CVEs published May 6, 2021
103 CVEs were published on May 6, 2021: 9 critical, 18 high. 3 are now in CISA KEV.
- Published
- 103
- Critical
- 9
- High
- 18
- Medium
- 24
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 3
- Fix available
- 11
Most affected products
- Cisco SD-WAN vManage
- 10
- Cisco AnyConnect Secure Mobility Client
- 7
- GitLab
- 4
- Cisco HyperFlex HX Data Platform
- 3
- Cisco SD-WAN Solution
- 3
- Cisco SD-WAN vEdge router
- 3
- Cisco Business Wireless Access Point Software
- 2
- Cisco Unified Communications Manager IM and Presence Service
- 2
- Cisco Web Security Appliance
- 2
- Dell PowerScale OneFS
- 2
Critical 9
- CVE-2021-32030The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio
- CVE-2021-20204A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databasgetdata
- CVE-2021-1275Cisco SD-WAN vManage Software VulnerabilitiesCisco SD-WAN vManage
- CVE-2021-1508Cisco SD-WAN vManage Software VulnerabilitiesCisco SD-WAN vManage
- CVE-2021-1506Cisco SD-WAN vManage Software VulnerabilitiesCisco SD-WAN vManage
- CVE-2021-1505Cisco SD-WAN vManage Software VulnerabilitiesCisco SD-WAN vManage
- CVE-2021-1498Cisco HyperFlex HX Command Injection VulnerabilitiesCisco HyperFlex HX Data Platform
- CVE-2021-1497Cisco HyperFlex HX Command Injection VulnerabilitiesCisco HyperFlex HX Data Platform
- CVE-2021-1468Cisco SD-WAN vManage Software VulnerabilitiesCisco SD-WAN vManage
High 18
- CVE-2021-22209An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8.GitLab
- CVE-2021-1513Cisco SD-WAN Software vDaemon Denial of Service VulnerabilityCisco SD-WAN Solution
- CVE-2021-1284Cisco SD-WAN vManage Software Authentication Bypass VulnerabilityCisco SD-WAN vManage
- CVE-2021-1363Cisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilitiesCisco Unified Communications Manager IM and Presence Service
- CVE-2021-1365Cisco Unified Communications Manager IM & Presence Service SQL Injection VulnerabilitiesCisco Unified Communications Manager IM and Presence Service
- CVE-2021-1400Cisco Small Business 100, 300, and 500 Series Wireless Access Points VulnerabilitiesCisco Business Wireless Access Point Software
- CVE-2021-1401Cisco Small Business 100, 300, and 500 Series Wireless Access Points VulnerabilitiesCisco Business Wireless Access Point Software
- CVE-2021-1421Cisco Enterprise NFV Infrastructure Software Command Injection VulnerabilityCisco Enterprise NFV Infrastructure Software
- CVE-2021-1426Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-1427Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-1511Cisco SD-WAN vEdge Software Buffer Overflow VulnerabilitiesCisco SD-WAN vEdge router
- CVE-2021-1510Cisco SD-WAN vEdge Software Buffer Overflow VulnerabilitiesCisco SD-WAN vEdge router
- CVE-2021-1509Cisco SD-WAN vEdge Software Buffer Overflow VulnerabilitiesCisco SD-WAN vEdge router
- CVE-2021-1496Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-1429Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-1430Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-1428Cisco AnyConnect Secure Mobility Client for Windows DLL and Executable Hijacking VulnerabilitiesCisco AnyConnect Secure Mobility Client
- CVE-2021-21505Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account.Dell EMC Integrated System for Microsoft Azure Stack Hub
Medium, low and unrated 76
- CVE-2021-32077Primary Source Verification in VerityStream MSOW Solutions before 3.1.1 allows an anonymous internet user to discover Social Security Number
- CVE-2020-23264Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.forkcms/forkcms
- CVE-2020-23263Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the forkcms/forkcms
- CVE-2021-27941Unconstrained Web access to the device's private encryption key in the QR code pairing mode in the eWeLink mobile application (through 4.9.2
- CVE-2021-29203A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure ManagemenHPE Edgeline Infrastructure Management Software
- CVE-2021-31737emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php.
- CVE-2021-29493Kennnyshiwa-cogs vulnerable to Remote Code Execution in Tickets Modulekennnyshiwa-cogs
- CVE-2021-28665Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive c
- CVE-2020-28198The 'id' parameter of IBM Tivoli Storage Manager Version 5 Release 2 (Command Line Administrative Interface, dsmadmc.exe) is vulnerable to a
- CVE-2021-31828An SSRF issue in Open Distro for Elasticsearch (ODFE) before 1.13.1.0 allows an existing privileged user to enumerate listening services or
- CVE-2020-18888Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php.
- CVE-2020-18890Rmote Code Execution (RCE) vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via
- CVE-2020-18889Cross Site Request Forgery (CSRF) vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php.
- CVE-2021-31793An issue exists on NightOwl WDB-20-V2 WDB-20-V2_20190314 devices that allows an unauthenticated user to gain access to snapshots and video s
- CVE-2019-25043ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process cr
- CVE-2021-31918A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1.tripleo-ansible
- CVE-2021-31916An out-of-bounds (OOB) memory write flaw was found in list_devices in drivers/md/dm-ioctl.c in the Multi-device driver module in the Linux kkernel
- CVE-2021-32052In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs django
- CVE-2021-31829kernel/bpf/verifier.c in the Linux kernel through 5.12.1 performs undesirable speculative loads, leading to disclosure of stack content via
- CVE-2021-3507A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including).QEMU
- CVE-2021-28149Hongdian H8922 3.0.5 devices allow Directory Traversal.
- CVE-2021-28150Hongdian H8922 3.0.5 devices allow the unprivileged guest user to read cli.conf (with the administrator password and other sensitive data) v
- CVE-2021-28152Hongdian H8922 3.0.5 devices have an undocumented feature that allows access to a shell as a superuser.
- CVE-2021-28151Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cg
- CVE-2020-35519An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5.kernel
- CVE-2021-28128In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password.strapi
- CVE-2021-22208An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7.GitLab
- CVE-2021-22206An issue has been discovered in GitLab affecting all versions starting from 11.6.GitLab
- CVE-2021-22210An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2.GitLab
- CVE-2021-1535Cisco SD-WAN vManage Information Disclosure VulnerabilityCisco SD-WAN vManage
- CVE-2021-1532Cisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Read VulnerabilityCisco TelePresence Endpoint Software
- CVE-2021-1530Cisco BroadWorks Messaging Server XML External Entity Injection VulnerabilityCisco BroadWorks
- CVE-2021-1521Cisco Video Surveillance 8000 Series IP Cameras Cisco Discovery Protocol Denial of Service VulnerabilityCisco Video Surveillance 8000 Series IP Cameras
- CVE-2021-1520Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2021-1519Cisco AnyConnect Secure Mobility Client Profile Modification VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-1516Cisco Content Security Management Appliance, Email Security Appliance, and Web Security Appliance Information Disclosure VulnerabilityCisco Web Security Appliance
- CVE-2021-1515Cisco SD-WAN vManage Information Disclosure VulnerabilityCisco SD-WAN vManage
- CVE-2021-1514Cisco SD-WAN Software Privilege Escalation VulnerabilityCisco SD-WAN Solution
- CVE-2021-1397Cisco Integrated Management Controller Open Redirect VulnerabilityCisco Unified Computing System
- CVE-2021-1512Cisco SD-WAN Software Arbitrary File Corruption VulnerabilityCisco SD-WAN Solution
- CVE-2021-1507Cisco SD-WAN vManage API Stored Cross-Site Scripting VulnerabilityCisco SD-WAN vManage
- CVE-2021-1499Cisco HyperFlex HX Data Platform File Upload VulnerabilityCisco HyperFlex HX Data Platform
- CVE-2021-1490Cisco Web Security Appliance Cross-Site Scripting VulnerabilityCisco Web Security Appliance
- CVE-2021-1486Cisco SD-WAN vManage HTTP Authentication User Enumeration VulnerabilityCisco SD-WAN vManage
- CVE-2021-1478Cisco Unified Communications Manager Denial of Service VulnerabilityCisco Unified Communications Manager
- CVE-2021-1447Cisco Content Security Management Appliance Privilege Escalation VulnerabilityCisco Content Security Management Appliance
- CVE-2021-1438Cisco Wide Area Application Services Software Information Disclosure VulnerabilityCisco Wide Area Application Services
- CVE-2021-21550Dell EMC PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability.Dell PowerScale OneFS
- CVE-2021-21527Dell PowerScale OneFS 8.1.0-9.1.0 contain an improper neutralization of special elements used in an OS command vulnerability.Dell PowerScale OneFS
- CVE-2021-26543The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability.git-parse
- CVE-2021-31245omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier compares the user provided password with the original password in a length depe
- CVE-2021-31616Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.1.0 allow a stack buffer overflow via crafted message
- CVE-2021-31532NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x
- CVE-2021-27216Exim 4 before 4.94.2 has Execution with Unnecessary Privileges.
- CVE-2020-28026Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Noti
- CVE-2020-28025Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len an
- CVE-2020-28024Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp
- CVE-2020-28023Exim 4 before 4.94.2 allows Out-of-bounds Read.
- CVE-2020-28022Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.
- CVE-2020-28021Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters.
- CVE-2020-28020Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by lev
- CVE-2020-28019Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.
- CVE-2020-28018Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.
- CVE-2020-28017Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients
- CVE-2020-28016Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.
- CVE-2020-28015Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters.
- CVE-2020-28014Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges.
- CVE-2020-28013Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege esc
- CVE-2020-28012Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks
- CVE-2020-28011Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S.
- CVE-2020-28010Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname
- CVE-2020-28009Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounde
- CVE-2020-28008Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges.
- CVE-2020-28007Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges.
- CVE-2021-29921In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.libpython · python +1
- CVE-2021-30473aom_image.c in libaom in AOMedia before 2021-04-07 frees memory that is not located on the heap.