# CVEs published 2021-06-24

103 CVEs were published on June 24, 2021: 2 critical, 11 high. Days are UTC.

- [CVE-2021-32717](https://cve.now/CVE-2021-32717.md): Private files publicly accessible with Cloud Storage providers (CVSS 7.5, shopware platform · shopware/platform +1)
- [CVE-2021-32716](https://cve.now/CVE-2021-32716.md): Internal hidden fields are visible on to many associations in admin api (CVSS 4.4, shopware platform · shopware/platform +1)
- [CVE-2021-32712](https://cve.now/CVE-2021-32712.md): Information leakage in Error Handler (CVSS 5.3, shopware · shopware/shopware)
- [CVE-2021-32713](https://cve.now/CVE-2021-32713.md): Authenticated Stored XSS (CVSS 4.8, shopware · shopware/shopware)
- [CVE-2021-32711](https://cve.now/CVE-2021-32711.md): Leak of information via Store-API (CVSS 9.1, shopware platform · shopware/platform)
- [CVE-2021-32710](https://cve.now/CVE-2021-32710.md): Potential Session Hijacking in Shopware (CVSS 5.9, shopware platform · shopware/platform)
- [CVE-2021-35448](https://cve.now/CVE-2021-35448.md): Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image… (no CVSS)
- [CVE-2020-17752](https://cve.now/CVE-2020-17752.md): Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart… (no CVSS)
- [CVE-2020-17753](https://cve.now/CVE-2020-17753.md): An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer… (no CVSS)
- [CVE-2020-17759](https://cve.now/CVE-2020-17759.md): An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. (no CVSS)
- [CVE-2021-32709](https://cve.now/CVE-2021-32709.md): Creation of order credits was not validated by acl in admin orders (CVSS 4.9, shopware platform · shopware/platform +1)
- [CVE-2021-29777](https://cve.now/CVE-2021-29777.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table… (CVSS 5.3, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-29703](https://cve.now/CVE-2021-29703.md): Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally… (CVSS 7.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-20579](https://cve.now/CVE-2021-20579.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view… (CVSS 5.9, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2020-4945](https://cve.now/CVE-2020-4945.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due… (CVSS 6.5, IBM DB2 for Linux and UNIX)
- [CVE-2020-4885](https://cve.now/CVE-2020-4885.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of… (CVSS 6.2, IBM DB2 for Linux and UNIX)
- [CVE-2021-32493](https://cve.now/CVE-2021-32493.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-32492](https://cve.now/CVE-2021-32492.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-32490](https://cve.now/CVE-2021-32490.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2020-18671](https://cve.now/CVE-2020-18671.md): Cross Site Scripting (XSS) vulnerability in Roundcube Mail \<=1.4.4 via smtp config in /installer/test.php. (no CVSS)
- [CVE-2021-32491](https://cve.now/CVE-2021-32491.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2020-18670](https://cve.now/CVE-2020-18670.md): Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php. (no CVSS)
- [CVE-2021-3500](https://cve.now/CVE-2021-3500.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-33002](https://cve.now/CVE-2021-33002.md): Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. (no CVSS, WebAccess HMI Designer)
- [CVE-2020-18668](https://cve.now/CVE-2020-18668.md): Cross Site Scripting (XSS) vulnerabililty in WebPort \<=1.19.1 via the description parameter to script/listcalls. (no CVSS)
- [CVE-2021-33004](https://cve.now/CVE-2021-33004.md): The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow… (no CVSS, WebAccess HMI Designer)
- [CVE-2021-33000](https://cve.now/CVE-2021-33000.md): Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code… (no CVSS, WebAccess HMI Designer)
- [CVE-2021-21574](https://cve.now/CVE-2021-21574.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21573](https://cve.now/CVE-2021-21573.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21572](https://cve.now/CVE-2021-21572.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21571](https://cve.now/CVE-2021-21571.md): Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate… (CVSS 5.9, Dell UEFI BIOS https stack)
- [CVE-2021-32708](https://cve.now/CVE-2021-32708.md): Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem (CVSS 9.8, thephpleague flysystem · league/flysystem)
- [CVE-2021-32704](https://cve.now/CVE-2021-32704.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core (CVSS 8.5, dhis2-core)
- [CVE-2020-18667](https://cve.now/CVE-2020-18667.md): SQL Injection vulnerability in WebPort \<=1.19.1 via the new connection, parameter name in type-conn. (no CVSS)
- [CVE-2020-18665](https://cve.now/CVE-2020-18665.md): Directory Traversal vulnerability in WebPort \<=1.19.1 in tags of system settings. (no CVSS)
- [CVE-2020-18664](https://cve.now/CVE-2020-18664.md): Cross Site Scripting (XSS) vulnerability in WebPort \<=1.19.1via the connection name parameter in type-conn. (no CVSS)
- [CVE-2020-21784](https://cve.now/CVE-2020-21784.md): phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. (no CVSS)
- [CVE-2020-21785](https://cve.now/CVE-2020-21785.md): In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability. (no CVSS)
- [CVE-2020-21786](https://cve.now/CVE-2020-21786.md): In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php. (no CVSS)
- [CVE-2020-21783](https://cve.now/CVE-2020-21783.md): In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody\[content\] parameter. (no CVSS)
- [CVE-2021-31649](https://cve.now/CVE-2021-31649.md): In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code… (no CVSS, com.jfinal:jfinal)
- [CVE-2020-18663](https://cve.now/CVE-2020-18663.md): Cross Site Scripting (XSS) vulnerability in gnuboard5 \<=v5.3.2.8 via the act parameter in bbs/move\_update.php. (no CVSS)
- [CVE-2021-33346](https://cve.now/CVE-2021-33346.md): There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. (no CVSS)
- [CVE-2020-18662](https://cve.now/CVE-2020-18662.md): SQL Injection vulnerability in gnuboard5 \<=v5.3.2.8 via the table\_prefix parameter in install\_db.php. (no CVSS)
- [CVE-2021-23398](https://cve.now/CVE-2021-23398.md): Cross-site Scripting (XSS) (CVSS 6.1, react-bootstrap-table)
- [CVE-2020-18661](https://cve.now/CVE-2020-18661.md): Cross Site Scripting (XSS) vulnerability in gnuboard5 \<=v5.3.2.8 via the url parameter to bbs/login.php. (no CVSS)
- [CVE-2020-21787](https://cve.now/CVE-2020-21787.md): CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. (no CVSS)
- [CVE-2020-21788](https://cve.now/CVE-2020-21788.md): In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). (no CVSS)
- [CVE-2021-33348](https://cve.now/CVE-2021-33348.md): An issue was discovered in JFinal framework v4.9.10 and below. (no CVSS, com.jfinal:jfinal)
- [CVE-2021-27659](https://cve.now/CVE-2021-27659.md): exacqVision Web Service CSS (CVSS 5.3, Johnson Controls exacqVision Web Service)
- [CVE-2021-27658](https://cve.now/CVE-2021-27658.md): exacqVision Enterprise Manager CSS (CVSS 4.3, Johnson Controls exacqVision Enterprise Manager)
- [CVE-2021-23991](https://cve.now/CVE-2021-23991.md): If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's… (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23992](https://cve.now/CVE-2021-23992.md): Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23993](https://cve.now/CVE-2021-23993.md): An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23994](https://cve.now/CVE-2021-23994.md): A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23995](https://cve.now/CVE-2021-23995.md): When Responsive Design Mode was enabled, it used references to objects that were previously freed. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23996](https://cve.now/CVE-2021-23996.md): By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a… (no CVSS, Mozilla Firefox)
- [CVE-2021-23997](https://cve.now/CVE-2021-23997.md): Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. (no CVSS, Mozilla Firefox)
- [CVE-2021-23998](https://cve.now/CVE-2021-23998.md): Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23999](https://cve.now/CVE-2021-23999.md): If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional… (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-24000](https://cve.now/CVE-2021-24000.md): A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they… (no CVSS, Mozilla Firefox)
- [CVE-2021-24001](https://cve.now/CVE-2021-24001.md): A compromised content process could have performed session history manipulations it should not have been able to due to testing… (no CVSS, Mozilla Firefox)
- [CVE-2021-24002](https://cve.now/CVE-2021-24002.md): When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such… (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29944](https://cve.now/CVE-2021-29944.md): Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. (no CVSS, Mozilla Firefox)
- [CVE-2021-29945](https://cve.now/CVE-2021-29945.md): The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29946](https://cve.now/CVE-2021-29946.md): Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when… (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29947](https://cve.now/CVE-2021-29947.md): Mozilla developers and community members reported memory safety bugs present in Firefox 87. (no CVSS, Mozilla Firefox)
- [CVE-2021-29948](https://cve.now/CVE-2021-29948.md): Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local… (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29949](https://cve.now/CVE-2021-29949.md): When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a… (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29950](https://cve.now/CVE-2021-29950.md): Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29951](https://cve.now/CVE-2021-29951.md): The Mozilla Maintenance Service granted SERVICE\_START access to BUILTIN|Users which, in a domain network, grants normal remote users… (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29952](https://cve.now/CVE-2021-29952.md): When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort… (no CVSS, Mozilla Firefox)
- [CVE-2021-29953](https://cve.now/CVE-2021-29953.md): A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another… (no CVSS, Mozilla Firefox)
- [CVE-2021-29954](https://cve.now/CVE-2021-29954.md): Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. (no CVSS, Mozilla Hubs Cloud)
- [CVE-2021-29955](https://cve.now/CVE-2021-29955.md): A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses… (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2021-29956](https://cve.now/CVE-2021-29956.md): OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local… (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29957](https://cve.now/CVE-2021-29957.md): If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part… (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29958](https://cve.now/CVE-2021-29958.md): When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode… (no CVSS, Mozilla Firefox for iOS)
- [CVE-2021-29959](https://cve.now/CVE-2021-29959.md): When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website… (no CVSS, Mozilla Firefox)
- [CVE-2021-29960](https://cve.now/CVE-2021-29960.md): Firefox used to cache the last filename used for printing a file. (no CVSS, Mozilla Firefox)
- [CVE-2021-29961](https://cve.now/CVE-2021-29961.md): When styling and rendering an oversized \`\<select\>\` element, Firefox did not apply correct clipping which allowed an attacker to paint over… (no CVSS, Mozilla Firefox)
- [CVE-2021-29962](https://cve.now/CVE-2021-29962.md): Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. (no CVSS, Mozilla Firefox)
- [CVE-2021-29963](https://cve.now/CVE-2021-29963.md): Address bar search suggestions in private browsing mode were re-using session data from normal mode. (no CVSS, Mozilla Firefox)
- [CVE-2021-29964](https://cve.now/CVE-2021-29964.md): A locally-installed hostile program could send \`WM\_COPYDATA\` messages that Firefox would process incorrectly, leading to an out-of-bounds… (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29965](https://cve.now/CVE-2021-29965.md): A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords… (no CVSS, Mozilla Firefox)
- [CVE-2021-29966](https://cve.now/CVE-2021-29966.md): Mozilla developers reported memory safety bugs present in Firefox 88. (no CVSS, Mozilla Firefox)
- [CVE-2021-29967](https://cve.now/CVE-2021-29967.md): Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29968](https://cve.now/CVE-2021-29968.md): When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. (no CVSS, Mozilla Firefox)
- [CVE-2020-28097](https://cve.now/CVE-2020-28097.md): The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. (no CVSS)
- [CVE-2021-31412](https://cve.now/CVE-2021-31412.md): Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 (CVSS 5.3, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-33604](https://cve.now/CVE-2021-33604.md): Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 (CVSS 2.5, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-26585](https://cve.now/CVE-2021-26585.md): A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of… (no CVSS, HPE OneView Global Dashboard)
- [CVE-2021-25923](https://cve.now/CVE-2021-25923.md): In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. (no CVSS, openemr)
- [CVE-2021-21737](https://cve.now/CVE-2021-21737.md): A smart STB product of ZTE is impacted by a permission and access control vulnerability. (no CVSS, ZXV10 B860H)
- [CVE-2020-7862](https://cve.now/CVE-2020-7862.md): HelpU Overflow Vulnerability (CVSS 7.0, HelpuViewer.exe · HelpuServer.exe +2)
- [CVE-2021-25656](https://cve.now/CVE-2021-25656.md): Avaya Aura Experience Portal XSS vulnerabilities (CVSS 5.3, Avaya Product)
- [CVE-2021-25655](https://cve.now/CVE-2021-25655.md): URL redirection to untrusted site possible in Avaya Aura Experience Portal (CVSS 4.4, Avaya Experience Portal)
- [CVE-2021-25653](https://cve.now/CVE-2021-25653.md): Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation Vulnerability (CVSS 8.0, Avaya Aura Appliance Virtualization Platform Utilities)
- [CVE-2021-25652](https://cve.now/CVE-2021-25652.md): Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability (CVSS 4.9, Avaya Aura Appliance Virtualization Platform Utilities)
- [CVE-2021-25651](https://cve.now/CVE-2021-25651.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 8.0, Avaya Aura Utility Services)
- [CVE-2021-25650](https://cve.now/CVE-2021-25650.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 7.7, Avaya Aura Utility Services)
- [CVE-2021-25649](https://cve.now/CVE-2021-25649.md): Avaya Utility Services Sensitive Information Disclosure Vulnerability (CVSS 4.9, Avaya Aura Utility Services)
- [CVE-2021-28800](https://cve.now/CVE-2021-28800.md): Command Injection Vulnerability in QTS (CVSS 8.1, QNAP Systems QTS · QNAP Systems QuTS hero +1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.