# CVEs published 2021-05-25

55 CVEs were published on May 25, 2021: 0 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-31924](https://cve.now/CVE-2021-31924.md): Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local P (no CVSS)
- [CVE-2021-33575](https://cve.now/CVE-2021-33575.md): The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usin (no CVSS, ruby-jss)
- [CVE-2021-33570](https://cve.now/CVE-2021-33570.md): Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. (no CVSS)
- [CVE-2016-20011](https://cve.now/CVE-2016-20011.md): libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the cont (no CVSS)
- [CVE-2020-25672](https://cve.now/CVE-2020-25672.md): A memory leak vulnerability was found in Linux kernel in llcp\_sock\_connect (no CVSS, Linux Kernel)
- [CVE-2021-20209](https://cve.now/CVE-2021-20209.md): A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured. (no CVSS, privoxy)
- [CVE-2020-20453](https://cve.now/CVE-2020-20453.md): FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service (no CVSS)
- [CVE-2021-25946](https://cve.now/CVE-2021-25946.md): Prototype pollution vulnerability in \`nconf-toml\` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead (no CVSS, nconf-toml)
- [CVE-2020-20451](https://cve.now/CVE-2020-20451.md): Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c. (no CVSS)
- [CVE-2021-25934](https://cve.now/CVE-2021-25934.md): In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through me (no CVSS, OpenNMS · org.opennms:opennms)
- [CVE-2021-25935](https://cve.now/CVE-2021-25935.md): In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through me (no CVSS, OpenNMS)
- [CVE-2021-27562](https://cve.now/CVE-2021-27562.md): In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure da (CVSS 5.5, KEV)
- [CVE-2021-25944](https://cve.now/CVE-2021-25944.md): Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead (no CVSS, deep-defaults)
- [CVE-2021-32640](https://cve.now/CVE-2021-32640.md): ReDoS in Sec-Websocket-Protocol header (CVSS 5.3, websockets ws · ws)
- [CVE-2020-20450](https://cve.now/CVE-2020-20450.md): FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service. (no CVSS)
- [CVE-2020-20448](https://cve.now/CVE-2020-20448.md): FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of S (no CVSS)
- [CVE-2020-20446](https://cve.now/CVE-2020-20446.md): FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service. (no CVSS)
- [CVE-2020-20445](https://cve.now/CVE-2020-20445.md): FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service. (no CVSS)
- [CVE-2021-32638](https://cve.now/CVE-2021-32638.md): CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated (CVSS 4.4, github codeql-action)
- [CVE-2021-29708](https://cve.now/CVE-2021-29708.md): IBM Spectrum Scale 5.1.0.1 could allow a local with access to the GUI pod container to obtain sensitive cryptographic keys that could allow (CVSS 6.7, IBM Spectrum Scale)
- [CVE-2021-29695](https://cve.now/CVE-2021-29695.md): IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system. (CVSS 4.9, IBM 8335-GTB · IBM 8335-GTA +1)
- [CVE-2020-4839](https://cve.now/CVE-2020-4839.md): IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking. (CVSS 4.9, IBM 8335-GTB · IBM 8335-GTA +1)
- [CVE-2021-29209](https://cve.now/CVE-2021-29209.md): A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrate (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29208](https://cve.now/CVE-2021-29208.md): A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrate (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29211](https://cve.now/CVE-2021-29211.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29210](https://cve.now/CVE-2021-29210.md): A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrate (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-21660](https://cve.now/CVE-2021-21660.md): Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting ( (no CVSS, Jenkins project Jenkins Markdown Formatter Plugin · io.jenk…)
- [CVE-2021-21659](https://cve.now/CVE-2021-21659.md): Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins URLTrigger Plugin · org.jenkins-ci.…)
- [CVE-2021-21657](https://cve.now/CVE-2021-21657.md): Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Filesystem Trigger Plugin · org.jen…)
- [CVE-2021-21658](https://cve.now/CVE-2021-21658.md): Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Nuget Plugin · org.jenkins-ci.plugi…)
- [CVE-2021-29207](https://cve.now/CVE-2021-29207.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29206](https://cve.now/CVE-2021-29206.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-27823](https://cve.now/CVE-2021-27823.md): An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticate (no CVSS)
- [CVE-2021-33425](https://cve.now/CVE-2021-33425.md): A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers (no CVSS)
- [CVE-2021-27821](https://cve.now/CVE-2021-27821.md): The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability. (no CVSS)
- [CVE-2021-29205](https://cve.now/CVE-2021-29205.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29204](https://cve.now/CVE-2021-29204.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29202](https://cve.now/CVE-2021-29202.md): A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights- (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-29201](https://cve.now/CVE-2021-29201.md): A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO (no CVSS, HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…)
- [CVE-2021-30195](https://cve.now/CVE-2021-30195.md): CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation. (no CVSS)
- [CVE-2021-30188](https://cve.now/CVE-2021-30188.md): CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. (no CVSS)
- [CVE-2021-30186](https://cve.now/CVE-2021-30186.md): CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. (no CVSS)
- [CVE-2021-30194](https://cve.now/CVE-2021-30194.md): CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. (no CVSS)
- [CVE-2021-30193](https://cve.now/CVE-2021-30193.md): CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write. (no CVSS)
- [CVE-2021-30192](https://cve.now/CVE-2021-30192.md): CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. (no CVSS)
- [CVE-2021-30191](https://cve.now/CVE-2021-30191.md): CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input. (no CVSS)
- [CVE-2021-30190](https://cve.now/CVE-2021-30190.md): CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. (no CVSS)
- [CVE-2021-30189](https://cve.now/CVE-2021-30189.md): CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. (no CVSS)
- [CVE-2021-30187](https://cve.now/CVE-2021-30187.md): CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. (no CVSS)
- [CVE-2021-20096](https://cve.now/CVE-2021-20096.md): Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate u (no CVSS, OpenOversight)
- [CVE-2020-9452](https://cve.now/CVE-2020-9452.md): An issue was discovered in Acronis True Image 2020 24.5.22510. (no CVSS)
- [CVE-2020-9450](https://cve.now/CVE-2020-9450.md): An issue was discovered in Acronis True Image 2020 24.5.22510. (no CVSS)
- [CVE-2020-9451](https://cve.now/CVE-2020-9451.md): An issue was discovered in Acronis True Image 2020 24.5.22510. (no CVSS)
- [CVE-2021-23937](https://cve.now/CVE-2021-23937.md): DNS proxy and possible amplification attack (no CVSS, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2021-33574](https://cve.now/CVE-2021-33574.md): The mq\_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.