CVEs published May 7, 2021
105 CVEs were published on May 7, 2021: 1 critical, 35 high. 3 are now in CISA KEV.
- Published
- 105
- Critical
- 1
- High
- 35
- Medium
- 16
- Low
- 12
- Unrated
- 41
- Now in CISA KEV
- 3
- Fix available
- 9
Most affected products
- Foxit Reader
- 32
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 17
- SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- 5
- Atlassian Confluence Server
- 2
- Jun-He Technology ERP POS
- 2
- Jun-He Technology Quan-Fang-Wei-Tong-Xun system
- 2
- localstack
- 2
- avahi
- 1
- craftcms/cms
- 1
- eventlet
- 1
Critical 1
High 35
- CVE-2021-29499Predictable SIF UUID Identifierssylabs sif · github.com/sylabs/sif
- CVE-2021-31472This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31470This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31468This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31466This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31465This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31461This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31460This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31459This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31458This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31457This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31456This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31454This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31455This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31453This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31452This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31451This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31449This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31450This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31442This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31441This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-1927Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1915Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, SnapdragoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1925Possible denial of service scenario due to improper handling of group management action frame in Snapdragon Auto, Snapdragon Compute, SnapdrQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1910Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1905Possible use after free due to improper handling of memory mapping of multiple processes simultaneously.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1891A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11289Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute, SnapdragoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11288Out of bound write can occur in playready while processing command due to lack of input validation in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11284Locked memory can be unlocked and modified by non secure boot loader through improper system call sequence making the memory region untrusteQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon In…
- CVE-2020-11285Buffer over-read while unpacking the RTCP packet we may read extra byte if wrong length is provided in RTCP packets in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11279Memory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, SnapdragonQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11273Histogram type KPI was teardown with the assumption of the existence of histogram binning info and will lead to null pointer access when hisQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11274Denial of service in MODEM due to assert to the invalid configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11268Potential UE reset while decoding a crafted Sib1 or SIB1 that schedules unsupported SIBs and can lead to denial of service in Snapdragon AutQualcomm Snapdragon Auto, Snapdragon Mobile
Medium, low and unrated 69
- CVE-2021-31757An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.
- CVE-2021-31758An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.
- CVE-2021-31756An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.
- CVE-2021-31471This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31469This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31467This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31463This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31464This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31462This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31448This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31447This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31446This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31445This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31444This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-31443This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 10.1.1.37576.Foxit Reader
- CVE-2021-32470Craft CMS before 3.6.13 has an XSS vulnerability.craftcms/cms
- CVE-2021-27574An issue was discovered in Emote Remote Mouse through 4.0.0.0.
- CVE-2021-27573An issue was discovered in Emote Remote Mouse through 4.0.0.0.
- CVE-2021-27572An issue was discovered in Emote Remote Mouse through 4.0.0.0.
- CVE-2021-27571An issue was discovered in Emote Remote Mouse through 4.0.0.0.
- CVE-2021-27570An issue was discovered in Emote Remote Mouse through 3.015.
- CVE-2021-27569An issue was discovered in Emote Remote Mouse through 4.0.0.0.
- CVE-2020-4901IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on the network to obtain sensitive information or causeIBM Robotic Process Automation with Automation Anywhere
- CVE-2021-29495Nim stdlib httpClient does not validate peer certificates by defaultnim-lang security
- CVE-2021-22677An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-servSimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- CVE-2021-29488Creation of files outside the Download Folder through malicious PAR2 filessabnzbd
- CVE-2021-27437The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard.WISE-PaaS/RMM
- CVE-2021-21419Improper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventleteventlet
- CVE-2021-22673The affected product is vulnerable to stack-based buffer overflow while processing over-the-air firmware updates from the CDN server, which SimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- CVE-2021-22671Multiple integer overflow issues exist while processing long domain names, which may allow an attacker to remotely execute code on the SimplSimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- CVE-2021-22679The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute codSimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- CVE-2021-22675The affected product is vulnerable to integer overflow while parsing malformed over-the-air firmware update files, which may allow an attackSimpleLink Wi-Fi, MSP432, CC13XX, CC26XX, CC32XX, CC3100
- CVE-2021-3502A flaw was found in avahi 0.8-5.avahi
- CVE-2020-14009Proofpoint Enterprise Protection (PPS/PoD) before 8.16.4 contains a vulnerability that could allow an attacker to deliver an email message w
- CVE-2021-21984VMware vRealize Business for Cloud 7.x prior to 7.6.0 contains a remote code execution vulnerability due to an unauthorised end point.VMware vRealize Business for Cloud
- CVE-2021-26123LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
- CVE-2021-26122LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
- CVE-2020-36124Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection.
- CVE-2020-36125Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive ope
- CVE-2020-36126Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation
- CVE-2020-36127Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability.
- CVE-2020-36128Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability.
- CVE-2021-30173Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Local File InclusionJun-He Technology Quan-Fang-Wei-Tong-Xun system
- CVE-2021-30172Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSSJun-He Technology Quan-Fang-Wei-Tong-Xun system
- CVE-2021-30171Jun-He Technology Ltd. ERP POS - Stored XSS-2Jun-He Technology ERP POS
- CVE-2021-30170Jun-He Technology Ltd. ERP POS - Stored XSS-1Jun-He Technology ERP POS
- CVE-2021-1906Improper handling of address deregistration on failure can lead to new GPU address allocation failure.Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1895Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, SnapdrQualcomm Snapdragon Consumer IOT, Snapdragon Industrial IOT…
- CVE-2020-11295Use after free in camera If the threadmanager is being cleaned up while the worker thread is processing objects in Snapdragon Auto, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11294Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11293Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length received in SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-11254Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto,Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2020-29445Affected versions of Confluence Server before 7.4.8, and versions from 7.5.0 before 7.11.0 allow attackers to identify internal hosts and poAtlassian Confluence Server
- CVE-2020-29444Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross SitAtlassian Confluence Server
- CVE-2021-32074HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a mult
- CVE-2021-32090The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.localstack
- CVE-2021-32091A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.localstack
- CVE-2021-32092A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S.
- CVE-2021-32093The ConfigFileAction component of U.S.
- CVE-2021-32094U.S.
- CVE-2021-32095U.S.
- CVE-2021-32096The ConsoleAction component of U.S.
- CVE-2021-32098Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
- CVE-2021-32099A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u
- CVE-2021-32100A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.
- CVE-2021-32101The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php.
- CVE-2021-32102A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
- CVE-2021-32103A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject
- CVE-2021-32104A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.