlex HX Data Platform)
- [CVE-2021-1498](https://cve.now/CVE-2021-1498.md): Cisco HyperFlex HX Command Injection Vulnerabilities (CVSS 9.8, KEV, Cisco HyperFlex HX Data Platform)
- [CVE-2021-1497](https://cve.now/CVE-2021-1497.md): Cisco HyperFlex HX Command Injection Vulnerabilities (CVSS 9.8, KEV, Cisco HyperFlex HX Data Platform)
- [CVE-2021-1496](https://cve.now/CVE-2021-1496.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1490](https://cve.now/CVE-2021-1490.md): Cisco Web Security Appliance Cross-Site Scripting Vulnerability (CVSS 4.7, Cisco Web Security Appliance)
- [CVE-2021-1486](https://cve.now/CVE-2021-1486.md): Cisco SD-WAN vManage HTTP Authentication User Enumeration Vulnerability (CVSS 5.3, Cisco SD-WAN vManage)
- [CVE-2021-1478](https://cve.now/CVE-2021-1478.md): Cisco Unified Communications Manager Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Communications Manager)
- [CVE-2021-1468](https://cve.now/CVE-2021-1468.md): Cisco SD-WAN vManage Software Vulnerabilities (CVSS 9.8, Cisco SD-WAN vManage)
- [CVE-2021-1447](https://cve.now/CVE-2021-1447.md): Cisco Content Security Management Appliance Privilege Escalation Vulnerability (CVSS 6.7, Cisco Content Security Management Appliance)
- [CVE-2021-1438](https://cve.now/CVE-2021-1438.md): Cisco Wide Area Application Services Software Information Disclosure Vulnerability (CVSS 5.5, Cisco Wide Area Application Services)
- [CVE-2021-1429](https://cve.now/CVE-2021-1429.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1430](https://cve.now/CVE-2021-1430.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1428](https://cve.now/CVE-2021-1428.md): Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking Vulnerabilities (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-21550](https://cve.now/CVE-2021-21550.md): Dell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2021-21527](https://cve.now/CVE-2021-21527.md): Dell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2021-21505](https://cve.now/CVE-2021-21505.md): Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. (CVSS 8.0, Dell EMC Integrated System for Microsoft Azure Stack Hub)
- [CVE-2021-26543](https://cve.now/CVE-2021-26543.md): The "gitDiff" function in Wayfair git-parse \<=1.0.4 has a command injection vulnerability. (no CVSS, git-parse)
- [CVE-2021-31245](https://cve.now/CVE-2021-31245.md): omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length depe (no CVSS)
- [CVE-2021-31616](https://cve.now/CVE-2021-31616.md): Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted message (no CVSS)
- [CVE-2021-31532](https://cve.now/CVE-2021-31532.md): NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (no CVSS)
- [CVE-2021-27216](https://cve.now/CVE-2021-27216.md): Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. (no CVSS)
- [CVE-2020-28026](https://cve.now/CVE-2020-28026.md): Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Noti (no CVSS)
- [CVE-2020-28025](https://cve.now/CVE-2020-28025.md): Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim\_finish\_bodyhash does not validate the relationship between sig-\>bodyhash.len an (no CVSS)
- [CVE-2020-28024](https://cve.now/CVE-2020-28024.md): Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp (no CVSS)
- [CVE-2020-28023](https://cve.now/CVE-2020-28023.md): Exim 4 before 4.94.2 allows Out-of-bounds Read. (no CVSS)
- [CVE-2020-28022](https://cve.now/CVE-2020-28022.md): Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. (no CVSS)
- [CVE-2020-28021](https://cve.now/CVE-2020-28021.md): Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. (no CVSS)
- [CVE-2020-28020](https://cve.now/CVE-2020-28020.md): Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by lev (no CVSS)
- [CVE-2020-28019](https://cve.now/CVE-2020-28019.md): Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. (no CVSS)
- [CVE-2020-28018](https://cve.now/CVE-2020-28018.md): Exim 4 before 4.94.2 allows Use After Free in smtp\_reset in certain situations that may be common for builds with OpenSSL. (no CVSS)
- [CVE-2020-28017](https://cve.now/CVE-2020-28017.md): Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive\_add\_recipient via an e-mail message with fifty million recipients (no CVSS)
- [CVE-2020-28016](https://cve.now/CVE-2020-28016.md): Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse\_fix\_phrase. (no CVSS)
- [CVE-2020-28015](https://cve.now/CVE-2020-28015.md): Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. (no CVSS)
- [CVE-2020-28014](https://cve.now/CVE-2020-28014.md): Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. (no CVSS)
- [CVE-2020-28013](https://cve.now/CVE-2020-28013.md): Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege esc (no CVSS)
- [CVE-2020-28012](https://cve.now/CVE-2020-28012.md): Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda\_interpret uses a privileged pipe that lacks (no CVSS)
- [CVE-2020-28011](https://cve.now/CVE-2020-28011.md): Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue\_run via two sender options: -R and -S. (no CVSS)
- [CVE-2020-28010](https://cve.now/CVE-2020-28010.md): Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname (no CVSS)
- [CVE-2020-28009](https://cve.now/CVE-2020-28009.md): Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get\_stdinput allows unbounded reads that are accompanied by unbounde (no CVSS)
- [CVE-2020-28008](https://cve.now/CVE-2020-28008.md): Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. (no CVSS)
- [CVE-2020-28007](https://cve.now/CVE-2020-28007.md): Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. (no CVSS)
- [CVE-2021-29921](https://cve.now/CVE-2021-29921.md): In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. (no CVSS, libpython · python +1)
- [CVE-2021-30473](https://cve.now/CVE-2021-30473.md): aom\_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.