# CVEs published 2021-05-24

90 CVEs were published on May 24, 2021: 2 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-33563](https://cve.now/CVE-2021-33563.md): Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. (no CVSS, phanan/koel)
- [CVE-2021-33561](https://cve.now/CVE-2021-33561.md): A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML v (no CVSS, com.shopizer:shopizer)
- [CVE-2021-33562](https://cve.now/CVE-2021-33562.md): A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTM (no CVSS, com.shopizer:shopizer)
- [CVE-2021-3320](https://cve.now/CVE-2021-3320.md): Type Confusion in 802154 ACK Frames Handling (CVSS 5.9, zephyrproject-rtos zephyr)
- [CVE-2020-13603](https://cve.now/CVE-2020-13603.md): Integer Overflow in memory allocating functions (CVSS 6.9, zephyrproject-rtos zephyr)
- [CVE-2020-13602](https://cve.now/CVE-2020-13602.md): Remote Denial of Service in LwM2M do\_write\_op\_tlv (CVSS 4.0, zephyrproject-rtos zephyr)
- [CVE-2020-13601](https://cve.now/CVE-2020-13601.md): Possible read out of bounds in dns read (CVSS 9.0, zephyrproject-rtos zephyr)
- [CVE-2020-13600](https://cve.now/CVE-2020-13600.md): Malformed SPI in response for eswifi can corrupt kernel memory (CVSS 7.0, zephyrproject-rtos zephyr)
- [CVE-2020-13599](https://cve.now/CVE-2020-13599.md): Security problem with settings and littlefs (CVSS 3.3, zephyrproject-rtos zephyr)
- [CVE-2020-13598](https://cve.now/CVE-2020-13598.md): FS: Buffer Overflow when enabling Long File Names in FAT\_FS and calling fs\_stat (CVSS 6.3, zephyrproject-rtos zephyr)
- [CVE-2020-10072](https://cve.now/CVE-2020-10072.md): Improper Handling of Insufficient Permissions or Privileges in zephyr (CVSS 5.9, zephyrproject-rtos zephyr)
- [CVE-2020-10069](https://cve.now/CVE-2020-10069.md): Zephyr Bluetooth unchecked packet data results in denial of service (CVSS 4.3, zephyrproject-rtos zephyr)
- [CVE-2020-10066](https://cve.now/CVE-2020-10066.md): Incorrect Error Handling in Bluetooth HCI core (CVSS 2.5, zephyrproject-rtos zephyr)
- [CVE-2020-10065](https://cve.now/CVE-2020-10065.md): Missing Size Checks in Bluetooth HCI over SPI (CVSS 3.8, zephyrproject-rtos zephyr)
- [CVE-2020-10064](https://cve.now/CVE-2020-10064.md): Improper Input Frame Validation in ieee802154 Processing (CVSS 8.3, zephyrproject-rtos zephyr)
- [CVE-2021-33525](https://cve.now/CVE-2021-33525.md): EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios\_path par (no CVSS)
- [CVE-2021-30108](https://cve.now/CVE-2021-30108.md): Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. (no CVSS, feehi/cms)
- [CVE-2020-20178](https://cve.now/CVE-2020-20178.md): Ethereum 0xe933c0cd9784414d5f278c114904f5a84b396919#code.sol latest version is affected by a denial of service vulnerability in the affected (no CVSS)
- [CVE-2021-23387](https://cve.now/CVE-2021-23387.md): Open Redirect (CVSS 5.4, trailing-slash)
- [CVE-2020-20907](https://cve.now/CVE-2020-20907.md): MetInfo 7.0 beta is affected by a file modification vulnerability. (no CVSS)
- [CVE-2021-29256](https://cve.now/CVE-2021-29256.md): . (CVSS 8.8, KEV)
- [CVE-2021-30083](https://cve.now/CVE-2021-30083.md): An issue was discovered in Mediat 1.4.1. (no CVSS)
- [CVE-2021-30082](https://cve.now/CVE-2021-30082.md): An issue was discovered in Gris CMS v0.1. (no CVSS)
- [CVE-2021-30081](https://cve.now/CVE-2021-30081.md): An issue was discovered in emlog 6.0.0stable. (no CVSS)
- [CVE-2020-26555](https://cve.now/CVE-2020-26555.md): Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spo (no CVSS)
- [CVE-2020-26556](https://cve.now/CVE-2020-26556.md): Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on (no CVSS)
- [CVE-2020-21041](https://cve.now/CVE-2020-21041.md): Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng\_do\_inverse\_blend in libavcodec/pngenc.c, which could let a remote malicious user (no CVSS)
- [CVE-2020-26557](https://cve.now/CVE-2020-26557.md): Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the pr (no CVSS)
- [CVE-2020-26558](https://cve.now/CVE-2020-26558.md): Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to ide (no CVSS)
- [CVE-2020-26559](https://cve.now/CVE-2020-26559.md): Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protoc (no CVSS)
- [CVE-2020-26560](https://cve.now/CVE-2020-26560.md): Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence f (no CVSS)
- [CVE-2021-32624](https://cve.now/CVE-2021-32624.md): Private Field data leak (CVSS 7.5, keystonejs keystone-5 · @keystonejs/keystone)
- [CVE-2021-33502](https://cve.now/CVE-2021-33502.md): The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service (no CVSS, normalize-url)
- [CVE-2021-29300](https://cve.now/CVE-2021-29300.md): The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute c (no CVSS, @ronomon/opened)
- [CVE-2021-32629](https://cve.now/CVE-2021-32629.md): Memory access due to code generation flaw in Cranelift module (CVSS 7.2, bytecodealliance wasmtime · cranelift-codegen +1)
- [CVE-2019-12348](https://cve.now/CVE-2019-12348.md): An issue was discovered in zzcms 2019. (no CVSS)
- [CVE-2021-33516](https://cve.now/CVE-2021-33516.md): An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. (no CVSS)
- [CVE-2021-20557](https://cve.now/CVE-2021-20557.md): IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially cr (CVSS 7.2, IBM Security Guardium)
- [CVE-2021-20428](https://cve.now/CVE-2021-20428.md): IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned (CVSS 5.3, IBM Security Guardium)
- [CVE-2021-20426](https://cve.now/CVE-2021-20426.md): IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe (CVSS 5.9, IBM Security Guardium)
- [CVE-2021-20419](https://cve.now/CVE-2021-20419.md): IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infor (CVSS 6.8, IBM Security Guardium)
- [CVE-2021-20389](https://cve.now/CVE-2021-20389.md): IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user. (CVSS 5.1, IBM Security Guardium)
- [CVE-2021-20386](https://cve.now/CVE-2021-20386.md): IBM Security Guardium 11.2 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Security Guardium)
- [CVE-2021-20385](https://cve.now/CVE-2021-20385.md): IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. (CVSS 8.4, IBM Security Guardium)
- [CVE-2020-4990](https://cve.now/CVE-2020-4990.md): IBM Security Guardium 11.2 is vulnerable to SQL injection. (CVSS 7.6, IBM Security Guardium)
- [CVE-2021-3485](https://cve.now/CVE-2021-3485.md): Improper Input Validation in Bitdefender Endpoint Security Tools for Linux (CVSS 6.4, Bitdefender Endpoint Security Tools for Linux)
- [CVE-2020-25408](https://cve.now/CVE-2020-25408.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to (no CVSS)
- [CVE-2020-28911](https://cve.now/CVE-2020-28911.md): Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fu (no CVSS)
- [CVE-2020-28910](https://cve.now/CVE-2020-28910.md): Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of s (no CVSS)
- [CVE-2020-28909](https://cve.now/CVE-2020-28909.md): Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. (no CVSS)
- [CVE-2020-28908](https://cve.now/CVE-2020-28908.md): Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. (no CVSS)
- [CVE-2020-28907](https://cve.now/CVE-2020-28907.md): Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via ve (no CVSS)
- [CVE-2020-28906](https://cve.now/CVE-2020-28906.md): Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root. (no CVSS)
- [CVE-2020-28905](https://cve.now/CVE-2020-28905.md): Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination. (no CVSS)
- [CVE-2020-28904](https://cve.now/CVE-2020-28904.md): Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a mal (no CVSS)
- [CVE-2020-28903](https://cve.now/CVE-2020-28903.md): Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary H (no CVSS)
- [CVE-2020-28902](https://cve.now/CVE-2020-28902.md): Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd\_subsys.php. (no CVSS)
- [CVE-2020-28901](https://cve.now/CVE-2020-28901.md): Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrup (no CVSS)
- [CVE-2020-28900](https://cve.now/CVE-2020-28900.md): Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of P (no CVSS)
- [CVE-2021-32075](https://cve.now/CVE-2021-32075.md): Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization. (no CVSS)
- [CVE-2020-26006](https://cve.now/CVE-2020-26006.md): Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php. (no CVSS)
- [CVE-2020-25411](https://cve.now/CVE-2020-25411.md): Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user. (no CVSS)
- [CVE-2020-25409](https://cve.now/CVE-2020-25409.md): Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters. (no CVSS)
- [CVE-2021-3559](https://cve.now/CVE-2021-3559.md): A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0. (no CVSS, libvirt)
- [CVE-2021-21989](https://cve.now/CVE-2021-21989.md): VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th (no CVSS, VMware Workstation Pro / Player (Workstation), VMware Horiz…)
- [CVE-2021-21988](https://cve.now/CVE-2021-21988.md): VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th (no CVSS, VMware Workstation Pro / Player (Workstation), VMware Horiz…)
- [CVE-2021-21987](https://cve.now/CVE-2021-21987.md): VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in th (no CVSS, VMware Workstation Pro / Player (Workstation), VMware Horiz…)
- [CVE-2021-21001](https://cve.now/CVE-2021-21001.md): WAGO: PFC200 Access to files outside the home directory (CVSS 9.1, WAGO Series PFC200 Controller · WAGO Series Ethernet Contro…)
- [CVE-2021-21000](https://cve.now/CVE-2021-21000.md): WAGO: PFC200 Denial of Service due to the number of connections to the runtime (CVSS 5.3, WAGO Series PFC200 Controller · WAGO Series Ethernet Contro…)
- [CVE-2021-24306](https://cve.now/CVE-2021-24306.md): Ultimate Member \< 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Ultimate Member – User Profile, User Registration, Login &…)
- [CVE-2021-24307](https://cve.now/CVE-2021-24307.md): All in One SEO Pack \< 4.1.0.2 - Admin RCE via unserialize (no CVSS, All in One SEO Team All in One SEO – Best WordPress SEO Plu…)
- [CVE-2021-24308](https://cve.now/CVE-2021-24308.md): LifterLMS \< 4.21.1 - Authenticated Stored XSS in Edit Profile (no CVSS, LMS by LifterLMS – Online Course, Membership & Learning Man…)
- [CVE-2021-24332](https://cve.now/CVE-2021-24332.md): Autoptimize \< 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Autoptimize)
- [CVE-2021-24296](https://cve.now/CVE-2021-24296.md): WP Customer Reviews \< 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Go Web Solutions WP Customer Reviews)
- [CVE-2021-24297](https://cve.now/CVE-2021-24297.md): Goto \< 2.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, Goto)
- [CVE-2021-24298](https://cve.now/CVE-2021-24298.md): Simple Giveaways \< 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Igor Benic Simple Giveaways – Grow your business, email lis…)
- [CVE-2021-24300](https://cve.now/CVE-2021-24300.md): PickPlugins Product Slider for WooCommerce \< 1.13.22 - Reflected Cross-Site Scripting (XSS) (no CVSS, PickPlugins Product Slider for WooCommerce)
- [CVE-2021-24301](https://cve.now/CVE-2021-24301.md): Hotjar Connecticator \<= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Blue Medicine Labs Hotjar Connecticator)
- [CVE-2021-24302](https://cve.now/CVE-2021-24302.md): Hana Flv Player \<= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, HanaDaddy Hana Flv Player)
- [CVE-2021-24305](https://cve.now/CVE-2021-24305.md): Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key (no CVSS, TargetFirst Target First Plugin)
- [CVE-2021-24294](https://cve.now/CVE-2021-24294.md): DSGVO All in one for WP \< 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS) (no CVSS, Michael Leithold DSGVO All in one for WP)
- [CVE-2021-25938](https://cve.now/CVE-2021-25938.md): In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file n (no CVSS, ArangoDB)
- [CVE-2021-33497](https://cve.now/CVE-2021-33497.md): Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files. (no CVSS, github.com/dutchcoders/transfer.sh)
- [CVE-2021-33496](https://cve.now/CVE-2021-33496.md): Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view. (no CVSS, github.com/dutchcoders/transfer.sh)
- [CVE-2021-20726](https://cve.now/CVE-2021-20726.md): Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arb (no CVSS, The Installer of Overwolf)
- [CVE-2021-20725](https://cve.now/CVE-2021-20725.md): Reflected cross-site scripting vulnerability in the admin page of \[Calendar01\] free edition ver1.0.1 and earlier allows a remote attacker to (no CVSS, PHP Factory \[Calendar01\] free edition)
- [CVE-2021-20723](https://cve.now/CVE-2021-20723.md): Reflected cross-site scripting vulnerability in \[MailForm01\] free edition (versions which the last updated date listed at the top of descrip (no CVSS, PHP Factory \[MailForm01\] free edition)
- [CVE-2021-20724](https://cve.now/CVE-2021-20724.md): Reflected cross-site scripting vulnerability in the admin page of \[Telop01\] free edition ver1.0.1 and earlier allows a remote attacker to in (no CVSS, PHP Factory \[Telop01\] free edition)
- [CVE-2021-20722](https://cve.now/CVE-2021-20722.md): Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prio (CVSS 7.8, FUJITSU LIMITED and PFU LIMITED The installers of ScanSnap…)
- [CVE-2021-20713](https://cve.now/CVE-2021-20713.md): Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can log in to the PC where (no CVSS, QualitySoft QND Advance/Premium/Standard)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.