CVEs published May 11, 2021
141 CVEs were published on May 11, 2021: 3 critical, 40 high. 2 are now in CISA KEV.
- Published
- 141
- Critical
- 3
- High
- 40
- Medium
- 28
- Low
- 2
- Unrated
- 68
- Now in CISA KEV
- 2
- Fix available
- 71
Most affected products
- Microsoft Windows
- 21
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 7
- Microsoft Office · Microsoft 365 Apps for Enterprise +1
- 6
- OpenClinic GA
- 5
- ImageMagick
- 4
- IBM OpenPages GRC Platform
- 2
- Jenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- 2
- Jenkins project Jenkins S3 publisher Plugin · org.jenkins-c…
- 2
- Jenkins project Jenkins Xray - Test Management for Jira Plu…
- 2
- Microsoft Exchange Server 2019 Cumulative Update · Micro… +1
- 2
Critical 3
High 40
- CVE-2021-31214Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-31936Microsoft Accessibility Insights for Web Information Disclosure VulnerabilityMicrosoft Accessibility Insights for Web
- CVE-2021-31213Visual Studio Code Remote Containers Extension Remote Code Execution VulnerabilityMicrosoft Visual Studio Code Remote - Containers Extension
- CVE-2021-31211Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-31208Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31204.NET and Visual Studio Elevation of Privilege VulnerabilityMicrosoft .NET Core · Microsoft .NET +3
- CVE-2021-31198Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2021-31200Common Utilities Remote Code Execution VulnerabilityMicrosoft common_utils.py
- CVE-2021-31194OLE Automation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-31192Windows Media Foundation Core Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-31193Windows SSDP Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31188Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31190Windows Container Isolation FS Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31187Windows WalletService Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31186Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-31181Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-31182Microsoft Bluetooth Driver Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-31180Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31179Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31177Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31175Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31176Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-31172Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-31169Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31170Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31168Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31167Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31165Windows Container Manager Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28478Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-28474Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-28465Web Media Extensions Remote Code Execution VulnerabilityMicrosoft Web Media Extensions
- CVE-2021-28455Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution VulnerabilityMicrosoft Access 2013 Service Pack · Microsoft Office +3
- CVE-2021-26422Skype for Business and Lync Remote Code Execution VulnerabilityMicrosoft Lync Server 2013 CU10 · Microsoft Skype for Bu… +1
- CVE-2021-27068Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2021-26419Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer
- CVE-2021-29509Keepalive Connections Causing Denial Of Service in pumapuma
- CVE-2021-27611SAP NetWeaver AS ABAP, versions - 700, 701, 702, 730, 731, allow a high privileged attacker to inject malicious code by executing an ABAP reSAP SE SAP NetWeaver AS ABAP
- CVE-2021-27613Under certain conditions, SAP Business One Chef cookbook, version - 9.2, 9.3, 10.0, used to install SAP Business One, allows an attacker to SAP SE SAP Business One
- CVE-2021-27614SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One on SAP HANA, allows an attaSAP SE SAP Business One,
- CVE-2021-27616Under certain conditions, SAP Business One Hana Chef Cookbook, versions - 8.82, 9.0, 9.1, 9.2, 9.3, 10.0, used to install SAP Business One fSAP SE SAP Business One,
Medium, low and unrated 98
- CVE-2021-20311A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero in sRGBTransformImage() in the MagickCore/colorspace.c mImageMagick
- CVE-2021-20310A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigImageMagick
- CVE-2021-3504A flaw was found in the hivex library in versions before 1.3.20.hivex
- CVE-2021-32605zzzcms zzzphp before 2.0.4 allows remote attackers to execute arbitrary OS commands by placing them in the keys parameter of a ?location=sea
- CVE-2021-32604Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS."
- CVE-2021-32089An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices.
- CVE-2020-26141An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H.
- CVE-2020-26142An issue was discovered in the kernel in OpenBSD 6.6.
- CVE-2020-26147An issue was discovered in the Linux kernel 5.8.9.
- CVE-2020-26146An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices.
- CVE-2020-26139An issue was discovered in the kernel in NetBSD 7.1.
- CVE-2020-26143An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH.
- CVE-2020-26145An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices.
- CVE-2020-26140An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H.
- CVE-2020-26144An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices.
- CVE-2021-31209Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Micro… +1
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-31205Windows SMB Client Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-31195Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2021-31191Windows Projected File System FS Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-31185Windows Desktop Bridge Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-31184Microsoft Windows Infrared Data Association (IrDA) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-31178Microsoft Office Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31174Microsoft Excel Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-31173Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-31171Microsoft SharePoint Information Disclosure VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-28479Windows CSC Service Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-28461Dynamics Finance and Operations Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 for Finance and Operations
- CVE-2021-26421Skype for Business and Lync Spoofing VulnerabilityMicrosoft Skype for Business Server 2015 CU11 · Microsoft L…
- CVE-2021-26418Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2020-18964Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote
- CVE-2021-32573The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options.
- CVE-2020-4536IBM OpenPages GRC Platform 8.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is retuIBM OpenPages GRC Platform
- CVE-2020-4535IBM OpenPages GRC Platform 8.1 is vulnerable to cross-site scripting.IBM OpenPages GRC Platform
- CVE-2021-29471Denial of service in Matrix Synapsematrix-org synapse · matrix-synapse
- CVE-2020-20265Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /ram/pckg/wireless/nova/bin/wireless proce
- CVE-2020-20267Mikrotik RouterOs before 6.47 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/resolver process.
- CVE-2021-27612In specific situations SAP GUI for Windows until and including 7.60 PL9, 7.70 PL0, forwards a user to specific malicious website which couldSAP SE SAP GUI for Windows
- CVE-2021-27617The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently valiSAP SE SAP Process Integration
- CVE-2021-27618The Integration Builder Framework of SAP Process Integration versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not check the file tySAP SE SAP Process Integration
- CVE-2021-27619SAP Commerce (Backoffice Search), versions - 1808, 1811, 1905, 2005, 2011, allows a low privileged user to search for attributes which are nSAP SE SAP Commerce
- CVE-2021-21655A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specifiJenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- CVE-2021-21656Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Xcode integration Plugin · org.jenk…
- CVE-2021-21654Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read perJenkins project Jenkins P4 Plugin · org.jenkins-ci.plugins:…
- CVE-2021-21652A cross-site request forgery (CSRF) vulnerability in Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier allows attackers to coJenkins project Jenkins Xray - Test Management for Jira Plu…
- CVE-2021-21653Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with OverJenkins project Jenkins Xray - Test Management for Jira Plu…
- CVE-2021-21651Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReadJenkins project Jenkins S3 publisher Plugin · org.jenkins-c…
- CVE-2021-21649Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-siteJenkins project Jenkins Dashboard View Plugin · org.jenkins…
- CVE-2021-21650Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, alJenkins project Jenkins S3 publisher Plugin · org.jenkins-c…
- CVE-2021-21648Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected crJenkins project Jenkins Credentials Plugin · org.jenkins-ci…
- CVE-2021-31537SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config, version, win, db, pwd, and user) and /r
- CVE-2021-32561OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.octoprint
- CVE-2021-32560The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.octoprint
- CVE-2021-21990VMware Workspace one UEM console (2102 prior to 21.2.0.8, 2101 prior to 21.1.0.14, 2011 prior to 20.11.0.27, 2010 prior to 20.10.0.16,2008 pVmware Workspace One UEM console
- CVE-2020-35438Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5.
- CVE-2021-31897In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.
- CVE-2021-31898In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.
- CVE-2021-30482In JetBrains UpSource before 2020.1.1883, application passwords were not revoked correctly
- CVE-2021-31915In JetBrains TeamCity before 2020.2.4, OS command injection leading to remote code execution was possible.
- CVE-2021-31914In JetBrains TeamCity before 2020.2.4 on Windows, arbitrary code execution on TeamCity Server was possible.
- CVE-2021-31913In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirect_uri were made during GitHub SSO token exchange.
- CVE-2021-31912In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.
- CVE-2021-31911In JetBrains TeamCity before 2020.2.3, reflected XSS was possible on several pages.
- CVE-2021-31910In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible.
- CVE-2021-31908In JetBrains TeamCity before 2020.2.3, stored XSS was possible on several pages.
- CVE-2021-31909In JetBrains TeamCity before 2020.2.3, argument injection leading to remote code execution was possible.
- CVE-2021-3315In JetBrains TeamCity before 2020.2.2, stored XSS on a tests page was possible.
- CVE-2021-31907In JetBrains TeamCity before 2020.2.2, permission checks for changing TeamCity plugins were implemented improperly.
- CVE-2021-31906In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file.
- CVE-2021-26309Information disclosure in the TeamCity plugin for IntelliJ before 2020.2.2.85899 was possible because a local temporary file had Insecure Pe
- CVE-2021-26310In the TeamCity IntelliJ plugin before 2020.2.2.85899, DoS was possible.
- CVE-2021-31904In JetBrains TeamCity before 2020.2.2, XSS was potentially possible on the test history page.
- CVE-2021-30005In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.
- CVE-2021-31905In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible.
- CVE-2021-31902In JetBrains YouTrack before 2020.6.6600, access control during the exporting of issues was implemented improperly.
- CVE-2021-31903In JetBrains YouTrack before 2021.1.9819, a pull request's title was sanitized insufficiently, leading to XSS.
- CVE-2021-27733In JetBrains YouTrack before 2020.6.6441, stored XSS was possible via an issue attachment.
- CVE-2021-31901In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group.
- CVE-2021-30504In JetBrains IntelliJ IDEA before 2021.1, DoS was possible because of unbounded resource allocation.
- CVE-2021-29263In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.
- CVE-2021-30006In IntelliJ IDEA before 2020.3.3, XXE was possible, leading to information disclosure.
- CVE-2021-31900In JetBrains Code With Me bundled to the compatible IDE versions before 2021.1, a client could open a browser on a host.
- CVE-2021-31899In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.
- CVE-2020-27246An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27245An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27244An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27243An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2020-27242An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application.OpenClinic GA
- CVE-2021-32544Intelligent global technology Ltd, igt+ - DOM-based Cross-Site ScriptingIntelligent global technology igt+
- CVE-2021-30174RiyaLab Co., Ltd. CloudISO - Stored XSSRiyaLab Co. CloudISO
- CVE-2020-24586The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that rece
- CVE-2020-24587The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all
- CVE-2020-24588The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that the
- CVE-2021-20309A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-efImagemMagick
- CVE-2021-20312A flaw was found in ImageMagick in versions 7.0.11, where an integer overflow in WriteTHUMBNAILImage of coders/thumbnail.c may trigger undefImageMagick
- CVE-2021-20313A flaw was found in ImageMagick in versions before 7.0.11.ImageMagick
- CVE-2021-32563An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2.
- CVE-2021-32606In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-f