# CVEs published 2021-05-14

170 CVEs were published on May 14, 2021: 2 critical, 6 high. Days are UTC.

- [CVE-2020-16632](https://cve.now/CVE-2020-16632.md): A XSS Vulnerability in /uploads/dede/action\_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via (no CVSS)
- [CVE-2021-32073](https://cve.now/CVE-2021-32073.md): DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remo (no CVSS)
- [CVE-2019-25044](https://cve.now/CVE-2019-25044.md): The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and (no CVSS)
- [CVE-2021-33033](https://cve.now/CVE-2021-33033.md): The Linux kernel before 5.11.14 has a use-after-free in cipso\_v4\_genopt in net/ipv4/cipso\_ipv4.c because the CIPSO and CALIPSO refcounting f (no CVSS)
- [CVE-2021-33034](https://cve.now/CVE-2021-33034.md): In the Linux kernel before 5.12.4, net/bluetooth/hci\_event.c has a use-after-free when destroying an hci\_chan, aka CID-5c4c8c954409. (no CVSS)
- [CVE-2021-22866](https://cve.now/CVE-2021-22866.md): UI misrepresentation of granted permissions in GitHub Enterprise Server leading to unauthorized access to user resources (no CVSS, GitHub Enterprise Server)
- [CVE-2021-27737](https://cve.now/CVE-2021-27737.md): Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin. (no CVSS, Apache Traffic Server)
- [CVE-2021-32054](https://cve.now/CVE-2021-32054.md): Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered (no CVSS)
- [CVE-2020-24119](https://cve.now/CVE-2020-24119.md): A heap buffer overflow read was discovered in upx 4.0.0, because the check in p\_lx\_elf.cpp is not perfect. (no CVSS)
- [CVE-2020-27833](https://cve.now/CVE-2020-27833.md): A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially craf (no CVSS, openshift/oc)
- [CVE-2021-3402](https://cve.now/CVE-2021-3402.md): An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could allow an attacker to (no CVSS, libyara)
- [CVE-2021-3537](https://cve.now/CVE-2021-3537.md): A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a (no CVSS, libxml2 · nokogiri)
- [CVE-2021-29513](https://cve.now/CVE-2021-29513.md): Type confusion during tensor casts lead to dereferencing null pointers (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29514](https://cve.now/CVE-2021-29514.md): Heap out of bounds write in \`RaggedBinCount\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29515](https://cve.now/CVE-2021-29515.md): Reference binding to null pointer in \`MatrixDiag\*\` ops (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29516](https://cve.now/CVE-2021-29516.md): Null pointer dereference via invalid Ragged Tensors (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29517](https://cve.now/CVE-2021-29517.md): Division by zero in \`Conv3D\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29518](https://cve.now/CVE-2021-29518.md): Session operations in eager mode lead to null pointer dereferences (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29519](https://cve.now/CVE-2021-29519.md): CHECK-fail in SparseCross due to type confusion (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29520](https://cve.now/CVE-2021-29520.md): Heap buffer overflow in \`Conv3DBackprop\*\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29521](https://cve.now/CVE-2021-29521.md): Segfault in SparseCountSparseOutput (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29522](https://cve.now/CVE-2021-29522.md): Division by 0 in \`Conv3DBackprop\*\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29523](https://cve.now/CVE-2021-29523.md): CHECK-fail in AddManySparseToTensorsMap (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29524](https://cve.now/CVE-2021-29524.md): Division by 0 in \`Conv2DBackpropFilter\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29585](https://cve.now/CVE-2021-29585.md): Division by zero in padding computation in TFLite (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29586](https://cve.now/CVE-2021-29586.md): Division by zero in optimized pooling implementations in TFLite (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2020-17891](https://cve.now/CVE-2020-17891.md): TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbit (no CVSS)
- [CVE-2021-29615](https://cve.now/CVE-2021-29615.md): Stack overflow in \`ParseAttrValue\` with nested tensors (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29616](https://cve.now/CVE-2021-29616.md): Null dereference in Grappler's \`TrySimplify\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29617](https://cve.now/CVE-2021-29617.md): Crash in \`tf.strings.substr\` due to \`CHECK\`-fail (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29618](https://cve.now/CVE-2021-29618.md): Crash in \`tf.transpose\` with complex inputs (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29619](https://cve.now/CVE-2021-29619.md): Segfault in \`tf.raw\_ops.SparseCountSparseOutput\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29587](https://cve.now/CVE-2021-29587.md): Division by zero in TFLite's implementation of \`SpaceToDepth\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29588](https://cve.now/CVE-2021-29588.md): Division by zero in TFLite's implementation of \`TransposeConv\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29589](https://cve.now/CVE-2021-29589.md): Division by zero in TFLite's implementation of \`GatherNd\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29590](https://cve.now/CVE-2021-29590.md): Heap OOB read in TFLite's implementation of \`Minimum\` or \`Maximum\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29591](https://cve.now/CVE-2021-29591.md): Stack overflow due to looping TFLite subgraph (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29592](https://cve.now/CVE-2021-29592.md): Null pointer dereference in TFLite's \`Reshape\` operator (CVSS 4.4, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29593](https://cve.now/CVE-2021-29593.md): Division by zero in TFLite's implementation of \`BatchToSpaceNd\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29594](https://cve.now/CVE-2021-29594.md): Division by zero in TFLite's convolution code (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29595](https://cve.now/CVE-2021-29595.md): Division by zero in TFLite's implementation of \`DepthToSpace\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29596](https://cve.now/CVE-2021-29596.md): Division by zero in TFLite's implementation of \`EmbeddingLookup\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29597](https://cve.now/CVE-2021-29597.md): Division by zero in TFLite's implementation of \`SpaceToBatchNd\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29598](https://cve.now/CVE-2021-29598.md): Division by zero in TFLite's implementation of \`SVDF\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29599](https://cve.now/CVE-2021-29599.md): Division by zero in TFLite's implementation of \`Split\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29600](https://cve.now/CVE-2021-29600.md): Division by zero in TFLite's implementation of \`OneHot\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29601](https://cve.now/CVE-2021-29601.md): Integer overflow in TFLite concatentation (CVSS 6.3, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29602](https://cve.now/CVE-2021-29602.md): Division by zero in TFLite's implementation of \`DepthwiseConv\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29603](https://cve.now/CVE-2021-29603.md): Heap OOB write in TFLite (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29604](https://cve.now/CVE-2021-29604.md): Division by zero in TFLite's implementation of hashtable lookup (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29605](https://cve.now/CVE-2021-29605.md): Integer overflow in TFLite memory allocation (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29606](https://cve.now/CVE-2021-29606.md): Heap OOB read in TFLite (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29607](https://cve.now/CVE-2021-29607.md): Incomplete validation in \`SparseSparseMinimum\` (CVSS 5.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29608](https://cve.now/CVE-2021-29608.md): Heap OOB and null pointer dereference in \`RaggedTensorToTensor\` (CVSS 5.3, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29609](https://cve.now/CVE-2021-29609.md): Incomplete validation in \`SparseAdd\` (CVSS 5.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29610](https://cve.now/CVE-2021-29610.md): Invalid validation in \`QuantizeAndDequantizeV2\` (CVSS 3.6, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29611](https://cve.now/CVE-2021-29611.md): Incomplete validation in \`SparseReshape\` (CVSS 3.6, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29612](https://cve.now/CVE-2021-29612.md): Heap buffer overflow in \`BandedTriangularSolve\` (CVSS 3.6, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29613](https://cve.now/CVE-2021-29613.md): Incomplete validation in \`tf.raw\_ops.CTCLoss\` (CVSS 6.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29614](https://cve.now/CVE-2021-29614.md): Interpreter crash from \`tf.io.decode\_raw\` (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29555](https://cve.now/CVE-2021-29555.md): Division by 0 in \`FusedBatchNorm\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29556](https://cve.now/CVE-2021-29556.md): Division by 0 in \`Reverse\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29557](https://cve.now/CVE-2021-29557.md): Division by 0 in \`SparseMatMul\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29558](https://cve.now/CVE-2021-29558.md): Heap buffer overflow in \`SparseSplit\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29559](https://cve.now/CVE-2021-29559.md): Heap OOB access in unicode ops (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29560](https://cve.now/CVE-2021-29560.md): Heap buffer overflow in \`RaggedTensorToTensor\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29561](https://cve.now/CVE-2021-29561.md): CHECK-fail in \`LoadAndRemapMatrix\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29562](https://cve.now/CVE-2021-29562.md): CHECK-fail in \`tf.raw\_ops.IRFFT\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29563](https://cve.now/CVE-2021-29563.md): CHECK-fail in \`tf.raw\_ops.RFFT\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29564](https://cve.now/CVE-2021-29564.md): Null pointer dereference in \`EditDistance\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29565](https://cve.now/CVE-2021-29565.md): Null pointer dereference in \`SparseFillEmptyRows\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29566](https://cve.now/CVE-2021-29566.md): Heap OOB access in \`Dilation2DBackpropInput\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29567](https://cve.now/CVE-2021-29567.md): Lack of validation in \`SparseDenseCwiseMul\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29568](https://cve.now/CVE-2021-29568.md): Reference binding to null in \`ParameterizedTruncatedNormal\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29569](https://cve.now/CVE-2021-29569.md): Heap out of bounds read in \`RequantizationRange\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29570](https://cve.now/CVE-2021-29570.md): Heap out of bounds read in \`MaxPoolGradWithArgmax\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29571](https://cve.now/CVE-2021-29571.md): Memory corruption in \`DrawBoundingBoxesV2\` (CVSS 4.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29572](https://cve.now/CVE-2021-29572.md): Reference binding to nullptr in \`SdcaOptimizer\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29573](https://cve.now/CVE-2021-29573.md): Division by 0 in \`MaxPoolGradWithArgmax\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29574](https://cve.now/CVE-2021-29574.md): Undefined behavior in \`MaxPool3DGradGrad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29575](https://cve.now/CVE-2021-29575.md): Overflow/denial of service in \`tf.raw\_ops.ReverseSequence\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29576](https://cve.now/CVE-2021-29576.md): Heap buffer overflow in \`MaxPool3DGradGrad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29577](https://cve.now/CVE-2021-29577.md): Heap buffer overflow in \`AvgPool3DGrad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29578](https://cve.now/CVE-2021-29578.md): Heap buffer overflow in \`FractionalAvgPoolGrad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29579](https://cve.now/CVE-2021-29579.md): Heap buffer overflow in \`MaxPoolGrad\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29580](https://cve.now/CVE-2021-29580.md): Undefined behavior and \`CHECK\`-fail in \`FractionalMaxPoolGrad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29581](https://cve.now/CVE-2021-29581.md): Segfault in \`CTCBeamSearchDecoder\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29582](https://cve.now/CVE-2021-29582.md): Heap OOB read in \`tf.raw\_ops.Dequantize\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29583](https://cve.now/CVE-2021-29583.md): Heap buffer overflow and undefined behavior in \`FusedBatchNorm\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29584](https://cve.now/CVE-2021-29584.md): CHECK-fail due to integer overflow (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29525](https://cve.now/CVE-2021-29525.md): Division by 0 in \`Conv2DBackpropInput\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29526](https://cve.now/CVE-2021-29526.md): Division by 0 in \`Conv2D\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29527](https://cve.now/CVE-2021-29527.md): Division by 0 in \`QuantizedConv2D\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29528](https://cve.now/CVE-2021-29528.md): Division by 0 in \`QuantizedMul\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29529](https://cve.now/CVE-2021-29529.md): Heap buffer overflow caused by rounding (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29530](https://cve.now/CVE-2021-29530.md): Invalid validation in \`SparseMatrixSparseCholesky\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29531](https://cve.now/CVE-2021-29531.md): CHECK-fail in tf.raw\_ops.EncodePng (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29532](https://cve.now/CVE-2021-29532.md): Heap out of bounds read in \`RaggedCross\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29533](https://cve.now/CVE-2021-29533.md): CHECK-fail in DrawBoundingBoxes (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29534](https://cve.now/CVE-2021-29534.md): CHECK-fail in SparseConcat (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29535](https://cve.now/CVE-2021-29535.md): Heap buffer overflow in \`QuantizedMul\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29536](https://cve.now/CVE-2021-29536.md): Heap buffer overflow in \`QuantizedReshape\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29537](https://cve.now/CVE-2021-29537.md): Heap buffer overflow in \`QuantizedResizeBilinear\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29538](https://cve.now/CVE-2021-29538.md): Division by zero in \`Conv2DBackpropFilter\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29539](https://cve.now/CVE-2021-29539.md): Segfault in tf.raw\_ops.ImmutableConst (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29540](https://cve.now/CVE-2021-29540.md): Heap buffer overflow in \`Conv2DBackpropFilter\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29541](https://cve.now/CVE-2021-29541.md): Null pointer dereference in \`StringNGrams\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29542](https://cve.now/CVE-2021-29542.md): Heap buffer overflow in \`StringNGrams\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29543](https://cve.now/CVE-2021-29543.md): CHECK-fail in \`CTCGreedyDecoder\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29544](https://cve.now/CVE-2021-29544.md): CHECK-fail in \`QuantizeAndDequantizeV4Grad\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29545](https://cve.now/CVE-2021-29545.md): Heap buffer overflow in \`SparseTensorToCSRSparseMatrix\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29546](https://cve.now/CVE-2021-29546.md): Division by 0 in \`QuantizedBiasAdd\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29547](https://cve.now/CVE-2021-29547.md): Heap out of bounds in \`QuantizedBatchNormWithGlobalNormalization\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29548](https://cve.now/CVE-2021-29548.md): Division by 0 in \`QuantizedBatchNormWithGlobalNormalization\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29549](https://cve.now/CVE-2021-29549.md): Division by 0 in \`QuantizedAdd\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29550](https://cve.now/CVE-2021-29550.md): Division by 0 in \`FractionalAvgPool\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29551](https://cve.now/CVE-2021-29551.md): OOB read in \`MatrixTriangularSolve\` (CVSS 2.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-29552](https://cve.now/CVE-2021-29552.md): CHECK-failure in \`UnsortedSegmentJoin\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29553](https://cve.now/CVE-2021-29553.md): Heap OOB in \`QuantizeAndDequantizeV3\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29554](https://cve.now/CVE-2021-29554.md): Division by 0 in \`DenseCountSparseOutput\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29512](https://cve.now/CVE-2021-29512.md): Heap buffer overflow in \`RaggedBinCount\` (CVSS 2.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-32820](https://cve.now/CVE-2021-32820.md): File disclosure in Express Handlebars (no CVSS, express-handlebars)
- [CVE-2021-32818](https://cve.now/CVE-2021-32818.md): Remote code execution and Reflected cross site scripting in haml-coffee (CVSS 7.7, netzpirat haml-coffee · haml-coffee)
- [CVE-2021-32817](https://cve.now/CVE-2021-32817.md): File disclosure in express-hbs (CVSS 5.4, TryGhost express-hbs · express-hbs)
- [CVE-2021-32816](https://cve.now/CVE-2021-32816.md): Regular expression Denial of Service in ProtonMail (CVSS 6.5, ProtonMail WebClient)
- [CVE-2021-20565](https://cve.now/CVE-2021-20565.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 uses a protection mechanism that relies on the existence o (CVSS 4.6, IBM Cloud Pak for Security)
- [CVE-2021-20564](https://cve.now/CVE-2021-20564.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a remote attacker to obtain sensitive informat (CVSS 5.9, IBM Cloud Pak for Security)
- [CVE-2021-20429](https://cve.now/CVE-2021-20429.md): IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could disclose sensitive information due an overly permissive cross-domain policy. (CVSS 3.7, IBM QRadar SIEM)
- [CVE-2021-20393](https://cve.now/CVE-2021-20393.md): IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technic (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2021-20392](https://cve.now/CVE-2021-20392.md): IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. (CVSS 6.1, IBM QRadar SIEM)
- [CVE-2021-20391](https://cve.now/CVE-2021-20391.md): IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system (CVSS 4.0, IBM QRadar SIEM)
- [CVE-2020-4985](https://cve.now/CVE-2020-4985.md): IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. (CVSS 3.7, IBM Planning Analytics Local)
- [CVE-2020-4811](https://cve.now/CVE-2020-4811.md): IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious d (CVSS 2.4, IBM Cloud Pak for Security)
- [CVE-2020-23691](https://cve.now/CVE-2020-23691.md): YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php. (no CVSS)
- [CVE-2020-23689](https://cve.now/CVE-2020-23689.md): In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page. (no CVSS)
- [CVE-2021-25941](https://cve.now/CVE-2021-25941.md): Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may le (CVSS 9.8, deep-override)
- [CVE-2021-25943](https://cve.now/CVE-2021-25943.md): Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remo (CVSS 9.8, 101)
- [CVE-2020-18167](https://cve.now/CVE-2020-18167.md): Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Intr (no CVSS)
- [CVE-2020-18166](https://cve.now/CVE-2020-18166.md): Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension (no CVSS)
- [CVE-2021-32613](https://cve.now/CVE-2021-32613.md): In radare2 through 5.3.0 there is a double free vulnerability in the pyc parse via a crafted file which can lead to DoS. (no CVSS, radare2)
- [CVE-2020-27185](https://cve.now/CVE-2020-27185.md): Cleartext transmission of sensitive information via Moxa Service in NPort IA5000A series serial devices. (no CVSS, NPort IA5000A Series with Moxa Service enabled)
- [CVE-2020-27184](https://cve.now/CVE-2020-27184.md): The NPort IA5000A Series devices use Telnet as one of the network device management services. (no CVSS, NPort IA5000A Series with Telnet enabled)
- [CVE-2021-24286](https://cve.now/CVE-2021-24286.md): Redirect 404 to Parent \< 1.3.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, Moove Agency Redirect 404 to parent)
- [CVE-2021-24287](https://cve.now/CVE-2021-24287.md): Select All Categories and Taxonomies \< 1.3.2 - Reflected Cross-Site Scripting (XSS) (no CVSS, Moove Agency Select All Categories and Taxonomies, Change C…)
- [CVE-2021-24291](https://cve.now/CVE-2021-24291.md): Photo Gallery \< 1.5.69 - Multiple Reflected Cross-Site Scripting (XSS) (no CVSS, Photo Gallery Team Photo Gallery by 10Web – Mobile-Friendly…)
- [CVE-2021-24278](https://cve.now/CVE-2021-24278.md): Redirection for Contact Form 7 \< 2.3.4 - Unauthenticated Arbitrary Nonce Generation (no CVSS, Query Solutions Redirection for Contact Form)
- [CVE-2021-24279](https://cve.now/CVE-2021-24279.md): Redirection for Contact Form 7 \< 2.3.4 - Authenticated Arbitrary Plugin Installation (no CVSS, Query Solutions Redirection for Contact Form)
- [CVE-2021-24280](https://cve.now/CVE-2021-24280.md): Redirection for Contact Form 7 \< 2.3.4 - Authenticated PHP Object Injection (no CVSS, Query Solutions Redirection for Contact Form)
- [CVE-2021-24281](https://cve.now/CVE-2021-24281.md): Redirection for Contact Form 7 \< 2.3.4 - Authenticated Arbitrary Post Deletion (no CVSS, Query Solutions Redirection for Contact Form)
- [CVE-2021-24282](https://cve.now/CVE-2021-24282.md): Redirection for Contact Form 7 \< 2.3.4 - Unprotected AJAX Actions (no CVSS, Query Solutions Redirection for Contact Form)
- [CVE-2021-24283](https://cve.now/CVE-2021-24283.md): Accordion \< 2.2.30 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, PickPlugins Accordion)
- [CVE-2021-24284](https://cve.now/CVE-2021-24284.md): Kaswara Modern VC Addons \<= 3.0.1 - Unauthenticated Arbitrary File Upload (no CVSS, SayenThemes Kaswara Modern VC Addons)
- [CVE-2021-24285](https://cve.now/CVE-2021-24285.md): Car Seller - Auto Classifieds Script \<= 2.1.0 - Unauthenticated SQL Injection (no CVSS, Car Seller - Auto Classifieds Script)
- [CVE-2021-24189](https://cve.now/CVE-2021-24189.md): Captchinoo, Google recaptcha for admin login page \< 2.4 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy Captchinoo, Google recaptcha for admin login page)
- [CVE-2021-24190](https://cve.now/CVE-2021-24190.md): WooCommerce Conditional Marketing Mailer \< 1.5.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy WooCommerce Conditional Marketing Mailer)
- [CVE-2021-24191](https://cve.now/CVE-2021-24191.md): WP Maintenance Mode & Site Under Construction \< 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy WP Maintenance Mode & Site Under Construction)
- [CVE-2021-24192](https://cve.now/CVE-2021-24192.md): Tree Sitemap \< 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy Tree Sitemap)
- [CVE-2021-24193](https://cve.now/CVE-2021-24193.md): Visitor Traffic Real Time Statistics \< 2.12 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy Visitor Traffic Real Time Statistics)
- [CVE-2021-24194](https://cve.now/CVE-2021-24194.md): Login Protection - Limit Failed Login Attempts \< 2.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy Login Protection – Limit Failed Login Attempts)
- [CVE-2021-24195](https://cve.now/CVE-2021-24195.md): Login as User or Customer (User Switching) \< 1.9 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy Login as User or Customer)
- [CVE-2021-24277](https://cve.now/CVE-2021-24277.md): RSS for Yandex Turbo \< 1.30 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Flector RSS for Yandex Turbo)
- [CVE-2021-24188](https://cve.now/CVE-2021-24188.md): WP Content Copy Protection & No Right Click \< 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User (no CVSS, wp-buy WP Content Copy Protection & No Right Click)
- [CVE-2020-27150](https://cve.now/CVE-2020-27150.md): In multiple versions of NPort IA5000A Series, the result of exporting a device’s configuration contains the passwords of all users on the sy (no CVSS, NPort IA5000A Series)
- [CVE-2020-27149](https://cve.now/CVE-2020-27149.md): By exploiting a vulnerability in NPort IA5150A/IA5250A Series before version 1.5, a user with “Read Only” privilege level can send requests (no CVSS, NPort IA5000A Series with web console enabled)
- [CVE-2020-27020](https://cve.now/CVE-2020-27020.md): Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to (no CVSS, Kaspersky Password Manager for Windows, Kaspersky Password…)
- [CVE-2021-30183](https://cve.now/CVE-2021-30183.md): Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export (no CVSS)
- [CVE-2021-31922](https://cve.now/CVE-2021-31922.md): An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP reque (no CVSS)
- [CVE-2021-32051](https://cve.now/CVE-2021-32051.md): Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter. (no CVSS)
- [CVE-2020-27769](https://cve.now/CVE-2020-27769.md): In ImageMagick versions before 7.0.9-0, there are outside the range of representable values of type 'float' at MagickCore/quantize.c. (no CVSS, ImageMagick)
- [CVE-2021-32819](https://cve.now/CVE-2021-32819.md): Remote code execution in squirrelly (CVSS 8.0, squirrellyjs squirrelly · squirrelly)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.