# CVEs published 2021-05-19 29 CVEs were published on May 19, 2021: 0 critical, 3 high. Days are UTC. - [CVE-2021-29625](https://cve.now/CVE-2021-29625.md): XSS in doc\_link (CVSS 7.5, vrana adminer · vrana/adminer) - [CVE-2021-29624](https://cve.now/CVE-2021-29624.md): Lack of protection against cookie tossing attacks in fastify-csrf (CVSS 6.5, fastify-csrf) - [CVE-2021-29622](https://cve.now/CVE-2021-29622.md): Arbitrary redirects under /new endpoint (CVSS 6.5, prometheus) - [CVE-2021-29503](https://cve.now/CVE-2021-29503.md): Improper Neutralization of Script-Related HTML Tags in Notes (CVSS 8.1, hedgedoc) - [CVE-2021-20529](https://cve.now/CVE-2021-20529.md): IBM Control Center 6.2.0.0 could allow a user to obtain sensitive version information that could be used in further attacks against the syst (CVSS 5.3, IBM Control Center) - [CVE-2021-20528](https://cve.now/CVE-2021-20528.md): IBM Control Center 6.2.0.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Control Center) - [CVE-2021-20374](https://cve.now/CVE-2021-20374.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. (CVSS 6.5, IBM Maximo Asset Management) - [CVE-2020-4765](https://cve.now/CVE-2020-4765.md): IBM Cloud Pak for Multicloud Management prior to 2.3 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Cloud Pak for Multicloud Management) - [CVE-2020-4646](https://cve.now/CVE-2020-4646.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5, 6.0.0.0 through 6.0.3.3, and 6.1.0.0 through 6.1.0.2 could allow an au (CVSS 4.3, IBM Sterling B2B Integrator) - [CVE-2021-27924](https://cve.now/CVE-2021-27924.md): An issue was discovered in Couchbase Server 6.x through 6.6.1. (no CVSS) - [CVE-2020-36365](https://cve.now/CVE-2020-36365.md): Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskCont (no CVSS) - [CVE-2021-27925](https://cve.now/CVE-2021-27925.md): An issue was discovered in Couchbase Server 6.5.x and 6.6.x through 6.6.1. (no CVSS) - [CVE-2020-36364](https://cve.now/CVE-2020-36364.md): An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. (no CVSS) - [CVE-2021-25644](https://cve.now/CVE-2021-25644.md): An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. (no CVSS) - [CVE-2021-31158](https://cve.now/CVE-2021-31158.md): In the Query Engine in Couchbase Server 6.5.x and 6.6.x through 6.6.1, Common Table Expression queries were not correctly checking the user' (no CVSS) - [CVE-2021-33204](https://cve.now/CVE-2021-33204.md): In the pg\_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DE (no CVSS) - [CVE-2021-31930](https://cve.now/CVE-2021-31930.md): Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce (no CVSS) - [CVE-2021-3517](https://cve.now/CVE-2021-3517.md): There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. (CVSS 8.6, libxml2 · nokogiri) - [CVE-2021-3445](https://cve.now/CVE-2021-3445.md): A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. (no CVSS, libdnf) - [CVE-2021-3421](https://cve.now/CVE-2021-3421.md): A flaw was found in the RPM package in the read functionality. (no CVSS, rpm) - [CVE-2017-17677](https://cve.now/CVE-2017-17677.md): BMC Remedy 9.1SP3 is affected by authenticated code execution. (no CVSS) - [CVE-2017-17675](https://cve.now/CVE-2017-17675.md): BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. (no CVSS) - [CVE-2017-17678](https://cve.now/CVE-2017-17678.md): BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). (no CVSS) - [CVE-2017-17674](https://cve.now/CVE-2017-17674.md): BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. (no CVSS) - [CVE-2020-20266](https://cve.now/CVE-2020-20266.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/dot1x process. (no CVSS) - [CVE-2020-20264](https://cve.now/CVE-2020-20264.md): Mikrotik RouterOs before 6.47 (stable tree) in the /ram/pckg/advanced-tools/nova/bin/netwatch process. (no CVSS) - [CVE-2021-21733](https://cve.now/CVE-2021-21733.md): The management system of ZXCDN is impacted by the information leak vulnerability. (no CVSS, \) - [CVE-2021-21732](https://cve.now/CVE-2021-21732.md): A mobile phone of ZTE is impacted by improper access control vulnerability. (no CVSS, \) - [CVE-2021-20589](https://cve.now/CVE-2021-20589.md): Buffer access with incorrect length value vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.38.0 (no CVSS, GOT2000 series; GOT SIMPLE series; GT SoftGOT2000; Tension…) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-05-19 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.