Weekly Vulnerabilities Reports > June 14 to 20, 2021
Overview
248 new vulnerabilities reported during this period, including 8 critical vulnerabilities and 97 high severity vulnerabilities. This weekly summary report vulnerabilities in 243 products from 121 vendors including Opentext, Fedoraproject, Google, Siemens, and Cisco. Vulnerabilities are notably categorized as "Cross-site Scripting", "Out-of-bounds Write", "SQL Injection", "Use After Free", and "Out-of-bounds Read".
- 187 reported vulnerabilities are remotely exploitables.
- 2 reported vulnerabilities have public exploit available.
- 83 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
- 184 reported vulnerabilities are exploitable by an anonymous user.
- Opentext has the most reported vulnerabilities, with 25 reported vulnerabilities.
- Google has the most reported critical vulnerabilities, with 1 reported vulnerabilities.
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
VULNERABILITIES
EXPLOITABLE
EXPLOITABLE
AVAILABLE
ANONYMOUSLY
WEB APPLICATION
Vulnerability Details
The following table list reported vulnerabilities for the period covered by this report:
8 Critical Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2021-06-14 | CVE-2021-0324 | Unspecified vulnerability in Google Android Product: AndroidVersions: Android SoCAndroid ID: A-175402462 | 10.0 | |
2021-06-18 | CVE-2021-21669 | Jenkins | Unspecified vulnerability in Jenkins Generic Webhook Trigger Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. | 9.8 |
2021-06-17 | CVE-2021-23396 | Lutils Project | Unspecified vulnerability in Lutils Project Lutils All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function. | 9.8 |
2021-06-16 | CVE-2021-27610 | SAP | Improper Authentication vulnerability in SAP Netweaver Abap and Netweaver Application Server Abap SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create information about internal and external RFC user in consistent and distinguished format, which could lead to improper authentication and may be exploited by malicious users to obtain illegitimate access to the system. | 9.8 |
2021-06-16 | CVE-2020-9493 | Apache QOS | Deserialization of Untrusted Data vulnerability in multiple products A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution. | 9.8 |
2021-06-14 | CVE-2021-32682 | Std42 | Server-Side Request Forgery (SSRF) vulnerability in Std42 Elfinder elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. | 9.8 |
2021-06-17 | CVE-2021-21777 | Opener Project | Out-of-bounds Read vulnerability in Opener Project Opener 2.3 An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. | 9.4 |
2021-06-16 | CVE-2021-20093 | Wibu Siemens | Out-of-bounds Read vulnerability in multiple products A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. | 9.1 |
97 High Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2021-06-17 | CVE-2020-36388 | Civicrm | Unrestricted Upload of File with Dangerous Type vulnerability in Civicrm In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive. | 8.8 |
2021-06-16 | CVE-2020-22201 | Phpcms | Code Injection vulnerability in PHPcms 2008 phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. | 8.8 |
2021-06-15 | CVE-2021-30544 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in BFCache in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30545 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30546 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Autofill in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30547 | Google Debian Fedoraproject Mozilla | Out-of-bounds Write vulnerability in multiple products Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30548 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Loader in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30549 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Spell check in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30550 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30551 | Google Fedoraproject | Type Confusion vulnerability in multiple products Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30552 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Extensions in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-15 | CVE-2021-30553 | Google Fedoraproject | Use After Free vulnerability in multiple products Use after free in Network service in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | 8.8 |
2021-06-14 | CVE-2021-24347 | Smartypantsplugins | Improper Handling of Case Sensitivity vulnerability in Smartypantsplugins SP Project & Document Manager The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. | 8.8 |
2021-06-14 | CVE-2021-24352 | Wpdeveloper | Missing Authorization vulnerability in Wpdeveloper Simple 301 Redirects The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects. | 8.8 |
2021-06-14 | CVE-2021-24353 | Wpdeveloper | Missing Authorization vulnerability in Wpdeveloper Simple 301 Redirects The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects. | 8.8 |
2021-06-14 | CVE-2021-24356 | Wpdeveloper | Missing Authorization vulnerability in Wpdeveloper Simple 301 Redirects In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites. | 8.8 |
2021-06-16 | CVE-2021-32690 | Helm | Unspecified vulnerability in Helm Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). | 8.6 |
2021-06-17 | CVE-2021-3603 | Phpmailer Project Fedoraproject | Inclusion of Functionality from Untrusted Control Sphere vulnerability in multiple products PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is injected into the host project's scope by other means). | 8.1 |
2021-06-16 | CVE-2021-34203 | Dlink | Insecure Default Initialization of Resource vulnerability in Dlink Dir-2640-Us Firmware 1.01B04 D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. | 8.1 |
2021-06-16 | CVE-2021-1542 | Cisco | Improper Authentication vulnerability in Cisco products Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory. | 8.1 |
2021-06-16 | CVE-2021-34551 | Phpmailer Project Fedoraproject | Unrestricted Upload of File with Dangerous Type vulnerability in multiple products PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname. | 8.1 |
2021-06-18 | CVE-2021-21279 | Contiki NG | Infinite Loop vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for internet of things devices. | 7.8 |
2021-06-17 | CVE-2021-32936 | Opendesign Siemens | Out-of-bounds Write vulnerability in multiple products An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. | 7.8 |
2021-06-17 | CVE-2021-32948 | Opendesign Siemens | Out-of-bounds Write vulnerability in multiple products An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. | 7.8 |
2021-06-16 | CVE-2021-34202 | Dlink | Out-of-bounds Write vulnerability in Dlink Dir-2640-Us Firmware 1.01B04 There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. | 7.8 |
2021-06-15 | CVE-2021-31478 | Opentext | Heap-based Buffer Overflow vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31479 | Opentext | Access of Uninitialized Pointer vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31481 | Opentext | Untrusted Pointer Dereference vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31482 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31483 | Opentext | Heap-based Buffer Overflow vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31484 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31485 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31486 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31487 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31488 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31489 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31490 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31491 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31492 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31493 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31494 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31495 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31496 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31497 | Opentext | Use After Free vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31499 | Opentext | Out-of-bounds Write vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31500 | Opentext | Untrusted Pointer Dereference vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 7.8 |
2021-06-15 | CVE-2021-31502 | Opentext | Use After Free vulnerability in Opentext Brava! Desktop 16.6.4.55 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. | 7.8 |
2021-06-18 | CVE-2021-31272 | Serenityos | Path Traversal vulnerability in Serenityos SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation. | 7.5 |
2021-06-18 | CVE-2021-21280 | Contiki NG | Out-of-bounds Write vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for internet of things devices. | 7.5 |
2021-06-18 | CVE-2021-21281 | Contiki NG | Classic Buffer Overflow vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for internet of things devices. | 7.5 |
2021-06-18 | CVE-2021-21282 | Contiki NG | Classic Buffer Overflow vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for internet of things devices. | 7.5 |
2021-06-18 | CVE-2021-3604 | Primion Digitek | SQL Injection vulnerability in Primion-Digitek Secure 8 1.0.1.55 Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injection. | 7.5 |
2021-06-18 | CVE-2021-33576 | Cleo | Path Traversal vulnerability in Cleo Lexicom 5.5.0.0 An issue was discovered in Cleo LexiCom 5.5.0.0. | 7.5 |
2021-06-17 | CVE-2013-20002 | Themify | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Framework Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file. | 7.5 |
2021-06-17 | CVE-2020-25414 | Monstra | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Monstra 3.0.4 A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitrary PHP code. | 7.5 |
2021-06-17 | CVE-2021-34825 | Quassel IRC Fedoraproject | Cleartext Transmission of Sensitive Information vulnerability in multiple products Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. | 7.5 |
2021-06-16 | CVE-2021-31477 | GE | Use of Hard-coded Credentials vulnerability in GE Reason Rpv311 Firmware 14A03 This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. | 7.5 |
2021-06-16 | CVE-2021-32691 | Apollosapp | Improper Authentication vulnerability in Apollosapp Data-Connector-Rock Apollos Apps is an open source platform for launching church-related apps. | 7.5 |
2021-06-16 | CVE-2020-25753 | Enphase | Unspecified vulnerability in Enphase Envoy Firmware D4.0/R3.0 An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. | 7.5 |
2021-06-16 | CVE-2020-22203 | Phpcms | SQL Injection vulnerability in PHPcms 2008 SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | 7.5 |
2021-06-16 | CVE-2020-22204 | Shopex | SQL Injection vulnerability in Shopex Ecshop 2.7.6 SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php. | 7.5 |
2021-06-16 | CVE-2020-22205 | Shopex | SQL Injection vulnerability in Shopex Ecshop 3.0 SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. | 7.5 |
2021-06-16 | CVE-2020-22206 | Shopex | SQL Injection vulnerability in Shopex Ecshop 3.0 SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php. | 7.5 |
2021-06-16 | CVE-2020-22208 | 74Cms | SQL Injection vulnerability in 74Cms 3.2.0 SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php. | 7.5 |
2021-06-16 | CVE-2020-22209 | 74Cms | SQL Injection vulnerability in 74Cms 3.2.0 SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php. | 7.5 |
2021-06-16 | CVE-2020-22210 | 74Cms | SQL Injection vulnerability in 74Cms 3.2.0 SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php. | 7.5 |
2021-06-16 | CVE-2020-22211 | 74Cms | SQL Injection vulnerability in 74Cms 3.2.0 SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php. | 7.5 |
2021-06-16 | CVE-2020-22212 | 74Cms | SQL Injection vulnerability in 74Cms 3.2.0 SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php. | 7.5 |
2021-06-16 | CVE-2021-34813 | Matrix | Out-of-bounds Write vulnerability in Matrix OLM Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. | 7.5 |
2021-06-16 | CVE-2020-22199 | Phpcms | SQL Injection vulnerability in PHPcms 2007 SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | 7.5 |
2021-06-16 | CVE-2020-22198 | Dedecms | SQL Injection vulnerability in Dedecms 5.7 SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. | 7.5 |
2021-06-16 | CVE-2020-24939 | Stampit | Unspecified vulnerability in Stampit Supermixer 1.0.3 Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depending on the implementation. | 7.5 |
2021-06-16 | CVE-2020-35760 | Bloofox | Unrestricted Upload of File with Dangerous Type vulnerability in Bloofox Bloofoxcms 0.5.2.1 bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files). | 7.5 |
2021-06-16 | CVE-2021-32928 | Thalesgroup | Incomplete Cleanup vulnerability in Thalesgroup Sentinel LDK Run-Time Environment The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows incoming connections from private networks using TCP Port 1947. | 7.5 |
2021-06-16 | CVE-2021-30468 | Apache Oracle | Infinite Loop vulnerability in multiple products A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinite loop, consuming CPU indefinitely. | 7.5 |
2021-06-16 | CVE-2021-33813 | Jdom Apache Debian Fedoraproject Oracle | XXE vulnerability in multiple products An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. | 7.5 |
2021-06-16 | CVE-2021-21441 | Otrs | Cross-site Scripting vulnerability in Otrs There is a XSS vulnerability in the ticket overview screens. | 7.5 |
2021-06-16 | CVE-2021-32685 | Togatech | Improper Verification of Cryptographic Signature vulnerability in Togatech Tenvoy tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. | 7.5 |
2021-06-15 | CVE-2021-24037 | Use After Free vulnerability in Facebook Hermes A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. | 7.5 | |
2021-06-15 | CVE-2020-29214 | Alumni Management System Project | SQL Injection vulnerability in Alumni Management System Project Alumni Management System 1.0 SQL injection vulnerability in SourceCodester Alumni Management System 1.0 allows the user to inject SQL payload to bypass the authentication via admin/login.php. | 7.5 |
2021-06-15 | CVE-2020-7864 | Dext5 | Unrestricted Upload of File with Dangerous Type vulnerability in Dext5 Editor Parameter manipulation can bypass authentication to cause file upload and execution. | 7.5 |
2021-06-15 | CVE-2021-27388 | Siemens | Improper Input Validation vulnerability in Siemens products SINAMICS medium voltage routable products are affected by a vulnerability in the Sm@rtServer component for remote access that could allow an unauthenticated attacker to cause a denial-of-service condition, and/or execution of limited configuration modifications and/or execution of limited control commands on the SINAMICS Medium Voltage Products, Remote Access (SINAMICS SL150: All versions, SINAMICS SM150: All versions, SINAMICS SM150i: All versions). | 7.5 |
2021-06-15 | CVE-2021-34170 | Fromsoftware | Unspecified vulnerability in Fromsoftware Dark Souls III Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code. | 7.5 |
2021-06-15 | CVE-2021-31618 | Apache Fedoraproject Debian Oracle | NULL Pointer Dereference vulnerability in multiple products Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. | 7.5 |
2021-06-14 | CVE-2021-26845 | Hitachienergy | Incorrect Authorization vulnerability in Hitachienergy Esoms Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report is discovered. | 7.5 |
2021-06-14 | CVE-2021-27196 | Hitachienergy | Improper Input Validation vulnerability in Hitachienergy products Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the attack, as well as the IP addresses of the different IEC 61850 access points (of IEDs/products), to force the device to reboot, which renders the device inoperable for approximately 60 seconds. | 7.5 |
2021-06-16 | CVE-2021-1566 | Cisco | Improper Certificate Validation vulnerability in Cisco Asyncos and Email Security Appliance A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to intercept traffic between an affected device and the AMP servers. | 7.4 |
2021-06-16 | CVE-2021-1541 | Cisco | Improper Authentication vulnerability in Cisco products Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory. | 7.2 |
2021-06-16 | CVE-2020-20444 | Openclinic Project | Missing Authorization vulnerability in Openclinic Project Openclinic 0.8.20160412 Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET parameter in '/shared/view_source.php' which "could" lead to RCE vulnerability . | 7.2 |
2021-06-16 | CVE-2020-27339 | Insyde Siemens | Improper Input Validation vulnerability in multiple products In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. | 7.2 |
2021-06-15 | CVE-2021-33887 | Onepeloton | Insufficient Verification of Data Authenticity vulnerability in Onepeloton Ttr01 Firmware Ptv55G Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kernel/ramdisk without unlocking the bootloader. | 7.2 |
2021-06-14 | CVE-2021-21555 | Dell | Out-of-bounds Write vulnerability in Dell products Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a heap-based buffer overflow vulnerability in systems with NVDIMM-N installed. | 7.2 |
2021-06-14 | CVE-2021-21556 | Dell | Out-of-bounds Write vulnerability in Dell products Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. | 7.2 |
2021-06-14 | CVE-2021-24348 | WOW Estore | SQL Injection vulnerability in Wow-Estore Side Menu The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue | 7.2 |
2021-06-17 | CVE-2021-32938 | Opendesign Siemens | Out-of-bounds Read vulnerability in multiple products Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of proper validation of user-supplied data. | 7.1 |
2021-06-17 | CVE-2021-32940 | Opendesign Siemens | Out-of-bounds Read vulnerability in multiple products An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from the lack of proper validation of user-supplied data. | 7.1 |
2021-06-16 | CVE-2021-34201 | Dlink | Out-of-bounds Write vulnerability in Dlink Dir-2640-Us Firmware 1.01B04 D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. | 7.1 |
112 Medium Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2021-06-18 | CVE-2021-23845 | Bosch | Unspecified vulnerability in Bosch products This vulnerability could allow an attacker to hijack a session while a user is logged in the configuration web page. | 6.8 |
2021-06-18 | CVE-2021-32954 | Advantech | Path Traversal vulnerability in Advantech Webaccess/Scada Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the file system. | 6.8 |
2021-06-17 | CVE-2021-32424 | Trendnet | Cross-Site Request Forgery (CSRF) vulnerability in Trendnet Tw100-S4W1Ca Firmware 2.3.32 In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. | 6.8 |
2021-06-17 | CVE-2021-32944 | Opendesign Siemens | Use After Free vulnerability in multiple products A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. | 6.8 |
2021-06-17 | CVE-2021-32952 | Opendesign Siemens | Out-of-bounds Write vulnerability in multiple products An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of user-supplied data. | 6.8 |
2021-06-17 | CVE-2021-32946 | Opendesign Siemens | Improper Check for Unusual or Exceptional Conditions vulnerability in multiple products An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prior) resulting from the lack of proper validation of the user-supplied data. | 6.8 |
2021-06-16 | CVE-2021-31476 | Foxitsoftware | Type Confusion vulnerability in Foxitsoftware Foxit Reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. | 6.8 |
2021-06-16 | CVE-2021-34204 | Dlink | Insufficiently Protected Credentials vulnerability in Dlink Dir-2640-Us Firmware 1.01B04 D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. | 6.8 |
2021-06-15 | CVE-2021-33622 | Sylabs | Improper Check for Unusual or Exceptional Conditions vulnerability in Sylabs Singularity and Singularitypro Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has an Incorrect Check of a Function's Return Value. | 6.8 |
2021-06-15 | CVE-2021-31480 | Opentext | Type Confusion vulnerability in Opentext Brava! 16.6.3.84 This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. | 6.8 |
2021-06-16 | CVE-2021-1567 | Cisco | Uncontrolled Search Path Element vulnerability in Cisco Anyconnect Secure Mobility Client A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. | 6.7 |
2021-06-14 | CVE-2021-21554 | Dell | Out-of-bounds Write vulnerability in Dell products Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and, Dell Precision 7920 Rack Workstation BIOS contain a stack-based buffer overflow vulnerability in systems with Intel Optane DC Persistent Memory installed. | 6.7 |
2021-06-14 | CVE-2021-21557 | Dell | Out-of-bounds Read vulnerability in Dell products Dell PowerEdge Server BIOS and select Dell Precision Rack BIOS contain an out-of-bounds array access vulnerability. | 6.7 |
2021-06-17 | CVE-2021-32078 | Linux | Out-of-bounds Read vulnerability in Linux Kernel An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a check for a value that shouldn't be negative, e.g., access to element -2 of an array, aka CID-298a58e165e4. | 6.6 |
2021-06-18 | CVE-2021-34809 | Synology | Command Injection vulnerability in Synology Download Station Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. | 6.5 |
2021-06-18 | CVE-2021-34810 | Synology | Improper Privilege Management vulnerability in Synology Download Station Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. | 6.5 |
2021-06-17 | CVE-2021-32693 | Sensiolabs | Improper Authentication vulnerability in Sensiolabs Symfony 5.3.0 Symfony is a PHP framework for web and console applications and a set of reusable PHP components. | 6.5 |
2021-06-16 | CVE-2021-32243 | Fogproject | Unrestricted Upload of File with Dangerous Type vulnerability in Fogproject 1.5.9 FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). | 6.5 |
2021-06-16 | CVE-2020-25755 | Enphase | OS Command Injection vulnerability in Enphase Envoy Firmware D4.0/R3.0 An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. | 6.5 |
2021-06-16 | CVE-2021-1524 | Cisco | Improper Input Validation vulnerability in Cisco Meeting Server 3.1.0 A vulnerability in the API of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. | 6.5 |
2021-06-16 | CVE-2021-1569 | Cisco | Improper Input Validation vulnerability in Cisco Jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. | 6.5 |
2021-06-16 | CVE-2021-1570 | Cisco | Improper Input Validation vulnerability in Cisco Jabber Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for Mac, and Cisco Jabber for mobile platforms could allow an attacker to access sensitive information or cause a denial of service (DoS) condition. | 6.5 |
2021-06-16 | CVE-2021-27489 | Zoll | Unrestricted Upload of File with Dangerous Type vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. | 6.5 |
2021-06-15 | CVE-2021-34128 | Laiketui | Unrestricted Upload of File with Dangerous Type vulnerability in Laiketui 3.5.0 LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname. | 6.5 |
2021-06-14 | CVE-2021-24341 | Xllentech | SQL Injection vulnerability in Xllentech English Islamic Calendar When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection. | 6.5 |
2021-06-14 | CVE-2021-24354 | Wpdeveloper | Missing Authorization vulnerability in Wpdeveloper Simple 301 Redirects A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites. | 6.5 |
2021-06-14 | CVE-2021-21439 | Otrs | Improper Handling of Exceptional Conditions vulnerability in Otrs DoS attack can be performed when an email contains specially designed URL in the body. | 6.5 |
2021-06-18 | CVE-2021-21410 | Contiki NG | Out-of-bounds Read vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. | 6.4 |
2021-06-20 | CVE-2021-24368 | Expresstech | Cross-site Scripting vulnerability in Expresstech Quiz and Survey Master The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. | 6.1 |
2021-06-17 | CVE-2020-35373 | Fiyo | Cross-site Scripting vulnerability in Fiyo CMS 2.0.6.1 In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack. | 6.1 |
2021-06-16 | CVE-2021-1395 | Cisco | Cross-site Scripting vulnerability in Cisco products A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. | 6.1 |
2021-06-16 | CVE-2021-1543 | Cisco | Cross-site Scripting vulnerability in Cisco products Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory. | 6.1 |
2021-06-16 | CVE-2021-1571 | Cisco | Cross-site Scripting vulnerability in Cisco products Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting (XSS) attack Conduct an HTML injection attack For more information about these vulnerabilities, see the Details section of this advisory. | 6.1 |
2021-06-14 | CVE-2021-24349 | Gallery From Files Project | Cross-site Scripting vulnerability in Gallery From Files Project Gallery From Files This Gallery from files WordPress plugin through 1.6.0 gives the functionality of uploading images to the server. | 6.1 |
2021-06-14 | CVE-2021-24345 | Sendit Project | SQL Injection vulnerability in Sendit Project Sendit The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection. | 6.0 |
2021-06-18 | CVE-2021-32956 | Advantech | Open Redirect vulnerability in Advantech Webaccess/Scada Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage. | 5.8 |
2021-06-17 | CVE-2021-32950 | Opendesign Siemens | Out-of-bounds Read vulnerability in multiple products An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lack of proper validation of user-supplied data. | 5.8 |
2021-06-14 | CVE-2021-24358 | Posimyth | Open Redirect vulnerability in Posimyth the Plus Addons for Elementor The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. | 5.8 |
2021-06-16 | CVE-2021-1568 | Cisco | Uncontrolled Memory Allocation vulnerability in Cisco Anyconnect Secure Mobility Client A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected system. | 5.5 |
2021-06-15 | CVE-2021-34129 | Laiketui | Path Traversal vulnerability in Laiketui 3.5.0 LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. | 5.5 |
2021-06-14 | CVE-2021-34693 | Linux Debian | Missing Initialization of Resource vulnerability in multiple products net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. | 5.5 |
2021-06-16 | CVE-2021-21667 | Jenkins | Cross-site Scripting vulnerability in Jenkins Scriptler 3.1/3.2 Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. | 5.4 |
2021-06-16 | CVE-2021-21668 | Jenkins | Cross-site Scripting vulnerability in Jenkins Scriptler 3.1 Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. | 5.4 |
2021-06-15 | CVE-2020-29215 | Razormist | Cross-site Scripting vulnerability in Razormist Employee Management System 1.0 A Cross Site Scripting in SourceCodester Employee Management System 1.0 allows the user to execute alert messages via /Employee Management System/addemp.php on admin account. | 5.4 |
2021-06-15 | CVE-2020-5000 | IBM | Cross-site Scripting vulnerability in IBM Financial Transaction Manager 3.0.2/3.2.4 IBM Financial Transaction Manager 3.2.0 through 3.2.8 is vulnerable to cross-site scripting. | 5.4 |
2021-06-14 | CVE-2021-24357 | Fooplugins | Cross-site Scripting vulnerability in Fooplugins Foogallery In the Best Image Gallery & Responsive Photo Gallery – FooGallery WordPress plugin before 2.0.35, the Custom CSS field of each gallery is not properly sanitised or validated before being being output in the page where the gallery is embed, leading to a stored Cross-Site Scripting issue. | 5.4 |
2021-06-15 | CVE-2021-23395 | Nedb Project | Unspecified vulnerability in Nedb Project Nedb This affects all versions of package nedb. | 5.3 |
2021-06-14 | CVE-2021-24359 | Posimyth | Improper Authentication vulnerability in Posimyth the Plus Addons for Elementor The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.11 did not properly check that a user requesting a password reset was the legitimate user, allowing an attacker to send an arbitrary reset password email to a registered user on behalf of the WordPress site. | 5.3 |
2021-06-18 | CVE-2021-31660 | Riot OS | Classic Buffer Overflow vulnerability in Riot-Os Riot 2021.01 RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-31661 | Riot OS | Classic Buffer Overflow vulnerability in Riot-Os Riot 2021.01 RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-31662 | Riot OS | Classic Buffer Overflow vulnerability in Riot-Os Riot 2021.01 RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-31663 | Riot OS | Classic Buffer Overflow vulnerability in Riot-Os Riot 2021.01 RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-31664 | Riot OS | Classic Buffer Overflow vulnerability in Riot-Os Riot 2021.01 RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-33185 | Serenityos | Classic Buffer Overflow vulnerability in Serenityos SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-33186 | Serenityos | Out-of-bounds Write vulnerability in Serenityos SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. | 5.0 |
2021-06-18 | CVE-2021-21257 | Contiki NG | Out-of-bounds Write vulnerability in Contiki-Ng Contiki-NG is an open-source, cross-platform operating system for internet of things devices. | 5.0 |
2021-06-18 | CVE-2021-32696 | Striptags Project | Type Confusion vulnerability in Striptags Project Striptags The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. | 5.0 |
2021-06-18 | CVE-2021-33823 | Moxa | Unspecified vulnerability in Moxa Mgate Mb3180 Firmware 2.1 An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. | 5.0 |
2021-06-18 | CVE-2021-33824 | Moxa | Resource Exhaustion vulnerability in Moxa Mgate Mb3180 Firmware 2.1 An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. | 5.0 |
2021-06-18 | CVE-2021-33818 | UI | Resource Exhaustion vulnerability in UI Camera G3 Flex Firmware Uvc.V4.30.0.67 An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. | 5.0 |
2021-06-18 | CVE-2021-33820 | UI | Unspecified vulnerability in UI Camera G3 Flex Firmware Uvc.V4.30.0.67 An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted. | 5.0 |
2021-06-18 | CVE-2021-33822 | Sing4G | Resource Exhaustion vulnerability in Sing4G 4Gee Router Hh70Vb Firmware Hh70E102.0022 An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22. | 5.0 |
2021-06-18 | CVE-2021-33577 | Cleo | Unspecified vulnerability in Cleo Lexicom 5.5.0.0 An issue was discovered in Cleo LexiCom 5.5.0.0. | 5.0 |
2021-06-18 | CVE-2021-34808 | Synology | Server-Side Request Forgery (SSRF) vulnerability in Synology Media Server Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. | 5.0 |
2021-06-18 | CVE-2021-34812 | Synology | Use of Hard-coded Credentials vulnerability in Synology Calendar Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. | 5.0 |
2021-06-17 | CVE-2021-32582 | Connectwise | SQL Injection vulnerability in Connectwise Automate 2019.12/2020.7 An issue was discovered in ConnectWise Automate before 2021.5. | 5.0 |
2021-06-16 | CVE-2020-25752 | Enphase | Use of Hard-coded Credentials vulnerability in Enphase Envoy Firmware D4.0/R3.0 An issue was discovered on Enphase Envoy R3.x and D4.x devices. | 5.0 |
2021-06-16 | CVE-2020-25754 | Enphase | Use of Password Hash With Insufficient Computational Effort vulnerability in Enphase Envoy Firmware D4.0/R3.0 An issue was discovered on Enphase Envoy R3.x and D4.x devices. | 5.0 |
2021-06-16 | CVE-2020-22200 | Phpcms | Path Traversal vulnerability in PHPcms 9.1.13 Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword. | 5.0 |
2021-06-16 | CVE-2021-20566 | IBM | Use of a Broken or Risky Cryptographic Algorithm vulnerability in IBM Resilient Security Orchestration Automation and Response 38.0 IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. | 5.0 |
2021-06-16 | CVE-2021-29702 | IBM | Injection vulnerability in IBM DB2 Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminates abnormally when executing a specially crafted SELECT statement. | 5.0 |
2021-06-16 | CVE-2021-34801 | Valine JS | Unspecified vulnerability in Valine.Js Valine 1.4.14 Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version. | 5.0 |
2021-06-16 | CVE-2021-22914 | Citrix | Insecure Storage of Sensitive Information vulnerability in Citrix Cloud Connector Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. | 5.0 |
2021-06-16 | CVE-2021-27485 | Zoll | Storing Passwords in a Recoverable Format vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to retrieve the credentials from the web browser. | 5.0 |
2021-06-16 | CVE-2021-31159 | Zohocorp | Information Exposure Through an Error Message vulnerability in Zohocorp Manageengine Servicedesk Plus MSP 10.5 Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732. | 5.0 |
2021-06-16 | CVE-2021-20094 | Wibu Siemens | Out-of-bounds Read vulnerability in multiple products A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a. | 5.0 |
2021-06-16 | CVE-2021-34683 | EIC | Information Exposure vulnerability in EIC E-Document System 3.0 An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. | 5.0 |
2021-06-15 | CVE-2021-28857 | TP Link | Insufficiently Protected Credentials vulnerability in Tp-Link Tl-Wpa4220 Firmware 4.0.2 TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie. | 5.0 |
2021-06-14 | CVE-2021-20027 | Sonicwall | Classic Buffer Overflow vulnerability in Sonicwall Sonicos A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. | 5.0 |
2021-06-14 | CVE-2021-32684 | Scandipwa | Always-Incorrect Control Flow Implementation vulnerability in Scandipwa Magento-Scripts 1.5.1/1.5.2 magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. | 5.0 |
2021-06-18 | CVE-2021-21997 | Vmware | Unspecified vulnerability in VMWare Tools VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. | 4.9 |
2021-06-17 | CVE-2021-0143 | Intel | Incorrect Default Permissions vulnerability in Intel Brand Verification Tool Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to potentially enable escalation of privilege via local access. | 4.6 |
2021-06-16 | CVE-2021-27483 | Zoll | Incorrect Permission Assignment for Critical Resource vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user. | 4.6 |
2021-06-14 | CVE-2021-0467 | Out-of-bounds Write vulnerability in Google Android In Chromecast bootROM, there is a possible out of bounds write due to an incorrect bounds check. | 4.6 | |
2021-06-16 | CVE-2021-34803 | Teamviewer | Uncontrolled Search Path Element vulnerability in Teamviewer TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. | 4.4 |
2021-06-18 | CVE-2021-23846 | Bosch | Cleartext Transmission of Sensitive Information vulnerability in Bosch B426 Firmware When using http protocol, the user password is transmitted as a clear text parameter for which it is possible to be obtained by an attacker through a MITM attack. | 4.3 |
2021-06-18 | CVE-2021-26835 | Zettlr | Cross-site Scripting vulnerability in Zettlr 1.8.7 No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file. | 4.3 |
2021-06-18 | CVE-2021-32536 | Mcusystem | Cross-site Scripting vulnerability in Mcusystem 5.5 The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaScript without privilege and thus perform reflected XSS attacks. | 4.3 |
2021-06-17 | CVE-2021-32426 | Trendnet | Cross-site Scripting vulnerability in Trendnet Tw100-S4W1Ca Firmware 2.3.32 In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command. | 4.3 |
2021-06-17 | CVE-2021-32694 | Nextcloud | Uncaught Exception vulnerability in Nextcloud Nextcloud Android app is the Android client for Nextcloud. | 4.3 |
2021-06-17 | CVE-2020-36389 | Civicrm | Cross-Site Request Forgery (CSRF) vulnerability in Civicrm In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. | 4.3 |
2021-06-17 | CVE-2021-33557 | Mantisbt | Cross-site Scripting vulnerability in Mantisbt An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. | 4.3 |
2021-06-17 | CVE-2021-31818 | Octopus | SQL Injection vulnerability in Octopus Server Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied data in the API request isn’t parameterised correctly. | 4.3 |
2021-06-16 | CVE-2020-35759 | Bloofox | Cross-Site Request Forgery (CSRF) vulnerability in Bloofox Bloofoxcms 0.5.2.1 bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely). | 4.3 |
2021-06-16 | CVE-2020-8300 | Citrix | Unspecified vulnerability in Citrix products Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. | 4.3 |
2021-06-16 | CVE-2021-31857 | Zohocorp | Unspecified vulnerability in Zohocorp Manageengine Password Manager PRO In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for non-website resource types. | 4.3 |
2021-06-16 | CVE-2021-28979 | Thalesgroup | Injection vulnerability in Thalesgroup Safenet Keysecure 8.12.0 SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. | 4.3 |
2021-06-16 | CVE-2021-32612 | I DOO | Cleartext Transmission of Sensitive Information vulnerability in I-Doo Veryfitpro 3.2.8 The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. | 4.3 |
2021-06-16 | CVE-2021-3535 | Rapid7 | Cross-site Scripting vulnerability in Rapid7 Nexpose Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. | 4.3 |
2021-06-15 | CVE-2020-21316 | Zrlog | Cross-site Scripting vulnerability in Zrlog 2.1.3 A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel. | 4.3 |
2021-06-15 | CVE-2021-32683 | Wire | Cross-site Scripting vulnerability in Wire Wire-Webapp wire-webapp is the web version of Wire, an open-source messenger. | 4.3 |
2021-06-14 | CVE-2021-24350 | Bestwebsoft | Cross-site Scripting vulnerability in Bestwebsoft Visitors Online 0.1/0.2/0.3 The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. | 4.3 |
2021-06-14 | CVE-2021-24351 | Posimyth | Cross-site Scripting vulnerability in Posimyth the Plus Addons for Elementor The theplus_more_post AJAX action of The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.12 did not properly sanitise some of its fields, leading to a reflected Cross-Site Scripting (exploitable on both unauthenticated and authenticated users) | 4.3 |
2021-06-14 | CVE-2021-24355 | Wpdeveloper | Missing Authorization vulnerability in Wpdeveloper Simple 301 Redirects In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects. | 4.3 |
2021-06-18 | CVE-2021-34811 | Synology | Server-Side Request Forgery (SSRF) vulnerability in Synology Download Station Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors. | 4.0 |
2021-06-18 | CVE-2021-34553 | Sonatype | Path Traversal vulnerability in Sonatype Nexus Repository Manager Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | 4.0 |
2021-06-16 | CVE-2021-20483 | IBM | Server-Side Request Forgery (SSRF) vulnerability in IBM Security Identity Manager 6.0.2 IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). | 4.0 |
2021-06-16 | CVE-2020-35762 | Bloofox | Path Traversal vulnerability in Bloofox Bloofoxcms 0.5.2.1 bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files. | 4.0 |
2021-06-16 | CVE-2021-28815 | Qnap | Insecure Storage of Sensitive Information vulnerability in Qnap Myqnapcloud Link Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. | 4.0 |
2021-06-16 | CVE-2021-32623 | Apereo | XML Entity Expansion vulnerability in Apereo Opencast Opencast is a free and open source solution for automated video capture and distribution. | 4.0 |
2021-06-16 | CVE-2021-32676 | Nextcloud | Session Fixation vulnerability in Nextcloud Talk Nextcloud Talk is a fully on-premises audio/video and chat communication service. | 4.0 |
2021-06-14 | CVE-2021-24360 | Kohsei Works | SQL Injection vulnerability in Kohsei-Works Yes/No Chart The Yes/No Chart WordPress plugin before 1.0.12 did not sanitise its sid shortcode parameter before using it in a SQL statement, allowing medium privilege users (contributor+) to perform Blind SQL Injection attacks | 4.0 |
31 Low Vulnerabilities
DATE | CVE | VENDOR | VULNERABILITY | CVSS |
---|---|---|---|---|
2021-06-15 | CVE-2021-3592 | Libslirp Project Redhat Debian Fedoraproject | Access of Uninitialized Pointer vulnerability in multiple products An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. | 3.8 |
2021-06-15 | CVE-2021-3593 | Libslirp Project Redhat Fedoraproject Debian | Access of Uninitialized Pointer vulnerability in multiple products An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. | 3.8 |
2021-06-15 | CVE-2021-3594 | Libslirp Project Redhat Debian Fedoraproject | Access of Uninitialized Pointer vulnerability in multiple products An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. | 3.8 |
2021-06-15 | CVE-2021-3595 | Libslirp Project Redhat Debian Fedoraproject | Access of Uninitialized Pointer vulnerability in multiple products An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. | 3.8 |
2021-06-17 | CVE-2021-29706 | IBM | Unspecified vulnerability in IBM AIX 7.1.0 IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or cause a denial of service. | 3.6 |
2021-06-18 | CVE-2021-26834 | Znote | Cross-site Scripting vulnerability in Znote 0.5.2 A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. | 3.5 |
2021-06-18 | CVE-2021-34815 | Checksec | Cross-site Scripting vulnerability in Checksec Canopy CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter. | 3.5 |
2021-06-18 | CVE-2021-33347 | Jpress | Cross-site Scripting vulnerability in Jpress 1.0/1.0.4 An issue was discovered in JPress v3.3.0 and below. | 3.5 |
2021-06-17 | CVE-2021-32681 | Torchbox | Cross-site Scripting vulnerability in Torchbox Wagtail Wagtail is an open source content management system built on Django. | 3.5 |
2021-06-17 | CVE-2020-19202 | Ipfire | Cross-site Scripting vulnerability in Ipfire 2.21 An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TITLE" parameter in IPFire 2.21 (x86_64) - Core Update 130. | 3.5 |
2021-06-17 | CVE-2021-31521 | Trendmicro | Cross-site Scripting vulnerability in Trendmicro Interscan web Security Virtual Appliance 6.5 Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal. | 3.5 |
2021-06-16 | CVE-2021-32244 | Moodle | Cross-site Scripting vulnerability in Moodle 3.10.3 Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. | 3.5 |
2021-06-16 | CVE-2021-32245 | Pagekit | Cross-site Scripting vulnerability in Pagekit 1.0.18 In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. | 3.5 |
2021-06-16 | CVE-2021-32659 | Matrix | Missing Authentication for Critical Function vulnerability in Matrix Matrix-Appservice-Bridge Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. | 3.5 |
2021-06-16 | CVE-2021-20488 | IBM | Unspecified vulnerability in IBM Security Identity Manager 6.0.2 IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity Manager Windows Password Synch Plug-in is deployed and configured. | 3.5 |
2021-06-16 | CVE-2020-35761 | Bloofox | Cross-site Scripting vulnerability in Bloofox Bloofoxcms 0.5.2.1 bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code. | 3.5 |
2021-06-16 | CVE-2021-27479 | Zoll | Cross-site Scripting vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privilege users. | 3.5 |
2021-06-14 | CVE-2021-27887 | Hitachiabb Powergrids | Cross-site Scripting vulnerability in Hitachiabb-Powergrids Ellipse Asset Performance Management Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. | 3.5 |
2021-06-14 | CVE-2021-24346 | Stock IN OUT Project | Cross-site Scripting vulnerability in & OUT The Stock in & out WordPress plugin through 1.0.4 has a search functionality, the lowest accessible level to it being contributor. | 3.5 |
2021-06-14 | CVE-2021-24382 | Nextendweb | Cross-site Scripting vulnerability in Nextendweb Smart Slider The Smart Slider 3 Free and pro WordPress plugins before 3.5.0.9 did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. | 3.5 |
2021-06-18 | CVE-2020-18442 | Zziplib Project Debian Fedoraproject | Infinite Loop vulnerability in multiple products Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function "unzzip_cat_file". | 3.3 |
2021-06-17 | CVE-2021-32695 | Nextcloud | Unspecified vulnerability in Nextcloud Nextcloud Android app is the Android client for Nextcloud. | 3.3 |
2021-06-17 | CVE-2021-32575 | Hashicorp | Unspecified vulnerability in Hashicorp Nomad HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. | 3.3 |
2021-06-16 | CVE-2020-8299 | Citrix | Resource Exhaustion vulnerability in Citrix products Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix SD-WAN WANOP Edition before 11.4.0, 11.3.2, 11.3.1a, 11.2.3a, 11.1.2c, 10.2.9a suffers from uncontrolled resource consumption by way of a network-based denial-of-service from within the same Layer 2 network segment. | 3.3 |
2021-06-15 | CVE-2021-31498 | Opentext | Out-of-bounds Read vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. | 3.3 |
2021-06-15 | CVE-2021-31501 | Opentext | Out-of-bounds Read vulnerability in Opentext Brava! Desktop 16.6.3.84 This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop 16.6.3.84. | 3.3 |
2021-06-16 | CVE-2021-20567 | IBM | Missing Encryption of Sensitive Data vulnerability in IBM Resilient Security Orchestration Automation and Response 38.0 IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IBM X-Force ID: 199239. | 2.1 |
2021-06-16 | CVE-2021-27481 | Zoll | Use of Hard-coded Credentials vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcoded. | 2.1 |
2021-06-16 | CVE-2021-27487 | Zoll | Cleartext Storage of Sensitive Information vulnerability in Zoll Defibrillator Dashboard ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. | 2.1 |
2021-06-15 | CVE-2021-28858 | TP Link | Cleartext Storage of Sensitive Information vulnerability in Tp-Link Tl-Wpa4220 Firmware 4.0.2 TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. | 2.1 |
2021-06-16 | CVE-2021-32033 | Protectimus | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Protectimus Slim NFC 70 Firmware 10.01 Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. | 1.9 |