# CVEs published 2021-05-21

43 CVEs were published on May 21, 2021: 1 critical, 9 high. Days are UTC.

- [CVE-2021-33514](https://cve.now/CVE-2021-33514.md): Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library (CVSS 8.8)
- [CVE-2021-33507](https://cve.now/CVE-2021-33507.md): Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow (no CVSS, products-cmfcore · plone +1)
- [CVE-2021-33508](https://cve.now/CVE-2021-33508.md): Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item. (no CVSS, plone)
- [CVE-2021-33509](https://cve.now/CVE-2021-33509.md): Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform (no CVSS, plone)
- [CVE-2021-33510](https://cve.now/CVE-2021-33510.md): Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file. (no CVSS, plone)
- [CVE-2021-33511](https://cve.now/CVE-2021-33511.md): Plone though 5.2.4 allows SSRF via the lxml parser. (no CVSS, plone)
- [CVE-2021-33512](https://cve.now/CVE-2021-33512.md): Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document. (no CVSS, plone)
- [CVE-2021-33513](https://cve.now/CVE-2021-33513.md): Plone through 5.2.4 allows XSS via the inline\_diff methods in Products.CMFDiffTool. (no CVSS, plone)
- [CVE-2021-21552](https://cve.now/CVE-2021-21552.md): Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability. (CVSS 5.2, Dell Wyse Windows Embedded)
- [CVE-2021-21549](https://cve.now/CVE-2021-21549.md): Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. (CVSS 8.8, Dell XtremIO)
- [CVE-2021-33500](https://cve.now/CVE-2021-33500.md): PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its (CVSS 7.5)
- [CVE-2008-3280](https://cve.now/CVE-2008-3280.md): It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Rand (no CVSS, openid)
- [CVE-2021-29681](https://cve.now/CVE-2021-29681.md): IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information by injecting parameters into an HTML query. (CVSS 3.1, IBM InfoSphere Information Server)
- [CVE-2021-32634](https://cve.now/CVE-2021-32634.md): Deserialization of Untrusted Data in Emissary (CVSS 7.2, NationalSecurityAgency emissary)
- [CVE-2020-23768](https://cve.now/CVE-2020-23768.md): An information disclosure vulnerability was discovered in alipay\_function.php in the log file of Alibaba payment interface on PHPPYUN prior (no CVSS)
- [CVE-2021-27811](https://cve.now/CVE-2021-27811.md): A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0. (no CVSS)
- [CVE-2020-23766](https://cve.now/CVE-2020-23766.md): An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any (no CVSS)
- [CVE-2020-23765](https://cve.now/CVE-2020-23765.md): A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. (no CVSS)
- [CVE-2018-25014](https://cve.now/CVE-2018-25014.md): A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). (no CVSS, libwebp)
- [CVE-2018-25013](https://cve.now/CVE-2018-25013.md): A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). (no CVSS, libwebp)
- [CVE-2018-25012](https://cve.now/CVE-2018-25012.md): A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). (no CVSS, libwebp)
- [CVE-2018-25011](https://cve.now/CVE-2018-25011.md): A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). (no CVSS, libwebp)
- [CVE-2018-25010](https://cve.now/CVE-2018-25010.md): A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter(). (no CVSS, libwebp)
- [CVE-2018-25009](https://cve.now/CVE-2018-25009.md): A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). (no CVSS, libwebp)
- [CVE-2020-36332](https://cve.now/CVE-2020-36332.md): A flaw was found in libwebp in versions before 1.0.1. (no CVSS, libwebp)
- [CVE-2020-36331](https://cve.now/CVE-2020-36331.md): A flaw was found in libwebp in versions before 1.0.1. (no CVSS, libwebp)
- [CVE-2020-36330](https://cve.now/CVE-2020-36330.md): A flaw was found in libwebp in versions before 1.0.1. (no CVSS, libwebp)
- [CVE-2020-36329](https://cve.now/CVE-2020-36329.md): A flaw was found in libwebp in versions before 1.0.1. (no CVSS, libwebp)
- [CVE-2020-36328](https://cve.now/CVE-2020-36328.md): A flaw was found in libwebp in versions before 1.0.1. (no CVSS, libwebp)
- [CVE-2021-31474](https://cve.now/CVE-2021-31474.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 202 (CVSS 9.8, SolarWinds Network Performance Monitor)
- [CVE-2021-31475](https://cve.now/CVE-2021-31475.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF (CVSS 8.8, SolarWinds Orion Job Scheduler)
- [CVE-2021-31473](https://cve.now/CVE-2021-31473.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598. (CVSS 7.8, Foxit Reader)
- [CVE-2021-31440](https://cve.now/CVE-2021-31440.md): This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. (CVSS 8.8, Linux Kernel)
- [CVE-2021-32633](https://cve.now/CVE-2021-32633.md): Remote Code Execution via traversal in TAL expressions (CVSS 6.8, zopefoundation Zope · zope)
- [CVE-2020-27211](https://cve.now/CVE-2020-27211.md): Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. (no CVSS)
- [CVE-2020-27212](https://cve.now/CVE-2020-27212.md): STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. (no CVSS)
- [CVE-2021-29414](https://cve.now/CVE-2021-29414.md): STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control. (no CVSS)
- [CVE-2021-29415](https://cve.now/CVE-2021-29415.md): The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor (no CVSS)
- [CVE-2020-27208](https://cve.now/CVE-2020-27208.md): The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the N (no CVSS)
- [CVE-2020-12061](https://cve.now/CVE-2020-12061.md): An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. (no CVSS)
- [CVE-2021-32032](https://cve.now/CVE-2021-32032.md): In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) c (no CVSS)
- [CVE-2021-28798](https://cve.now/CVE-2021-28798.md): Relative Path Traversal Vulnerability in QTS and QuTS hero (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2021-31439](https://cve.now/CVE-2021-31439.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. (CVSS 8.8, Synology DiskStation Manager)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.