# CVEs published 2021-05-26

104 CVEs were published on May 26, 2021: 1 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-3509](https://cve.now/CVE-2021-3509.md): A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component. (no CVSS, ceph-dashboard)
- [CVE-2021-30501](https://cve.now/CVE-2021-30501.md): An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. (no CVSS, upx)
- [CVE-2021-30500](https://cve.now/CVE-2021-30500.md): Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p\_lx\_elf.cpp,in version UPX 4.0.0. (no CVSS, upx)
- [CVE-2021-30499](https://cve.now/CVE-2021-30499.md): A flaw was found in libcaca. (no CVSS, libcaca)
- [CVE-2020-27831](https://cve.now/CVE-2020-27831.md): A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repository (no CVSS, quay)
- [CVE-2021-25217](https://cve.now/CVE-2021-25217.md): A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclient (CVSS 7.4, ISC DHCP)
- [CVE-2021-28170](https://cve.now/CVE-2021-28170.md): In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be (no CVSS, The Eclipse Foundation Jakarta Expression Language Imple… +2)
- [CVE-2021-32614](https://cve.now/CVE-2021-32614.md): A flaw was found in dmg2img through 20170502. (no CVSS, dmg2img)
- [CVE-2021-30472](https://cve.now/CVE-2021-30472.md): A flaw was found in PoDoFo 0.9.7. (no CVSS, podofo)
- [CVE-2021-30471](https://cve.now/CVE-2021-30471.md): A flaw was found in PoDoFo 0.9.7. (no CVSS, podofo)
- [CVE-2021-30470](https://cve.now/CVE-2021-30470.md): A flaw was found in PoDoFo 0.9.7. (no CVSS, podofo)
- [CVE-2021-30469](https://cve.now/CVE-2021-30469.md): A flaw was found in PoDoFo 0.9.7. (no CVSS, podofo)
- [CVE-2020-10695](https://cve.now/CVE-2020-10695.md): An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. (no CVSS, containers/redhat-sso-7)
- [CVE-2021-3486](https://cve.now/CVE-2021-3486.md): GLPi 9.5.4 does not sanitize the metadata. (no CVSS, glpi)
- [CVE-2021-3561](https://cve.now/CVE-2021-3561.md): An Out of Bounds flaw was found fig2dev version 3.2.8a. (no CVSS, fig2dev)
- [CVE-2020-27839](https://cve.now/CVE-2020-27839.md): A flaw was found in ceph-dashboard. (no CVSS, ceph-dashboard)
- [CVE-2021-20196](https://cve.now/CVE-2021-20196.md): A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. (no CVSS, qemu)
- [CVE-2021-3527](https://cve.now/CVE-2021-3527.md): A flaw was found in the USB redirector device (usb-redir) of QEMU. (no CVSS, QEMU)
- [CVE-2009-3721](https://cve.now/CVE-2009-3721.md): Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived fr (no CVSS, ytnef)
- [CVE-2020-25634](https://cve.now/CVE-2020-25634.md): A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials. (no CVSS, 3scale-system)
- [CVE-2020-25724](https://cve.now/CVE-2020-25724.md): A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. (no CVSS, resteasy · org.jboss.resteasy:resteasy-bom)
- [CVE-2021-20177](https://cve.now/CVE-2021-20177.md): A flaw was found in the Linux kernel's implementation of string matching within a packet. (no CVSS, kernel)
- [CVE-2021-20297](https://cve.now/CVE-2021-20297.md): A flaw was found in NetworkManager in versions before 1.30.0. (no CVSS, NetworkManager)
- [CVE-2021-3549](https://cve.now/CVE-2021-3549.md): An out of bounds flaw was found in GNU binutils objdump utility version 2.36. (no CVSS, binutils)
- [CVE-2020-22028](https://cve.now/CVE-2020-22028.md): Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter\_vertically\_8 at libavfilter/vf\_avgblur.c, which could cause a remote Denial of (no CVSS)
- [CVE-2021-3548](https://cve.now/CVE-2021-3548.md): A flaw was found in dmg2img through 20170502. (no CVSS, dmg2img)
- [CVE-2020-22026](https://cve.now/CVE-2020-22026.md): Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config\_input function at libavfilter/af\_tremolo.c, which could let a remote malici (no CVSS)
- [CVE-2020-22024](https://cve.now/CVE-2020-22024.md): Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun\_frame16 function in libavfilter/vf\_lagfun.c, which could let a remote malicious us (no CVSS)
- [CVE-2021-25643](https://cve.now/CVE-2021-25643.md): An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. (no CVSS)
- [CVE-2020-22021](https://cve.now/CVE-2020-22021.md): Buffer Overflow vulnerability in FFmpeg 4.2 at filter\_edges function in libavfilter/vf\_yadif.c, which could let a remote malicious user caus (no CVSS)
- [CVE-2021-22747](https://cve.now/CVE-2021-22747.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that (no CVSS, Triconex Model 3009 MP installed on Tricon V11.3.x systems)
- [CVE-2021-22746](https://cve.now/CVE-2021-22746.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that (no CVSS, Triconex Model 3009 MP installed on Tricon V11.3.x systems)
- [CVE-2021-22745](https://cve.now/CVE-2021-22745.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that (no CVSS, Triconex Model 3009 MP installed on Tricon V11.3.x systems)
- [CVE-2021-22744](https://cve.now/CVE-2021-22744.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that (no CVSS, Triconex Model 3009 MP installed on Tricon V11.3.x systems)
- [CVE-2021-22743](https://cve.now/CVE-2021-22743.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TCM 4351B installed on Tricon V11.3.x systems that cou (no CVSS, Triconex TCM 4351B installed on Tricon V11.3.x systems.)
- [CVE-2021-22742](https://cve.now/CVE-2021-22742.md): Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems that (no CVSS, Triconex Model 3009 MP installed on Tricon V11.3.x systems)
- [CVE-2021-22741](https://cve.now/CVE-2021-22741.md): Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert (no CVSS, ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 201…)
- [CVE-2021-22740](https://cve.now/CVE-2021-22740.md): Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be expo (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22739](https://cve.now/CVE-2021-22739.md): Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be comprom (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22738](https://cve.now/CVE-2021-22738.md): Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could c (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22736](https://cve.now/CVE-2021-22736.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYn (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22735](https://cve.now/CVE-2021-22735.md): Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could a (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22734](https://cve.now/CVE-2021-22734.md): Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22733](https://cve.now/CVE-2021-22733.md): Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22732](https://cve.now/CVE-2021-22732.md): Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code execut (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-22731](https://cve.now/CVE-2021-22731.md): Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM\* and MCSESP\* V8.21 and prior w (no CVSS, Modicon Managed Switch MCSESM\* and MCSESP\* V8.21 and prior)
- [CVE-2021-22705](https://cve.now/CVE-2021-22705.md): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthori (no CVSS, Harmony HMI Products Configured by Vijeo Designer (all vers…)
- [CVE-2021-22699](https://cve.now/CVE-2021-22699.md): Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of (no CVSS, Modicon M241/M251 logic controllers firmware prior to)
- [CVE-2020-22019](https://cve.now/CVE-2020-22019.md): Buffer Overflow vulnerability in FFmpeg 4.2 at convolution\_y\_10bit in libavfilter/vf\_vmafmotion.c, which could let a remote malicious user c (no CVSS)
- [CVE-2020-22020](https://cve.now/CVE-2020-22020.md): Buffer Overflow vulnerability in FFmpeg 4.2 in the build\_diff\_map function in libavfilter/vf\_fieldmatch.c, which could let a remote maliciou (no CVSS)
- [CVE-2018-16494](https://cve.now/CVE-2018-16494.md): In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissi (no CVSS, Versa VOS)
- [CVE-2018-16495](https://cve.now/CVE-2018-16495.md): In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user suc (no CVSS, Versa VOS)
- [CVE-2018-16496](https://cve.now/CVE-2018-16496.md): In Versa Director, the un-authentication request found. (no CVSS, Versa Director)
- [CVE-2018-16497](https://cve.now/CVE-2018-16497.md): In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. (no CVSS, Versa Analytics)
- [CVE-2018-16498](https://cve.now/CVE-2018-16498.md): In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. (no CVSS, Versa Director)
- [CVE-2018-16499](https://cve.now/CVE-2018-16499.md): In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man (no CVSS, Versa VOS)
- [CVE-2019-25030](https://cve.now/CVE-2019-25030.md): In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation functio (no CVSS, Versa Director, Versa Analytics, Versa VOS)
- [CVE-2019-25029](https://cve.now/CVE-2019-25029.md): In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via (no CVSS, Versa Director)
- [CVE-2020-15076](https://cve.now/CVE-2020-15076.md): Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks (no CVSS, Private Tunnel)
- [CVE-2018-10868](https://cve.now/CVE-2018-10868.md): redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthentica (no CVSS, redhat-certification)
- [CVE-2018-10867](https://cve.now/CVE-2018-10867.md): Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove an (no CVSS, redhat-certification)
- [CVE-2018-10866](https://cve.now/CVE-2018-10866.md): It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti (no CVSS, redhat-certification)
- [CVE-2018-10865](https://cve.now/CVE-2018-10865.md): It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenti (no CVSS, redhat-certification)
- [CVE-2018-10863](https://cve.now/CVE-2018-10863.md): It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store (no CVSS, redhat-certification)
- [CVE-2021-33470](https://cve.now/CVE-2021-33470.md): COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel. (no CVSS)
- [CVE-2021-33469](https://cve.now/CVE-2021-33469.md): COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter. (no CVSS)
- [CVE-2020-22015](https://cve.now/CVE-2020-22015.md): Buffer Overflow vulnerability in FFmpeg 4.2 in mov\_write\_video\_tag due to the out of bounds in libavformat/movenc.c, which could let a remot (no CVSS)
- [CVE-2021-20492](https://cve.now/CVE-2021-20492.md): IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when p (CVSS 6.5, IBM WebSphere Application Server)
- [CVE-2021-20487](https://cve.now/CVE-2021-20487.md): IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware by (CVSS 8.0, IBM Power 9 Systems)
- [CVE-2021-20486](https://cve.now/CVE-2021-20486.md): IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins. (CVSS 5.3, IBM Cloud Pak for Data)
- [CVE-2019-4588](https://cve.now/CVE-2019-4588.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitr (CVSS 7.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2020-18221](https://cve.now/CVE-2020-18221.md): Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during bloc (no CVSS)
- [CVE-2021-33194](https://cve.now/CVE-2021-33194.md): golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFr (no CVSS, golang.org/x/net)
- [CVE-2021-33506](https://cve.now/CVE-2021-33506.md): jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict\_room\_creation is set by default. (no CVSS)
- [CVE-2020-24020](https://cve.now/CVE-2020-24020.md): Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn\_execute\_layer\_pad in libavfilter/dnn/dnn\_backend\_native\_layer\_pad.c due to a call to me (no CVSS)
- [CVE-2021-25945](https://cve.now/CVE-2021-25945.md): Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to r (no CVSS, js-extend)
- [CVE-2021-21986](https://cve.now/CVE-2021-21986.md): The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, v (no CVSS, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-21985](https://cve.now/CVE-2021-21985.md): The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check pl (CVSS 9.8, KEV, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-33038](https://cve.now/CVE-2021-33038.md): An issue was discovered in management/commands/hyperkitty\_import.py in HyperKitty through 1.3.4. (no CVSS, hyperkitty)
- [CVE-2021-32457](https://cve.now/CVE-2021-32457.md): Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which coul (no CVSS, Trend Micro Home Network Security)
- [CVE-2021-22160](https://cve.now/CVE-2021-22160.md): Authentication with JWT allows use of “none”-algorithm (no CVSS, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2020-27815](https://cve.now/CVE-2020-27815.md): A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes to (no CVSS, Linux Kernel)
- [CVE-2020-25697](https://cve.now/CVE-2020-25697.md): A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. (no CVSS, xorg-x11-server)
- [CVE-2020-26677](https://cve.now/CVE-2020-26677.md): Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API. (no CVSS)
- [CVE-2020-26680](https://cve.now/CVE-2020-26680.md): In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross- (no CVSS)
- [CVE-2020-26679](https://cve.now/CVE-2020-26679.md): vFairs 3.3 is affected by Insecure Permissions. (no CVSS)
- [CVE-2020-26678](https://cve.now/CVE-2020-26678.md): vFairs 3.3 is affected by Remote Code Execution. (no CVSS)
- [CVE-2020-25669](https://cve.now/CVE-2020-25669.md): A vulnerability was found in the Linux Kernel where the function sunkbd\_reinit having been scheduled by sunkbd\_interrupt before sunkbd being (no CVSS, Linux Kernel)
- [CVE-2019-14836](https://cve.now/CVE-2019-14836.md): A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF. (no CVSS, Red Hat 3scale API Management)
- [CVE-2020-25668](https://cve.now/CVE-2020-25668.md): A flaw was found in Linux Kernel because access to the global variable fg\_console is not properly synchronized leading to a use after free i (no CVSS, Linux Kernel)
- [CVE-2020-25673](https://cve.now/CVE-2020-25673.md): A vulnerability was found in Linux kernel where non-blocking socket in llcp\_sock\_connect() leads to leak and eventually hanging-up the syste (no CVSS, Linux Kernel)
- [CVE-2020-25671](https://cve.now/CVE-2020-25671.md): A vulnerability was found in Linux Kernel, where a refcount leak in llcp\_sock\_connect() causing use-after-free which might lead to privilege (no CVSS, Linux Kernel)
- [CVE-2021-22543](https://cve.now/CVE-2021-22543.md): Improper memory handling in Linux KVM (CVSS 8.7, Linux Kernel)
- [CVE-2020-25670](https://cve.now/CVE-2020-25670.md): A vulnerability was found in Linux Kernel where refcount leak in llcp\_sock\_bind() causing use-after-free which might lead to privilege escal (no CVSS, Linux Kernel)
- [CVE-2021-26034](https://cve.now/CVE-2021-26034.md): \[20210503\] - Core - CSRF in data download endpoints (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26033](https://cve.now/CVE-2021-26033.md): \[20210502\] - Core - CSRF in AJAX reordering endpoint (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26032](https://cve.now/CVE-2021-26032.md): \[20210501\] - Core - Adding HTML to the executable block list of MediaHelper::canUpload (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-27676](https://cve.now/CVE-2021-27676.md): Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability. (no CVSS, centreon/centreon)
- [CVE-2021-29253](https://cve.now/CVE-2021-29253.md): The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability. (CVSS 5.1)
- [CVE-2021-29252](https://cve.now/CVE-2021-29252.md): RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. (CVSS 5.4)
- [CVE-2021-20178](https://cve.now/CVE-2021-20178.md): A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature w (no CVSS, Ansible)
- [CVE-2021-20191](https://cve.now/CVE-2021-20191.md): A flaw was found in ansible. (no CVSS, ansible)
- [CVE-2021-22737](https://cve.now/CVE-2021-22737.md): Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unautho (no CVSS, homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior)
- [CVE-2021-30498](https://cve.now/CVE-2021-30498.md): A flaw was found in libcaca. (no CVSS, libcaca)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.