# CVEs published 2021-05-10

55 CVEs were published on May 10, 2021: 1 critical, 6 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-23575](https://cve.now/CVE-2020-23575.md): A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. (no CVSS)
- [CVE-2020-23369](https://cve.now/CVE-2020-23369.md): In YzmCMS 5.6, XSS was discovered in member/member\_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4 (no CVSS)
- [CVE-2020-23370](https://cve.now/CVE-2020-23370.md): In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attac (no CVSS)
- [CVE-2020-23371](https://cve.now/CVE-2020-23371.md): Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remo (no CVSS)
- [CVE-2020-23373](https://cve.now/CVE-2020-23373.md): Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary w (no CVSS)
- [CVE-2020-23374](https://cve.now/CVE-2020-23374.md): Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitra (no CVSS)
- [CVE-2020-23376](https://cve.now/CVE-2020-23376.md): NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be inj (no CVSS)
- [CVE-2021-32489](https://cve.now/CVE-2021-32489.md): An issue was discovered in the \_send\_secure\_msg() function of Yubico yubihsm-shell through 2.0.3. (CVSS 4.4)
- [CVE-2021-32399](https://cve.now/CVE-2021-32399.md): net/bluetooth/hci\_request.c in the Linux kernel through 5.12.2 has a race condition for removal of the HCI controller. (no CVSS)
- [CVE-2021-32053](https://cve.now/CVE-2021-32053.md): JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history (no CVSS, ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base)
- [CVE-2021-21430](https://cve.now/CVE-2021-21430.md): Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code (CVSS 6.2, OpenAPITools openapi-generator · org.openapitools:openapi-g…)
- [CVE-2020-28600](https://cve.now/CVE-2020-28600.md): An out-of-bounds write vulnerability exists in the import\_stl.cc:import\_stl() functionality of Openscad openscad-2020.12-RC2. (CVSS 8.8, Openscad)
- [CVE-2020-18102](https://cve.now/CVE-2020-18102.md): Cross Site Scripting (XSS) in Hotels\_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fi (no CVSS)
- [CVE-2020-27232](https://cve.now/CVE-2020-27232.md): An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-28588](https://cve.now/CVE-2020-28588.md): An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. (CVSS 4.0, Linux Kernel)
- [CVE-2021-21428](https://cve.now/CVE-2021-21428.md): Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator (CVSS 9.3, OpenAPITools openapi-generator · org.openapitools:openapi-g…)
- [CVE-2020-27226](https://cve.now/CVE-2020-27226.md): An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. (CVSS 6.4, OpenClinic)
- [CVE-2020-27231](https://cve.now/CVE-2020-27231.md): A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27230](https://cve.now/CVE-2020-27230.md): A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27229](https://cve.now/CVE-2020-27229.md): A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2021-29022](https://cve.now/CVE-2021-29022.md): In InvoicePlane 1.5.11, the upload feature discloses the full path of the file upload directory. (no CVSS)
- [CVE-2020-19199](https://cve.now/CVE-2020-19199.md): A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious u (no CVSS)
- [CVE-2021-29502](https://cve.now/CVE-2021-29502.md): Remote code execution in the WarnSystem module of Laggrons-Dumb-Cogs (CVSS 7.3, retke Laggrons-Dumb-Cogs)
- [CVE-2021-29501](https://cve.now/CVE-2021-29501.md): Remote code execution in ticketer (CVSS 8.1, Dav-Git Dav-Cogs)
- [CVE-2021-20577](https://cve.now/CVE-2021-20577.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 is vulnerable to cross-site scripting. (CVSS 4.3, IBM Cloud Pak for Security)
- [CVE-2021-20559](https://cve.now/CVE-2021-20559.md): IBM Control Desk 7.6.1.2 and 7.6.1.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Control Desk)
- [CVE-2021-20538](https://cve.now/CVE-2021-20538.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0 and 1.5.0.1 could allow a user to obtain sensitive information or perform actions they should not (CVSS 4.8, IBM Cloud Pak for Security)
- [CVE-2020-13529](https://cve.now/CVE-2020-13529.md): An exploitable denial-of-service vulnerability exists in Systemd 245. (CVSS 6.1, Systemd)
- [CVE-2021-21822](https://cve.now/CVE-2021-21822.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. (CVSS 8.8, Foxit)
- [CVE-2021-23016](https://cve.now/CVE-2021-23016.md): On BIG-IP APM versions 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, and all versions of 16.0.x, 12.1.x, and 11.6.x, a (no CVSS, BIG-IP APM)
- [CVE-2021-23015](https://cve.now/CVE-2021-23015.md): On BIG-IP 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.0.8 through 13.1.3.6, and all versions of 16.0.x, when running in Appliance Mod (no CVSS, BIG-IP)
- [CVE-2021-23014](https://cve.now/CVE-2021-23014.md): On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization ch (no CVSS, BIG-IP ASM/Advanced WAF)
- [CVE-2021-23010](https://cve.now/CVE-2021-23010.md): On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and 12.1.x before 12.1.5.3, when t (no CVSS, BIG-IP ASM/Advanced WAF)
- [CVE-2021-23009](https://cve.now/CVE-2021-23009.md): On BIG-IP version 16.0.x before 16.0.1.1 and 15.1.x before 15.1.3, malformed HTTP/2 requests may cause an infinite loop which causes a Denia (no CVSS, BIG-IP)
- [CVE-2021-23012](https://cve.now/CVE-2021-23012.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation fo (no CVSS, BIG-IP)
- [CVE-2021-23013](https://cve.now/CVE-2021-23013.md): On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, t (no CVSS, BIG-IP)
- [CVE-2021-23011](https://cve.now/CVE-2021-23011.md): On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befor (no CVSS, BIG-IP)
- [CVE-2021-23008](https://cve.now/CVE-2021-23008.md): On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., B (no CVSS, BIG-IP APM)
- [CVE-2021-32056](https://cve.now/CVE-2021-32056.md): Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on serve (no CVSS)
- [CVE-2021-25645](https://cve.now/CVE-2021-25645.md): An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. (no CVSS)
- [CVE-2021-26583](https://cve.now/CVE-2021-26583.md): A potential security vulnerability was identified in HPE iLO Amplifier Pack. (no CVSS, iLO Amplifier Pack)
- [CVE-2020-22809](https://cve.now/CVE-2020-22809.md): In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation. (no CVSS)
- [CVE-2021-22672](https://cve.now/CVE-2021-22672.md): Delta Electronics' CNCSoft ScreenEditor in versions prior to v1.01.30 could allow the corruption of data, a denial-of-service condition, or (no CVSS, Delta Electronics CNCSoft ScreenEditor)
- [CVE-2021-24011](https://cve.now/CVE-2021-24011.md): A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing t (CVSS 6.3, Fortinet FortiNAC)
- [CVE-2021-31520](https://cve.now/CVE-2021-31520.md): A weak session token authentication bypass vulnerability in Trend Micro IM Security 1.6 and 1.6.5 could allow an remote attacker to guess cu (no CVSS, Trend Micro IM Security)
- [CVE-2021-25849](https://cve.now/CVE-2021-25849.md): An integer underflow was discovered in userdisk/vport\_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the Por (no CVSS)
- [CVE-2021-25846](https://cve.now/CVE-2021-25846.md): Improper validation of the ChassisID TLV in userdisk/vport\_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause (no CVSS)
- [CVE-2021-25845](https://cve.now/CVE-2021-25845.md): Improper validation of the ChassisID TLV in userdisk/vport\_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause (no CVSS)
- [CVE-2021-25847](https://cve.now/CVE-2021-25847.md): Improper validation of the length field of LLDP-MED TLV in userdisk/vport\_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows inf (no CVSS)
- [CVE-2021-25848](https://cve.now/CVE-2021-25848.md): Improper validation of the length field of LLDP-MED TLV in userdisk/vport\_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows inf (no CVSS)
- [CVE-2021-20717](https://cve.now/CVE-2021-20717.md): Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific i (no CVSS, EC-CUBE CO. EC-CUBE · ec-cube/ec-cube)
- [CVE-2021-3003](https://cve.now/CVE-2021-3003.md): Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP, which allows man-in-the-middle (no CVSS)
- [CVE-2021-32471](https://cve.now/CVE-2021-32471.md): Insufficient input validation in the Marvin Minsky 1967 implementation of the Universal Turing Machine allows program users to execute arbit (no CVSS)
- [CVE-2021-28663](https://cve.now/CVE-2021-28663.md): The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading t (CVSS 8.8, KEV)
- [CVE-2021-28664](https://cve.now/CVE-2021-28664.md): The Arm Mali GPU kernel driver allows privilege escalation or a denial of service (memory corruption) because an unprivileged user can achie (CVSS 8.8, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.