# CVEs published 2021-05-18

41 CVEs were published on May 18, 2021: 0 critical, 1 high. Days are UTC.

- [CVE-2021-31315](https://cve.now/CVE-2021-31315.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Stack Based Overflow in the blit function of th (no CVSS)
- [CVE-2021-31316](https://cve.now/CVE-2021-31316.md): The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. (no CVSS)
- [CVE-2021-31317](https://cve.now/CVE-2021-31317.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Type Confusion in the VDasher constructor of th (no CVSS)
- [CVE-2021-31318](https://cve.now/CVE-2021-31318.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Type Confusion in the LOTCompLayerItem::LOTComp (no CVSS)
- [CVE-2021-31319](https://cve.now/CVE-2021-31319.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by an Integer Overflow in the LOTGradient::populate (no CVSS)
- [CVE-2021-31320](https://cve.now/CVE-2021-31320.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Heap Buffer Overflow in the VGradientCache::gen (no CVSS)
- [CVE-2021-31321](https://cve.now/CVE-2021-31321.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Stack Based Overflow in the gray\_split\_cubic fu (no CVSS)
- [CVE-2021-31322](https://cve.now/CVE-2021-31322.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Heap Buffer Overflow in the LOTGradient::popula (no CVSS)
- [CVE-2021-31323](https://cve.now/CVE-2021-31323.md): Telegram Android \<7.1.0 (2090), Telegram iOS \<7.1, and Telegram macOS \<7.1 are affected by a Heap Buffer Overflow in the LottieParserImpl::p (no CVSS)
- [CVE-2021-31324](https://cve.now/CVE-2021-31324.md): The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution (no CVSS)
- [CVE-2020-19924](https://cve.now/CVE-2020-19924.md): In Boostnote 0.12.1, exporting to PDF contains opportunities for XSS attacks. (no CVSS)
- [CVE-2020-20245](https://cve.now/CVE-2020-20245.md): Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the log process. (no CVSS)
- [CVE-2020-20246](https://cve.now/CVE-2020-20246.md): Mikrotik RouterOs stable 6.46.3 suffers from a memory corruption vulnerability in the mactel process. (no CVSS)
- [CVE-2020-20227](https://cve.now/CVE-2020-20227.md): Mikrotik RouterOs stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/diskd process. (no CVSS)
- [CVE-2020-20220](https://cve.now/CVE-2020-20220.md): Mikrotik RouterOs prior to stable 6.47 suffers from a memory corruption vulnerability in the /nova/bin/bfd process. (no CVSS)
- [CVE-2020-20237](https://cve.now/CVE-2020-20237.md): Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. (no CVSS)
- [CVE-2020-20236](https://cve.now/CVE-2020-20236.md): Mikrotik RouterOs 6.46.3 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. (no CVSS)
- [CVE-2020-20222](https://cve.now/CVE-2020-20222.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/sniffer process. (no CVSS)
- [CVE-2020-20214](https://cve.now/CVE-2020-20214.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from an assertion failure vulnerability in the btest process. (no CVSS)
- [CVE-2020-18178](https://cve.now/CVE-2020-18178.md): Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the compone (no CVSS)
- [CVE-2021-3200](https://cve.now/CVE-2021-3200.md): Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver \* testcase\_read(Pool \*pool, FILE \*fp, const char \*testcase, Queue \*job, c (no CVSS)
- [CVE-2021-32305](https://cve.now/CVE-2021-32305.md): WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. (no CVSS)
- [CVE-2020-20951](https://cve.now/CVE-2020-20951.md): In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. (no CVSS)
- [CVE-2020-24740](https://cve.now/CVE-2020-24740.md): An issue was discovered in Pluck 4.7.10-dev2. (no CVSS)
- [CVE-2020-23861](https://cve.now/CVE-2020-23861.md): A heap-based buffer overflow vulnerability exists in LibreDWG 0.10.1 via the read\_system\_page function at libredwg-0.10.1/src/decode\_r2007.c (no CVSS)
- [CVE-2021-32238](https://cve.now/CVE-2021-32238.md): Epic Games / Psyonix Rocket League \<=1.95 is affected by Buffer Overflow. (no CVSS)
- [CVE-2020-23856](https://cve.now/CVE-2020-23856.md): Use-after-Free vulnerability in cflow 1.6 in the void call(char \*name, int line) function at src/parser.c, which could cause a denial of ser (no CVSS)
- [CVE-2020-24026](https://cve.now/CVE-2020-24026.md): TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. (no CVSS)
- [CVE-2020-23852](https://cve.now/CVE-2020-23852.md): A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif\_decode(void \*ctxt, BMP \*pb) function at ffjpeg/sr (no CVSS)
- [CVE-2020-23851](https://cve.now/CVE-2020-23851.md): A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif\_decode(void \*ctxt, BMP \*pb) function at ffjpeg/s (no CVSS)
- [CVE-2020-20254](https://cve.now/CVE-2020-20254.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/lcdstat process. (no CVSS)
- [CVE-2020-20253](https://cve.now/CVE-2020-20253.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from a divison by zero vulnerability in the /nova/bin/lcdstat process. (no CVSS)
- [CVE-2021-30145](https://cve.now/CVE-2021-30145.md): A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playli (no CVSS)
- [CVE-2021-22117](https://cve.now/CVE-2021-22117.md): RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with suffi (no CVSS, RabbitMQ)
- [CVE-2020-25709](https://cve.now/CVE-2020-25709.md): A flaw was found in OpenLDAP. (no CVSS, OpenLDAP)
- [CVE-2002-2438](https://cve.now/CVE-2002-2438.md): TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. (no CVSS, kernel)
- [CVE-2021-3518](https://cve.now/CVE-2021-3518.md): There's a flaw in libxml2 in versions before 2.9.11. (no CVSS, libxml2 · nokogiri)
- [CVE-2020-15279](https://cve.now/CVE-2020-15279.md): Scanning exclusion paths disclosure in BEST for Windows (CVSS 4.0, BItdefenderd Endpoint Security Tools for Windows)
- [CVE-2021-3423](https://cve.now/CVE-2021-3423.md): Privilege escalation in Bitdefender GravityZone Business Security (CVSS 7.8, BItdefender GravityZone Business Security)
- [CVE-2021-31827](https://cve.now/CVE-2021-31827.md): In Progress MOVEit Transfer before 2021.0 (13.0), a SQL injection vulnerability has been found in the MOVEit Transfer web app that could all (no CVSS)
- [CVE-2021-3531](https://cve.now/CVE-2021-3531.md): A flaw was found in the Red Hat Ceph Storage RGW in versions before 14.2.21. (no CVSS, ceph)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.