# CVEs published 2021-05-13

63 CVEs were published on May 13, 2021: 4 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-33026](https://cve.now/CVE-2021-33026.md): The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local pr (CVSS 9.8, flask-caching)
- [CVE-2021-32615](https://cve.now/CVE-2021-32615.md): Piwigo 11.4.0 allows admin/user\_list\_backend.php order\[0\]\[dir\] SQL Injection. (no CVSS)
- [CVE-2021-31876](https://cve.now/CVE-2021-31876.md): Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attacke (no CVSS)
- [CVE-2019-10062](https://cve.now/CVE-2019-10062.md): The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. (no CVSS, aurelia-framework)
- [CVE-2020-23996](https://cve.now/CVE-2020-23996.md): A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code (no CVSS)
- [CVE-2020-23995](https://cve.now/CVE-2020-23995.md): An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data (no CVSS)
- [CVE-2021-23910](https://cve.now/CVE-2021-23910.md): An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. (CVSS 5.3)
- [CVE-2021-23909](https://cve.now/CVE-2021-23909.md): An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. (CVSS 6.3)
- [CVE-2021-23908](https://cve.now/CVE-2021-23908.md): An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. (CVSS 2.9)
- [CVE-2021-23907](https://cve.now/CVE-2021-23907.md): An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. (CVSS 2.9)
- [CVE-2021-27413](https://cve.now/CVE-2021-27413.md): Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, whic (no CVSS, Omron CX-One)
- [CVE-2021-23906](https://cve.now/CVE-2021-23906.md): An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. (CVSS 1.8)
- [CVE-2021-29510](https://cve.now/CVE-2021-29510.md): Use of "infinity" as an input to datetime and date fields causes infinite loop in pydantic (CVSS 3.3, samuelcolvin pydantic · pydantic)
- [CVE-2021-29506](https://cve.now/CVE-2021-29506.md): Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service. (CVSS 6.5, graphhopper · com.graphhopper:graphhopper-nav)
- [CVE-2021-32925](https://cve.now/CVE-2021-32925.md): admin/user\_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities. (no CVSS)
- [CVE-2021-22140](https://cve.now/CVE-2021-22140.md): Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawle (no CVSS, Elastic App Search)
- [CVE-2021-22138](https://cve.now/CVE-2021-22138.md): In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. (no CVSS, Elasticsearch)
- [CVE-2021-22139](https://cve.now/CVE-2021-22139.md): Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limit (no CVSS, Elastic Kibana)
- [CVE-2021-22137](https://cve.now/CVE-2021-22137.md): In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2021-22135](https://cve.now/CVE-2021-22135.md): Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2021-22136](https://cve.now/CVE-2021-22136.md): In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout settin (no CVSS, Elastic Kibana)
- [CVE-2021-20221](https://cve.now/CVE-2021-20221.md): An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0o (no CVSS, qemu)
- [CVE-2021-20535](https://cve.now/CVE-2021-20535.md): IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). (CVSS 6.5, IBM Jazz Reporting Service)
- [CVE-2021-20181](https://cve.now/CVE-2021-20181.md): A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. (no CVSS, qemu)
- [CVE-2021-32921](https://cve.now/CVE-2021-32921.md): An issue was discovered in Prosody before 0.11.9. (no CVSS)
- [CVE-2021-32920](https://cve.now/CVE-2021-32920.md): Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests. (no CVSS)
- [CVE-2021-32919](https://cve.now/CVE-2021-32919.md): An issue was discovered in Prosody before 0.11.9. (no CVSS)
- [CVE-2021-32918](https://cve.now/CVE-2021-32918.md): An issue was discovered in Prosody before 0.11.9. (no CVSS)
- [CVE-2021-32917](https://cve.now/CVE-2021-32917.md): An issue was discovered in Prosody before 0.11.9. (no CVSS)
- [CVE-2021-20025](https://cve.now/CVE-2021-20025.md): SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at ini (no CVSS, SonicWall Email Security Virtual Appliance)
- [CVE-2020-21342](https://cve.now/CVE-2020-21342.md): Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php. (no CVSS)
- [CVE-2021-3528](https://cve.now/CVE-2021-3528.md): A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core (no CVSS, NooBaa)
- [CVE-2020-25713](https://cve.now/CVE-2020-25713.md): A malformed input file can lead to a segfault due to an out of bounds array access in raptor\_xml\_writer\_start\_element\_common. (no CVSS, raptor2)
- [CVE-2020-27830](https://cve.now/CVE-2020-27830.md): A vulnerability was found in Linux Kernel where in the spk\_ttyio\_receive\_buf2() function, it would dereference spk\_ttyio\_synth without check (no CVSS, kernel)
- [CVE-2020-28063](https://cve.now/CVE-2020-28063.md): A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell. (no CVSS)
- [CVE-2020-20092](https://cve.now/CVE-2020-20092.md): File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and pla (no CVSS)
- [CVE-2020-27823](https://cve.now/CVE-2020-27823.md): A flaw was found in OpenJPEG’s encoder. (no CVSS, openjpeg)
- [CVE-2020-27824](https://cve.now/CVE-2020-27824.md): A flaw was found in OpenJPEG’s encoder in the opj\_dwt\_calc\_explicit\_stepsizes() function. (no CVSS, openjpeg)
- [CVE-2021-20999](https://cve.now/CVE-2021-20999.md): WEIDMUELLER: Accidentally open network port in u-controls and IoT-Gateways (CVSS 9.4, Weidmüller UC20-WL2000-AC · Weidmüller UC20-WL2000-IOT +2)
- [CVE-2021-20998](https://cve.now/CVE-2021-20998.md): WAGO: Managed Switches: Unauthorized creation of user accounts (CVSS 10.0, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20997](https://cve.now/CVE-2021-20997.md): WAGO: Managed Switches: Unauthorized access to password hashes (CVSS 7.5, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20996](https://cve.now/CVE-2021-20996.md): WAGO: Managed Switches: Unsecure Cookie settings (CVSS 5.3, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20995](https://cve.now/CVE-2021-20995.md): WAGO: Managed Switches: Storage of user credentials in a cookie (CVSS 5.3, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20994](https://cve.now/CVE-2021-20994.md): WAGO: Managed Switches: Reflected Cross-site Scripting (CVSS 8.8, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20993](https://cve.now/CVE-2021-20993.md): WAGO: Managed Switches: Exposure of sensitive information through directory listing (CVSS 5.3, WAGO 0852-0303 · WAGO 0852-1305 +3)
- [CVE-2021-20988](https://cve.now/CVE-2021-20988.md): Hilscher rcX RTOS: Wrong handling of the UDP checksum (CVSS 8.6, Hilscher rcX RTOS · Pepperl+Fuchs Ethernet IO Modules IC… +1)
- [CVE-2020-12526](https://cve.now/CVE-2020-12526.md): BECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA Server (CVSS 5.3, Beckhoff TwinCAT OPC UA Server · Beckhoff IPC Diagnostic… +1)
- [CVE-2020-14354](https://cve.now/CVE-2020-14354.md): A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares\_destroy() is called prior to ares\_getaddrinfo() completing. (no CVSS, c-ares)
- [CVE-2021-20250](https://cve.now/CVE-2021-20250.md): A flaw was found in wildfly. (no CVSS, wildfly · org.jboss:jboss-ejb-client)
- [CVE-2021-25693](https://cve.now/CVE-2021-25693.md): An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference. (no CVSS)
- [CVE-2021-25694](https://cve.now/CVE-2021-25694.md): Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. (no CVSS)
- [CVE-2021-26311](https://cve.now/CVE-2021-26311.md): AMD Secure Encrypted Virtualization (no CVSS, AMD SEV/SEV-ES)
- [CVE-2020-12967](https://cve.now/CVE-2020-12967.md): AMD Secure Encrypted Virtualization (no CVSS, AMD SEV/SEV-ES)
- [CVE-2021-22154](https://cve.now/CVE-2021-22154.md): An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1 (no CVSS)
- [CVE-2021-22153](https://cve.now/CVE-2021-22153.md): A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a (no CVSS)
- [CVE-2021-22152](https://cve.now/CVE-2021-22152.md): A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 (no CVSS)
- [CVE-2021-20331](https://cve.now/CVE-2021-20331.md): MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application (CVSS 4.2, MongoDB C# Driver · mongodb.driver)
- [CVE-2021-31215](https://cve.now/CVE-2021-31215.md): SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlu (no CVSS)
- [CVE-2021-28799](https://cve.now/CVE-2021-28799.md): Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync) (CVSS 10.0, KEV, QNAP Systems HBS)
- [CVE-2020-36198](https://cve.now/CVE-2020-36198.md): Command Injection Vulnerability in Malware Remover (CVSS 6.7, QNAP Systems Malware Remover)
- [CVE-2020-36197](https://cve.now/CVE-2020-36197.md): Improper Access Control Vulnerability in Music Station (CVSS 7.1, QNAP Systems Music Station)
- [CVE-2021-21424](https://cve.now/CVE-2021-21424.md): Prevent user enumeration using Guard or the new Authenticator-based Security (CVSS 5.3, symfony · symfony/security +6)
- [CVE-2021-29623](https://cve.now/CVE-2021-29623.md): Uninitialized variable bug in Exiv2 (CVSS 3.6, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.