# CVEs published 2021-05-27

83 CVEs were published on May 27, 2021: 1 critical, 4 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2021-33408](https://cve.now/CVE-2021-33408.md): Local File Inclusion vulnerability in Ab Initio Control\>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files. (no CVSS)
- [CVE-2021-27852](https://cve.now/CVE-2021-27852.md): Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute a (CVSS 9.8, KEV, Checkbox Survey)
- [CVE-2020-10145](https://cve.now/CVE-2020-10145.md): The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\\ColdFusion2 (CVSS 7.8, Adobe ColdFusion)
- [CVE-2020-15180](https://cve.now/CVE-2020-15180.md): A flaw was found in the mysql-wsrep component of mariadb. (no CVSS, mariadb)
- [CVE-2020-1761](https://cve.now/CVE-2020-1761.md): A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. (no CVSS, openshift/console)
- [CVE-2020-1702](https://cve.now/CVE-2020-1702.md): A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterpr (no CVSS, containers/image)
- [CVE-2020-1701](https://cve.now/CVE-2020-1701.md): A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. (no CVSS, virt-handler · kubevirt.io/kubevirt)
- [CVE-2020-14387](https://cve.now/CVE-2020-14387.md): A flaw was found in rsync in versions since 3.2.0pre1. (no CVSS, rsync)
- [CVE-2020-14329](https://cve.now/CVE-2020-14329.md): A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpo (no CVSS, Tower)
- [CVE-2020-14328](https://cve.now/CVE-2020-14328.md): A flaw was found in Ansible Tower in versions before 3.7.2. (no CVSS, Tower)
- [CVE-2020-14327](https://cve.now/CVE-2020-14327.md): A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. (no CVSS, Tower)
- [CVE-2020-14301](https://cve.now/CVE-2020-14301.md): An information disclosure vulnerability was found in libvirt in versions before 6.3.0. (no CVSS, libvirt)
- [CVE-2021-20026](https://cve.now/CVE-2021-20026.md): A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP r (no CVSS, SonicWall NSM On-Prem)
- [CVE-2020-22034](https://cve.now/CVE-2020-22034.md): A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf\_floodfill.c, which might lead to memory corruption and other (no CVSS)
- [CVE-2020-10774](https://cve.now/CVE-2020-10774.md): A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/k (no CVSS, kernel)
- [CVE-2020-10729](https://cve.now/CVE-2020-10729.md): A flaw was found in the use of insufficiently random values in Ansible. (no CVSS, Ansible)
- [CVE-2020-10716](https://cve.now/CVE-2020-10716.md): A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. (no CVSS, rubygem-foreman\_ansible)
- [CVE-2020-10709](https://cve.now/CVE-2020-10709.md): A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. (no CVSS, Tower)
- [CVE-2020-10701](https://cve.now/CVE-2020-10701.md): A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout. (no CVSS, libvirt)
- [CVE-2020-10698](https://cve.now/CVE-2020-10698.md): A flaw was found in Ansible Tower when running jobs. (no CVSS, Tower)
- [CVE-2020-10697](https://cve.now/CVE-2020-10697.md): A flaw was found in Ansible Tower when running Openshift. (no CVSS, Tower)
- [CVE-2020-10688](https://cve.now/CVE-2020-10688.md): A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly ha (no CVSS, RESTEasy · org.jboss.resteasy:resteasy-bom +1)
- [CVE-2020-22033](https://cve.now/CVE-2020-22033.md): A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf\_vmafmotion.c in convolution\_y\_8bit, which could let a remote (no CVSS)
- [CVE-2020-22032](https://cve.now/CVE-2020-22032.md): A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf\_edgedetect.c in gaussian\_blur, which might lead to memory cor (no CVSS)
- [CVE-2020-22016](https://cve.now/CVE-2020-22016.md): A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get\_bits.h when writing .mov files, which might lead to memory corrup (no CVSS)
- [CVE-2020-22017](https://cve.now/CVE-2020-22017.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff\_fill\_rectangle in libavfilter/drawutils.c, which might lead to memory (no CVSS)
- [CVE-2021-33394](https://cve.now/CVE-2021-33394.md): Cubecart 6.4.2 allows Session Fixation. (no CVSS)
- [CVE-2020-22022](https://cve.now/CVE-2020-22022.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter\_frame at libavfilter/vf\_fieldorder.c, which might lead to memory c (no CVSS)
- [CVE-2020-22023](https://cve.now/CVE-2020-22023.md): A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter\_frame at libavfilter/vf\_bitplanenoise.c, which might lead to memo (no CVSS)
- [CVE-2020-22025](https://cve.now/CVE-2020-22025.md): A heap-based Buffer Overflow vulnerability exists in gaussian\_blur at libavfilter/vf\_edgedetect.c, which might lead to memory corruption and (no CVSS)
- [CVE-2020-22027](https://cve.now/CVE-2020-22027.md): A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf\_neighbor.c, which might lead to memory corrupt (no CVSS)
- [CVE-2020-22030](https://cve.now/CVE-2020-22030.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af\_afade.c in crossfade\_samples\_fltp, which might lead to mem (no CVSS)
- [CVE-2020-22029](https://cve.now/CVE-2020-22029.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf\_colorconstancy.c: in slice\_get\_derivative, which crossfade (no CVSS)
- [CVE-2020-22031](https://cve.now/CVE-2020-22031.md): A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf\_w3fdif.c in filter16\_complex\_low, which might lead to memo (no CVSS)
- [CVE-2021-32643](https://cve.now/CVE-2021-32643.md): StaticFile.fromUrl can leak presence of a directory (CVSS 5.8, http4s · org.http4s:http4s-core)
- [CVE-2021-32645](https://cve.now/CVE-2021-32645.md): Open Redirect in tenancy (CVSS 4.3, tenancy multi-tenant · hyn/multi-tenant)
- [CVE-2021-27490](https://cve.now/CVE-2021-27490.md): Datakit Software libraries CatiaV5\_3dRead, CatiaV6\_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior (no CVSS, Datakit Software libraries embedded in Luxion KeyShot softw…)
- [CVE-2021-27492](https://cve.now/CVE-2021-27492.md): When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5\_3dRead, CatiaV6\_3dRead, Step3dRea (no CVSS, Datakit Software libraries embedded in Luxion KeyShot softw…)
- [CVE-2021-27488](https://cve.now/CVE-2021-27488.md): Datakit Software libraries CatiaV5\_3dRead, CatiaV6\_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior (no CVSS, Datakit Software libraries embedded in Luxion KeyShot softw…)
- [CVE-2021-27496](https://cve.now/CVE-2021-27496.md): Datakit Software libraries CatiaV5\_3dRead, CatiaV6\_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior (no CVSS, Datakit Software libraries embedded in Luxion KeyShot softw…)
- [CVE-2021-27494](https://cve.now/CVE-2021-27494.md): Datakit Software libraries CatiaV5\_3dRead, CatiaV6\_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior (no CVSS, Datakit Software libraries embedded in Luxion KeyShot softw…)
- [CVE-2020-18229](https://cve.now/CVE-2020-18229.md): Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg (no CVSS)
- [CVE-2020-18230](https://cve.now/CVE-2020-18230.md): Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg (no CVSS)
- [CVE-2021-22118](https://cve.now/CVE-2021-22118.md): In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege es (no CVSS, Spring Framework · org.springframework:spring-web)
- [CVE-2020-27832](https://cve.now/CVE-2020-27832.md): A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notifica (no CVSS, quay)
- [CVE-2021-22360](https://cve.now/CVE-2021-22360.md): There is a resource management error vulnerability in the verisions V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 of USG9500. (no CVSS, USG9500)
- [CVE-2021-22364](https://cve.now/CVE-2021-22364.md): There is a denial of service vulnerability in the versions 10.1.0.126(C00E125R5P3) of HUAWEI Mate 30 and 10.1.0.152(C00E136R7P2) of HUAWEI M (no CVSS, HUAWEI Mate 30;HUAWEI Mate)
- [CVE-2021-22359](https://cve.now/CVE-2021-22359.md): There is a denial of service vulnerability in the verisions V200R005C00SPC500 of S5700 and V200R005C00SPC500 of S6700. (no CVSS, S5700;S6700)
- [CVE-2021-22358](https://cve.now/CVE-2021-22358.md): There is an insufficient input validation vulnerability in FusionCompute 8.0.0. (no CVSS, FusionCompute)
- [CVE-2008-2544](https://cve.now/CVE-2008-2544.md): Mounting /proc filesystem via chroot command silently mounts it in read-write mode. (no CVSS)
- [CVE-2021-31535](https://cve.now/CVE-2021-31535.md): LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. (no CVSS)
- [CVE-2021-22362](https://cve.now/CVE-2021-22362.md): There is an out of bounds write vulnerability in some Huawei products. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2021-31525](https://cve.now/CVE-2021-31525.md): net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to Re (no CVSS, golang.org/x/net · stdlib)
- [CVE-2021-22411](https://cve.now/CVE-2021-22411.md): There is an out-of-bounds write vulnerability in some Huawei products. (no CVSS, NGFW Module;Secospace USG6300;Secospace USG6500;Secospace U…)
- [CVE-2021-31155](https://cve.now/CVE-2021-31155.md): Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at l (no CVSS, pleaser)
- [CVE-2021-31154](https://cve.now/CVE-2021-31154.md): pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. (no CVSS, pleaser)
- [CVE-2020-17514](https://cve.now/CVE-2020-17514.md): disabled hostname verificiation (no CVSS, Apache Software Foundation Apache Fineract)
- [CVE-2021-31153](https://cve.now/CVE-2021-31153.md): please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations (no CVSS, pleaser)
- [CVE-2021-22885](https://cve.now/CVE-2021-22885.md): A possible information disclosure / unintended method execution vulnerability in Action Pack \>= 2.0.0 when using the \`redirect\_to\` or \`polym (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22900](https://cve.now/CVE-2021-22900.md): A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administra (CVSS 7.2, KEV, Pulse Secure Secure)
- [CVE-2021-22899](https://cve.now/CVE-2021-22899.md): A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote co (CVSS 8.8, KEV, Pulse Connect Secure)
- [CVE-2021-22891](https://cve.now/CVE-2021-22891.md): A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 may (no CVSS, Citrix ShareFile Storage Zones Controller)
- [CVE-2021-22894](https://cve.now/CVE-2021-22894.md): A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary c (CVSS 8.8, KEV, Pulse Connect Secure)
- [CVE-2021-22892](https://cve.now/CVE-2021-22892.md): An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be d (no CVSS, Rocket.Chat server)
- [CVE-2021-22911](https://cve.now/CVE-2021-22911.md): A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectio (no CVSS, Rocket.Chat server)
- [CVE-2021-22909](https://cve.now/CVE-2021-22909.md): A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack du (no CVSS, EdgeMAX EdgeRouter)
- [CVE-2021-22908](https://cve.now/CVE-2021-22908.md): A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse (no CVSS, Pulse Connect Secure)
- [CVE-2021-22907](https://cve.now/CVE-2021-22907.md): An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions p (no CVSS, Citrix Workspace App for Windows)
- [CVE-2021-33590](https://cve.now/CVE-2021-33590.md): GattLib 0.3-rc1 has a stack-based buffer over-read in get\_device\_path\_from\_mac in dbus/gattlib.c. (no CVSS)
- [CVE-2021-32459](https://cve.now/CVE-2021-32459.md): Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server whic (no CVSS, Trend Micro Home Network Security)
- [CVE-2021-32458](https://cve.now/CVE-2021-32458.md): Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which coul (no CVSS, Trend Micro Home Network Security)
- [CVE-2021-20727](https://cve.now/CVE-2021-20727.md): Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary script by loading a file or cod (no CVSS, Hendrik Erz Zettlr)
- [CVE-2021-33586](https://cve.now/CVE-2021-33586.md): InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "m (no CVSS)
- [CVE-2021-31920](https://cve.now/CVE-2021-31920.md): Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escap (no CVSS)
- [CVE-2020-12403](https://cve.now/CVE-2020-12403.md): A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. (no CVSS, nss)
- [CVE-2021-28651](https://cve.now/CVE-2021-28651.md): An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-28652](https://cve.now/CVE-2021-28652.md): An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-28662](https://cve.now/CVE-2021-28662.md): An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-30465](https://cve.now/CVE-2021-30465.md): runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. (no CVSS, github.com/opencontainers/runc)
- [CVE-2021-31806](https://cve.now/CVE-2021-31806.md): An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-31808](https://cve.now/CVE-2021-31808.md): An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-33200](https://cve.now/CVE-2021-33200.md): kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579. (no CVSS)
- [CVE-2021-33558](https://cve.now/CVE-2021-33558.md): Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, l (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.