# CVEs published 2021-05-20

59 CVEs were published on May 20, 2021: 1 critical, 2 high. Days are UTC.

- [CVE-2020-27209](https://cve.now/CVE-2020-27209.md): The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the pri (no CVSS)
- [CVE-2020-18220](https://cve.now/CVE-2020-18220.md): Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt o (no CVSS)
- [CVE-2021-22339](https://cve.now/CVE-2021-22339.md): There is a denial of service vulnerability in some versions of ManageOne. (no CVSS, ManageOne)
- [CVE-2021-33477](https://cve.now/CVE-2021-33477.md): rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certa (no CVSS)
- [CVE-2021-22409](https://cve.now/CVE-2021-22409.md): There is a denial of service vulnerability in some versions of ManageOne. (no CVSS, ManageOne)
- [CVE-2021-28906](https://cve.now/CVE-2021-28906.md): In function read\_yin\_leaf() in libyang \<= v1.0.225, it doesn't check whether the value of retval-\>ext\[r\] is NULL. (no CVSS)
- [CVE-2021-28905](https://cve.now/CVE-2021-28905.md): In function lys\_node\_free() in libyang \<= v1.0.225, it asserts that the value of node-\>module can't be NULL. (no CVSS)
- [CVE-2021-28904](https://cve.now/CVE-2021-28904.md): In function ext\_get\_plugin() in libyang \<= v1.0.225, it doesn't check whether the value of revision is NULL. (no CVSS)
- [CVE-2021-28903](https://cve.now/CVE-2021-28903.md): A stack overflow in libyang \<= v1.0.225 can cause a denial of service through function lyxml\_parse\_mem(). (no CVSS)
- [CVE-2021-28902](https://cve.now/CVE-2021-28902.md): In function read\_yin\_container() in libyang \<= v1.0.225, it doesn't check whether the value of retval-\>ext\[r\] is NULL. (no CVSS)
- [CVE-2021-27956](https://cve.now/CVE-2021-27956.md): Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e (no CVSS)
- [CVE-2020-21345](https://cve.now/CVE-2020-21345.md): Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user e (no CVSS)
- [CVE-2021-32630](https://cve.now/CVE-2021-32630.md): Various (CVSS 9.6, admidio)
- [CVE-2021-29258](https://cve.now/CVE-2021-29258.md): An issue was discovered in Envoy 1.14.0. (no CVSS)
- [CVE-2021-28683](https://cve.now/CVE-2021-28683.md): An issue was discovered in Envoy through 1.71.1. (no CVSS)
- [CVE-2021-28682](https://cve.now/CVE-2021-28682.md): An issue was discovered in Envoy through 1.71.1. (no CVSS)
- [CVE-2021-23386](https://cve.now/CVE-2021-23386.md): Remote Memory Exposure (CVSS 7.7, dns-packet)
- [CVE-2021-32632](https://cve.now/CVE-2021-32632.md): CSRF allowing modification of commands, modules, banphrases through hidden iFrames (CVSS 2.4, pajbot)
- [CVE-2020-21057](https://cve.now/CVE-2020-21057.md): Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder va (no CVSS)
- [CVE-2020-21056](https://cve.now/CVE-2020-21056.md): Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale t (no CVSS)
- [CVE-2020-21055](https://cve.now/CVE-2020-21055.md): A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2 (no CVSS)
- [CVE-2021-3313](https://cve.now/CVE-2021-3313.md): Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functi (no CVSS, plone)
- [CVE-2020-21054](https://cve.now/CVE-2020-21054.md): Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsa (no CVSS)
- [CVE-2020-35580](https://cve.now/CVE-2020-35580.md): A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrar (no CVSS)
- [CVE-2021-27432](https://cve.now/CVE-2021-27432.md): OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may a (no CVSS, OPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy)
- [CVE-2021-29692](https://cve.now/CVE-2021-29692.md): IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable (CVSS 3.1, IBM Security Identity Manager)
- [CVE-2021-29691](https://cve.now/CVE-2021-29691.md): IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo (CVSS 5.9, IBM Security Identity Manager)
- [CVE-2021-29688](https://cve.now/CVE-2021-29688.md): IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2021-29687](https://cve.now/CVE-2021-29687.md): IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid (CVSS 3.7, IBM Security Identity Manager)
- [CVE-2021-29686](https://cve.now/CVE-2021-29686.md): IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have acces (CVSS 5.4, IBM Security Identity Manager)
- [CVE-2021-29683](https://cve.now/CVE-2021-29683.md): IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2021-29682](https://cve.now/CVE-2021-29682.md): IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2020-4850](https://cve.now/CVE-2020-4850.md): IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused b (CVSS 4.0, IBM Spectrum Scale)
- [CVE-2021-25933](https://cve.now/CVE-2021-25933.md): In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through (CVSS 4.8, OpenNMS · org.opennms:opennms)
- [CVE-2021-25931](https://cve.now/CVE-2021-25931.md): In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through (CVSS 8.8, OpenNMS · org.opennms:opennms)
- [CVE-2020-21053](https://cve.now/CVE-2020-21053.md): Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2021-25929](https://cve.now/CVE-2021-25929.md): In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through (CVSS 4.8, OpenNMS · org.opennms:opennms)
- [CVE-2021-25930](https://cve.now/CVE-2021-25930.md): In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through (CVSS 4.3, OpenNMS · org.opennms:opennms +1)
- [CVE-2021-27434](https://cve.now/CVE-2021-27434.md): Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework ver (no CVSS, OPC UA Products Built with the .NET Framework 4.5, 4.0, and)
- [CVE-2021-3438](https://cve.now/CVE-2021-3438.md): A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalatio (no CVSS, Certain HP LaserJet products and Samsung product printers,…)
- [CVE-2021-28112](https://cve.now/CVE-2021-28112.md): Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker (no CVSS)
- [CVE-2021-28111](https://cve.now/CVE-2021-28111.md): Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker. (no CVSS)
- [CVE-2020-24395](https://cve.now/CVE-2020-24395.md): The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install comprom (no CVSS)
- [CVE-2020-24396](https://cve.now/CVE-2020-24396.md): homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images. (no CVSS)
- [CVE-2021-29659](https://cve.now/CVE-2021-29659.md): ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. (no CVSS)
- [CVE-2021-3536](https://cve.now/CVE-2021-3536.md): A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible t (no CVSS, wildfly · org.wildfly:wildfly-parent)
- [CVE-2021-3480](https://cve.now/CVE-2021-3480.md): A flaw was found in slapi-nis in versions before 0.56.7. (no CVSS, slapi-nis)
- [CVE-2021-27461](https://cve.now/CVE-2021-27461.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2021-27459](https://cve.now/CVE-2021-27459.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2021-27457](https://cve.now/CVE-2021-27457.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2020-15522](https://cve.now/CVE-2020-15522.md): Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue wi (no CVSS, org.bouncycastle:bc-fips · org.bouncycastle:bcprov-ext-j… +7)
- [CVE-2021-27467](https://cve.now/CVE-2021-27467.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2021-27465](https://cve.now/CVE-2021-27465.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2021-27463](https://cve.now/CVE-2021-27463.md): A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. (no CVSS, Emerson Rosemount X-STREAM Gas Analyzer)
- [CVE-2021-20721](https://cve.now/CVE-2021-20721.md): KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors. (no CVSS, kujirahand KonaWiki2)
- [CVE-2021-20720](https://cve.now/CVE-2021-20720.md): SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtain (no CVSS, kujirahand KonaWiki2)
- [CVE-2021-20718](https://cve.now/CVE-2021-20718.md): mod\_auth\_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. (no CVSS, ZmartZone mod\_auth\_openidc)
- [CVE-2021-20719](https://cve.now/CVE-2021-20719.md): RFNTPS firmware versions System\_01000004 and earlier, and Web\_01000004 and earlier allow an attacker on the same network segment to execute (no CVSS, NIPPON ANTENNA Co. RFNTPS)
- [CVE-2021-3426](https://cve.now/CVE-2021-3426.md): There's a flaw in Python 3's pydoc. (CVSS 5.7, python · libpython +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.