# CVEs published 2021-05-17

76 CVEs were published on May 17, 2021: 1 critical, 2 high. Days are UTC.

- [CVE-2020-21831](https://cve.now/CVE-2020-21831.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read\_2004\_section\_handles ../../src/decode.c:2637. (no CVSS)
- [CVE-2020-21844](https://cve.now/CVE-2020-21844.md): GNU LibreDWG 0.10 is affected by: memcpy-param-overlap. (no CVSS)
- [CVE-2020-24755](https://cve.now/CVE-2020-24755.md): In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. (no CVSS)
- [CVE-2020-21843](https://cve.now/CVE-2020-21843.md): A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit\_read\_RC ../../src/bits.c:318. (no CVSS)
- [CVE-2020-18198](https://cve.now/CVE-2020-18198.md): Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the c (no CVSS)
- [CVE-2020-18195](https://cve.now/CVE-2020-18195.md): Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via th (no CVSS)
- [CVE-2020-18194](https://cve.now/CVE-2020-18194.md): Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new b (no CVSS)
- [CVE-2020-21842](https://cve.now/CVE-2020-21842.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read\_2004\_section\_revhistory ../../src/decode.c:3051. (no CVSS)
- [CVE-2020-21841](https://cve.now/CVE-2020-21841.md): A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit\_read\_B ../../src/bits.c:135. (no CVSS)
- [CVE-2020-21840](https://cve.now/CVE-2020-21840.md): A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit\_search\_sentinel ../../src/bits.c:1985. (no CVSS)
- [CVE-2020-21839](https://cve.now/CVE-2020-21839.md): An issue was discovered in GNU LibreDWG 0.10. (no CVSS)
- [CVE-2020-21838](https://cve.now/CVE-2020-21838.md): A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read\_2004\_section\_appinfo ../../src/decode.c:2842. (no CVSS)
- [CVE-2020-21836](https://cve.now/CVE-2020-21836.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read\_2004\_section\_preview ../../src/decode.c:3175. (no CVSS)
- [CVE-2020-21835](https://cve.now/CVE-2020-21835.md): A null pointer deference issue exists in GNU LibreDWG 0.10 via read\_2004\_compressed\_section ../../src/decode.c:2337. (no CVSS)
- [CVE-2020-21834](https://cve.now/CVE-2020-21834.md): A null pointer deference issue exists in GNU LibreDWG 0.10 via get\_bmp ../../programs/dwgbmp.c:164. (no CVSS)
- [CVE-2020-21833](https://cve.now/CVE-2020-21833.md): A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read\_2004\_section\_classes ../../src/decode.c:2440. (no CVSS)
- [CVE-2020-21832](https://cve.now/CVE-2020-21832.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read\_2004\_compressed\_section ../../src/decode.c:2417. (no CVSS)
- [CVE-2020-21830](https://cve.now/CVE-2020-21830.md): A heap based buffer overflow vulneraibility exists in GNU LibreDWG 0.10 via bit\_calc\_CRC ../../src/bits.c:2213. (no CVSS)
- [CVE-2020-21827](https://cve.now/CVE-2020-21827.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read\_2004\_compressed\_section ../../src/decode.c:2379. (no CVSS)
- [CVE-2021-32622](https://cve.now/CVE-2021-32622.md): File upload local preview can run embedded scripts after user interaction (CVSS 4.2, matrix-org matrix-react-sdk · matrix-react-sdk)
- [CVE-2020-29205](https://cve.now/CVE-2020-29205.md): XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field (no CVSS)
- [CVE-2020-21819](https://cve.now/CVE-2020-21819.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641via htmlescape ../../programs/escape.c:51. (no CVSS)
- [CVE-2020-21818](https://cve.now/CVE-2020-21818.md): A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48. (no CVSS)
- [CVE-2020-21817](https://cve.now/CVE-2020-21817.md): A null pointer dereference issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:29. (no CVSS)
- [CVE-2020-21815](https://cve.now/CVE-2020-21815.md): A null pointer deference issue exists in GNU LibreDWG 0.10.2641 via output\_TEXT ../../programs/dwg2SVG.c:114, which causes a denial of servi (no CVSS)
- [CVE-2020-24993](https://cve.now/CVE-2020-24993.md): There is a cross site scripting vulnerability on CmsWing 1.3.7. (no CVSS)
- [CVE-2020-24992](https://cve.now/CVE-2020-24992.md): There is a cross site scripting vulnerability on CmsWing 1.3.7. (no CVSS)
- [CVE-2020-21816](https://cve.now/CVE-2020-21816.md): A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46. (no CVSS)
- [CVE-2020-21814](https://cve.now/CVE-2020-21814.md): A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97. (no CVSS)
- [CVE-2021-32618](https://cve.now/CVE-2021-32618.md): Open Redirect Vulnerability (CVSS 3.1, Flask-Middleware flask-security · flask-security-too)
- [CVE-2020-21813](https://cve.now/CVE-2020-21813.md): A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via output\_TEXT ../../programs/dwg2SVG.c:114. (no CVSS)
- [CVE-2021-32456](https://cve.now/CVE-2021-32456.md): SITEL CAP/PRX cleartext transmission of sensitive information (CVSS 6.5, SITEL CAP/PRX)
- [CVE-2021-23384](https://cve.now/CVE-2021-23384.md): Open Redirect (CVSS 5.4, koa-remove-trailing-slashes)
- [CVE-2021-32454](https://cve.now/CVE-2021-32454.md): SITEL CAP/PRX hardcoded credentials (CVSS 9.6, SITEL CAP/PRX)
- [CVE-2021-29747](https://cve.now/CVE-2021-29747.md): IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain highly sensitive information due to a vulnerability in the au (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2020-4670](https://cve.now/CVE-2020-4670.md): IBM Planning Analytics Local 2.0 connects to a Redis server. (CVSS 7.4, IBM Planning Analytics Local)
- [CVE-2020-4669](https://cve.now/CVE-2020-4669.md): IBM Planning Analytics Local 2.0 connects to a MongoDB server. (CVSS 7.4, IBM Planning Analytics Local)
- [CVE-2021-25264](https://cve.now/CVE-2021-25264.md): In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges. (no CVSS, Sophos Intercept X for MacOS · Sophos Home for MacOS)
- [CVE-2020-13667](https://cve.now/CVE-2020-13667.md): Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2021-24325](https://cve.now/CVE-2021-24325.md): 404 SEO Redirection \<= 1.3 - Reflected Cross-Site Scripting (XSS) (no CVSS, 404 SEO Redirection)
- [CVE-2021-24326](https://cve.now/CVE-2021-24326.md): All 404 Redirect to Homepage \< 1.21 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, All 404 Redirect to Homepage)
- [CVE-2021-24327](https://cve.now/CVE-2021-24327.md): SEO Redirection \< 6.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, SEO Redirection Plugin – 301 Redirect Manager)
- [CVE-2021-24290](https://cve.now/CVE-2021-24290.md): Store Locator Plus \<= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS) (no CVSS, Store Locator Plus® Store Locator Plus for WordPress)
- [CVE-2021-24292](https://cve.now/CVE-2021-24292.md): Happy Addons for Elementor Free \< 2.24.0 and Pro \< 1.17.0 - Contributor+ Stored XSS (no CVSS, weDevs Happy Addons for Elementor · weDevs Happy Addons Pro…)
- [CVE-2021-24295](https://cve.now/CVE-2021-24295.md): Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk \< 5.153.4 (no CVSS, СleanTalk Spam protection, AntiSpam, FireWall by CleanTalk)
- [CVE-2021-24299](https://cve.now/CVE-2021-24299.md): ReDi Restaurant Reservations \< 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS) (no CVSS, Reservation Diary ReDi Restaurant Reservation)
- [CVE-2021-24314](https://cve.now/CVE-2021-24314.md): Goto \< 2.1 - Unauthenticated Blind SQL Injection (no CVSS, BoostifyThemes Goto)
- [CVE-2021-24315](https://cve.now/CVE-2021-24315.md): Give WP \< 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2021-24323](https://cve.now/CVE-2021-24323.md): Woocommerce \< 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Automattic WooCommerce · woocommerce/woocommerce)
- [CVE-2021-24324](https://cve.now/CVE-2021-24324.md): 404 SEO Redirection \<= 1.3 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, 404 SEO Redirection)
- [CVE-2021-24288](https://cve.now/CVE-2021-24288.md): AcyMailing \< 7.5.0 - Unauthenticated Open Redirect (no CVSS, Newsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMai…)
- [CVE-2021-24289](https://cve.now/CVE-2021-24289.md): Store Locator Plus \<= 5.5.14 - Authenticated Privilege Escalation (no CVSS, Store Locator Plus for WordPress)
- [CVE-2021-32453](https://cve.now/CVE-2021-32453.md): SITEL CAP/PRX information exposure (CVSS 6.5, SITEL CAP/PRX)
- [CVE-2021-32455](https://cve.now/CVE-2021-32455.md): SITEL CAP/PRX vulnerable to a denial of service attack (CVSS 6.8, SITEL CAP/PRX)
- [CVE-2021-33041](https://cve.now/CVE-2021-33041.md): vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child\_process').ex (no CVSS, vmd)
- [CVE-2019-14827](https://cve.now/CVE-2019-14827.md): A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts (no CVSS, Moodle)
- [CVE-2021-27734](https://cve.now/CVE-2021-27734.md): Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the crede (no CVSS)
- [CVE-2021-32403](https://cve.now/CVE-2021-32403.md): Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token prot (no CVSS)
- [CVE-2021-32402](https://cve.now/CVE-2021-32402.md): Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurat (no CVSS)
- [CVE-2021-27342](https://cve.now/CVE-2021-27342.md): An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote a (no CVSS)
- [CVE-2021-31728](https://cve.now/CVE-2021-31728.md): Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \\. (no CVSS)
- [CVE-2021-31727](https://cve.now/CVE-2021-31727.md): Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestrict (no CVSS)
- [CVE-2007-5967](https://cve.now/CVE-2007-5967.md): A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval. (no CVSS, Mozilla Firefox)
- [CVE-2021-3483](https://cve.now/CVE-2021-3483.md): A flaw was found in the Nosy driver in the Linux kernel. (no CVSS, Linux kernel)
- [CVE-2021-29052](https://cve.now/CVE-2021-29052.md): The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefini (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29048](https://cve.now/CVE-2021-29048.md): Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29051](https://cve.now/CVE-2021-29051.md): Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7. (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29044](https://cve.now/CVE-2021-29044.md): Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29043](https://cve.now/CVE-2021-29043.md): The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fi (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29053](https://cve.now/CVE-2021-29053.md): Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to exe (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29046](https://cve.now/CVE-2021-29046.md): Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 bef (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29045](https://cve.now/CVE-2021-29045.md): Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-29023](https://cve.now/CVE-2021-29023.md): InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predic (no CVSS)
- [CVE-2021-29024](https://cve.now/CVE-2021-29024.md): In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download. (no CVSS)
- [CVE-2021-32617](https://cve.now/CVE-2021-32617.md): Denial of service in Exiv2 (CVSS 4.7, exiv2)
- [CVE-2021-3524](https://cve.now/CVE-2021-3524.md): A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21. (no CVSS, ceph)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.