# CVEs published 2021-05-11

141 CVEs were published on May 11, 2021: 3 critical, 40 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-20311](https://cve.now/CVE-2021-20311.md): A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c m (no CVSS, ImageMagick)
- [CVE-2021-20310](https://cve.now/CVE-2021-20310.md): A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trig (no CVSS, ImageMagick)
- [CVE-2021-3504](https://cve.now/CVE-2021-3504.md): A flaw was found in the hivex library in versions before 1.3.20. (no CVSS, hivex)
- [CVE-2021-32605](https://cve.now/CVE-2021-32605.md): zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=sea (no CVSS)
- [CVE-2021-32604](https://cve.now/CVE-2021-32604.md): Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS." (no CVSS)
- [CVE-2021-32089](https://cve.now/CVE-2021-32089.md): An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. (no CVSS)
- [CVE-2020-26141](https://cve.now/CVE-2020-26141.md): An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. (no CVSS)
- [CVE-2020-26142](https://cve.now/CVE-2020-26142.md): An issue was discovered in the kernel in OpenBSD 6.6. (no CVSS)
- [CVE-2020-26147](https://cve.now/CVE-2020-26147.md): An issue was discovered in the Linux kernel 5.8.9. (no CVSS)
- [CVE-2020-26146](https://cve.now/CVE-2020-26146.md): An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. (CVSS 5.3)
- [CVE-2020-26139](https://cve.now/CVE-2020-26139.md): An issue was discovered in the kernel in NetBSD 7.1. (no CVSS)
- [CVE-2020-26143](https://cve.now/CVE-2020-26143.md): An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. (no CVSS)
- [CVE-2020-26145](https://cve.now/CVE-2020-26145.md): An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. (no CVSS)
- [CVE-2020-26140](https://cve.now/CVE-2020-26140.md): An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. (no CVSS)
- [CVE-2020-26144](https://cve.now/CVE-2020-26144.md): An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. (no CVSS)
- [CVE-2021-31214](https://cve.now/CVE-2021-31214.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-31936](https://cve.now/CVE-2021-31936.md): Microsoft Accessibility Insights for Web Information Disclosure Vulnerability (CVSS 7.4, Microsoft Accessibility Insights for Web)
- [CVE-2021-31213](https://cve.now/CVE-2021-31213.md): Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code Remote - Containers Extension)
- [CVE-2021-31209](https://cve.now/CVE-2021-31209.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-31211](https://cve.now/CVE-2021-31211.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-31208](https://cve.now/CVE-2021-31208.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31207](https://cve.now/CVE-2021-31207.md): Microsoft Exchange Server Security Feature Bypass Vulnerability (CVSS 6.6, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-31204](https://cve.now/CVE-2021-31204.md): .NET and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft .NET Core · Microsoft .NET +3)
- [CVE-2021-31205](https://cve.now/CVE-2021-31205.md): Windows SMB Client Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-31198](https://cve.now/CVE-2021-31198.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Exchange Server 2019 Cumulative Update · Micro… +1)
- [CVE-2021-31200](https://cve.now/CVE-2021-31200.md): Common Utilities Remote Code Execution Vulnerability (CVSS 7.2, Microsoft common\_utils.py)
- [CVE-2021-31195](https://cve.now/CVE-2021-31195.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2021-31194](https://cve.now/CVE-2021-31194.md): OLE Automation Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-31192](https://cve.now/CVE-2021-31192.md): Windows Media Foundation Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31193](https://cve.now/CVE-2021-31193.md): Windows SSDP Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31191](https://cve.now/CVE-2021-31191.md): Windows Projected File System FS Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31188](https://cve.now/CVE-2021-31188.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31190](https://cve.now/CVE-2021-31190.md): Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31187](https://cve.now/CVE-2021-31187.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31185](https://cve.now/CVE-2021-31185.md): Windows Desktop Bridge Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31186](https://cve.now/CVE-2021-31186.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2021-31184](https://cve.now/CVE-2021-31184.md): Microsoft Windows Infrared Data Association (IrDA) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31181](https://cve.now/CVE-2021-31181.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31182](https://cve.now/CVE-2021-31182.md): Microsoft Bluetooth Driver Spoofing Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2021-31180](https://cve.now/CVE-2021-31180.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31178](https://cve.now/CVE-2021-31178.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31179](https://cve.now/CVE-2021-31179.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31177](https://cve.now/CVE-2021-31177.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31175](https://cve.now/CVE-2021-31175.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31176](https://cve.now/CVE-2021-31176.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2021-31174](https://cve.now/CVE-2021-31174.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31172](https://cve.now/CVE-2021-31172.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31173](https://cve.now/CVE-2021-31173.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31171](https://cve.now/CVE-2021-31171.md): Microsoft SharePoint Information Disclosure Vulnerability (CVSS 4.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31169](https://cve.now/CVE-2021-31169.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31170](https://cve.now/CVE-2021-31170.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31168](https://cve.now/CVE-2021-31168.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31167](https://cve.now/CVE-2021-31167.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31165](https://cve.now/CVE-2021-31165.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31166](https://cve.now/CVE-2021-31166.md): HTTP Protocol Stack Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft Windows)
- [CVE-2021-28479](https://cve.now/CVE-2021-28479.md): Windows CSC Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-28476](https://cve.now/CVE-2021-28476.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Windows)
- [CVE-2021-28478](https://cve.now/CVE-2021-28478.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-28474](https://cve.now/CVE-2021-28474.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-28461](https://cve.now/CVE-2021-28461.md): Dynamics Finance and Operations Cross-site Scripting Vulnerability (CVSS 6.1, Microsoft Dynamics 365 for Finance and Operations)
- [CVE-2021-28465](https://cve.now/CVE-2021-28465.md): Web Media Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Web Media Extensions)
- [CVE-2021-28455](https://cve.now/CVE-2021-28455.md): Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Access 2013 Service Pack · Microsoft Office +3)
- [CVE-2021-26422](https://cve.now/CVE-2021-26422.md): Skype for Business and Lync Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Lync Server 2013 CU10 · Microsoft Skype for Bu… +1)
- [CVE-2021-27068](https://cve.now/CVE-2021-27068.md): Visual Studio Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Visual Studio)
- [CVE-2021-26421](https://cve.now/CVE-2021-26421.md): Skype for Business and Lync Spoofing Vulnerability (CVSS 6.5, Microsoft Skype for Business Server 2015 CU11 · Microsoft L…)
- [CVE-2021-26419](https://cve.now/CVE-2021-26419.md): Scripting Engine Memory Corruption Vulnerability (CVSS 7.5, Microsoft Internet Explorer)
- [CVE-2021-26418](https://cve.now/CVE-2021-26418.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2020-18964](https://cve.now/CVE-2020-18964.md): Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote (no CVSS)
- [CVE-2021-29509](https://cve.now/CVE-2021-29509.md): Keepalive Connections Causing Denial Of Service in puma (CVSS 7.5, puma)
- [CVE-2021-32573](https://cve.now/CVE-2021-32573.md): The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. (no CVSS)
- [CVE-2021-29508](https://cve.now/CVE-2021-29508.md): Insecure deserialization in Wire (CVSS 9.1, AsynkronIT Wire · Wire)
- [CVE-2020-4536](https://cve.now/CVE-2020-4536.md): IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retu (CVSS 4.3, IBM OpenPages GRC Platform)
- [CVE-2020-4535](https://cve.now/CVE-2020-4535.md): IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM OpenPages GRC Platform)
- [CVE-2021-29471](https://cve.now/CVE-2021-29471.md): Denial of service in Matrix Synapse (CVSS 3.7, matrix-org synapse · matrix-synapse)
- [CVE-2020-20265](https://cve.now/CVE-2020-20265.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless proce (no CVSS)
- [CVE-2020-20267](https://cve.now/CVE-2020-20267.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process. (no CVSS)
- [CVE-2021-27611](https://cve.now/CVE-2021-27611.md): SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP re (CVSS 8.2, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2021-27612](https://cve.now/CVE-2021-27612.md): In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which could (CVSS 3.4, SAP SE SAP GUI for Windows)
- [CVE-2021-27613](https://cve.now/CVE-2021-27613.md): Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to (CVSS 7.8, SAP SE SAP Business One)
- [CVE-2021-27614](https://cve.now/CVE-2021-27614.md): SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an atta (CVSS 7.3, SAP SE SAP Business One,)
- [CVE-2021-27616](https://cve.now/CVE-2021-27616.md): Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One f (CVSS 7.8, SAP SE SAP Business One,)
- [CVE-2021-27617](https://cve.now/CVE-2021-27617.md): The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently vali (CVSS 4.9, SAP SE SAP Process Integration)
- [CVE-2021-27618](https://cve.now/CVE-2021-27618.md): The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file ty (CVSS 4.9, SAP SE SAP Process Integration)
- [CVE-2021-27619](https://cve.now/CVE-2021-27619.md): SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are n (CVSS 6.5, SAP SE SAP Commerce)
- [CVE-2021-21655](https://cve.now/CVE-2021-21655.md): A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specifi (no CVSS, Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…)
- [CVE-2021-21656](https://cve.now/CVE-2021-21656.md): Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Xcode integration Plugin · org.jenk…)
- [CVE-2021-21654](https://cve.now/CVE-2021-21654.md): Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read per (no CVSS, Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…)
- [CVE-2021-21652](https://cve.now/CVE-2021-21652.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to co (no CVSS, Jenkins project Jenkins Xray - Test Management for Jira Plu…)
- [CVE-2021-21653](https://cve.now/CVE-2021-21653.md): Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Over (no CVSS, Jenkins project Jenkins Xray - Test Management for Jira Plu…)
- [CVE-2021-21651](https://cve.now/CVE-2021-21651.md): Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read (no CVSS, Jenkins project Jenkins S3 publisher Plugin · org.jenkins-c…)
- [CVE-2021-21649](https://cve.now/CVE-2021-21649.md): Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins Dashboard View Plugin · org.jenkins…)
- [CVE-2021-21650](https://cve.now/CVE-2021-21650.md): Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, al (no CVSS, Jenkins project Jenkins S3 publisher Plugin · org.jenkins-c…)
- [CVE-2021-21648](https://cve.now/CVE-2021-21648.md): Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cr (no CVSS, Jenkins project Jenkins Credentials Plugin · org.jenkins-ci…)
- [CVE-2021-31537](https://cve.now/CVE-2021-31537.md): SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /r (no CVSS)
- [CVE-2021-32561](https://cve.now/CVE-2021-32561.md): OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters. (no CVSS, octoprint)
- [CVE-2021-32560](https://cve.now/CVE-2021-32560.md): The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not \*.log files. (no CVSS, octoprint)
- [CVE-2021-21990](https://cve.now/CVE-2021-21990.md): VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 p (no CVSS, Vmware Workspace One UEM console)
- [CVE-2020-35438](https://cve.now/CVE-2020-35438.md): Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5. (no CVSS)
- [CVE-2021-31897](https://cve.now/CVE-2021-31897.md): In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. (no CVSS)
- [CVE-2021-31898](https://cve.now/CVE-2021-31898.md): In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. (no CVSS)
- [CVE-2021-30482](https://cve.now/CVE-2021-30482.md): In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly (no CVSS)
- [CVE-2021-31915](https://cve.now/CVE-2021-31915.md): In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible. (no CVSS)
- [CVE-2021-31914](https://cve.now/CVE-2021-31914.md): In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible. (no CVSS)
- [CVE-2021-31913](https://cve.now/CVE-2021-31913.md): In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect\_uri were made during GitHub SSO token exchange. (no CVSS)
- [CVE-2021-31912](https://cve.now/CVE-2021-31912.md): In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset. (no CVSS)
- [CVE-2021-31911](https://cve.now/CVE-2021-31911.md): In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages. (no CVSS)
- [CVE-2021-31910](https://cve.now/CVE-2021-31910.md): In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible. (no CVSS)
- [CVE-2021-31908](https://cve.now/CVE-2021-31908.md): In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages. (no CVSS)
- [CVE-2021-31909](https://cve.now/CVE-2021-31909.md): In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible. (no CVSS)
- [CVE-2021-3315](https://cve.now/CVE-2021-3315.md): In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible. (no CVSS)
- [CVE-2021-31907](https://cve.now/CVE-2021-31907.md): In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly. (no CVSS)
- [CVE-2021-31906](https://cve.now/CVE-2021-31906.md): In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file. (no CVSS)
- [CVE-2021-26309](https://cve.now/CVE-2021-26309.md): Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Pe (no CVSS)
- [CVE-2021-26310](https://cve.now/CVE-2021-26310.md): In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible. (no CVSS)
- [CVE-2021-31904](https://cve.now/CVE-2021-31904.md): In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page. (no CVSS)
- [CVE-2021-30005](https://cve.now/CVE-2021-30005.md): In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. (no CVSS)
- [CVE-2021-31905](https://cve.now/CVE-2021-31905.md): In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible. (no CVSS)
- [CVE-2021-31902](https://cve.now/CVE-2021-31902.md): In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly. (no CVSS)
- [CVE-2021-31903](https://cve.now/CVE-2021-31903.md): In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS. (no CVSS)
- [CVE-2021-27733](https://cve.now/CVE-2021-27733.md): In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment. (no CVSS)
- [CVE-2021-31901](https://cve.now/CVE-2021-31901.md): In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group. (no CVSS)
- [CVE-2021-30504](https://cve.now/CVE-2021-30504.md): In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation. (no CVSS)
- [CVE-2021-29263](https://cve.now/CVE-2021-29263.md): In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS. (no CVSS)
- [CVE-2021-30006](https://cve.now/CVE-2021-30006.md): In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure. (no CVSS)
- [CVE-2021-31900](https://cve.now/CVE-2021-31900.md): In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host. (no CVSS)
- [CVE-2021-31899](https://cve.now/CVE-2021-31899.md): In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode. (no CVSS)
- [CVE-2020-27246](https://cve.now/CVE-2020-27246.md): An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27245](https://cve.now/CVE-2020-27245.md): An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27244](https://cve.now/CVE-2020-27244.md): An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27243](https://cve.now/CVE-2020-27243.md): An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2020-27242](https://cve.now/CVE-2020-27242.md): An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. (CVSS 6.4, OpenClinic GA)
- [CVE-2021-32544](https://cve.now/CVE-2021-32544.md): Intelligent global technology Ltd, igt+ - DOM-based Cross-Site Scripting (CVSS 5.4, Intelligent global technology igt+)
- [CVE-2021-30174](https://cve.now/CVE-2021-30174.md): RiyaLab Co., Ltd. CloudISO - Stored XSS (CVSS 5.4, RiyaLab Co. CloudISO)
- [CVE-2020-24586](https://cve.now/CVE-2020-24586.md): The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that rece (no CVSS)
- [CVE-2020-24587](https://cve.now/CVE-2020-24587.md): The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all (no CVSS)
- [CVE-2020-24588](https://cve.now/CVE-2020-24588.md): The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the (no CVSS)
- [CVE-2021-20309](https://cve.now/CVE-2021-20309.md): A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-ef (no CVSS, ImagemMagick)
- [CVE-2021-20312](https://cve.now/CVE-2021-20312.md): A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undef (no CVSS, ImageMagick)
- [CVE-2021-20313](https://cve.now/CVE-2021-20313.md): A flaw was found in ImageMagick in versions before 7.0.11. (no CVSS, ImageMagick)
- [CVE-2021-32563](https://cve.now/CVE-2021-32563.md): An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. (no CVSS)
- [CVE-2021-32606](https://cve.now/CVE-2021-32606.md): In the Linux kernel 5.11 through 5.12.2, isotp\_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-f (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.