CVEs published May 13, 2021
63 CVEs were published on May 13, 2021: 4 critical, 4 high. 1 is now in CISA KEV.
- Published
- 63
- Critical
- 4
- High
- 4
- Medium
- 11
- Low
- 5
- Unrated
- 39
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- WAGO 0852-0303 · WAGO 0852-1305 +3
- 6
- AMD SEV/SEV-ES
- 2
- Elastic Kibana
- 2
- Elasticsearch · org.elasticsearch:elasticsearch
- 2
- openjpeg
- 2
- qemu
- 2
- aurelia-framework
- 1
- Beckhoff TwinCAT OPC UA Server · Beckhoff IPC Diagnostic… +1
- 1
- c-ares
- 1
- Elastic App Search
- 1
Critical 4
- CVE-2021-33026The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local prflask-caching
- CVE-2021-20999WEIDMUELLER: Accidentally open network port in u-controls and IoT-GatewaysWeidmüller UC20-WL2000-AC · Weidmüller UC20-WL2000-IOT +2
- CVE-2021-20998WAGO: Managed Switches: Unauthorized creation of user accountsWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2021-28799Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)QNAP Systems HBS
High 4
- CVE-2021-20997WAGO: Managed Switches: Unauthorized access to password hashesWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2021-20994WAGO: Managed Switches: Reflected Cross-site ScriptingWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2021-20988Hilscher rcX RTOS: Wrong handling of the UDP checksumHilscher rcX RTOS · Pepperl+Fuchs Ethernet IO Modules IC… +1
- CVE-2020-36197Improper Access Control Vulnerability in Music StationQNAP Systems Music Station
Medium, low and unrated 55
- CVE-2021-32615Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.
- CVE-2021-31876Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes it easier for attacke
- CVE-2019-10062The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS.aurelia-framework
- CVE-2020-23996A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code
- CVE-2020-23995An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data
- CVE-2021-23910An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.
- CVE-2021-23909An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.
- CVE-2021-23908An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.
- CVE-2021-23907An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.
- CVE-2021-27413Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, whicOmron CX-One
- CVE-2021-23906An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021.
- CVE-2021-29510Use of "infinity" as an input to datetime and date fields causes infinite loop in pydanticsamuelcolvin pydantic · pydantic
- CVE-2021-29506Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.graphhopper · com.graphhopper:graphhopper-nav
- CVE-2021-32925admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.
- CVE-2021-22140Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the App Search web crawleElastic App Search
- CVE-2021-22138In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature.Elasticsearch
- CVE-2021-22139Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack of timeout or a limitElastic Kibana
- CVE-2021-22137In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2021-22135Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2021-22136In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout settinElastic Kibana
- CVE-2021-20221An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0oqemu
- CVE-2021-20535IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF).IBM Jazz Reporting Service
- CVE-2021-20181A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0.qemu
- CVE-2021-32921An issue was discovered in Prosody before 0.11.9.
- CVE-2021-32920Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.
- CVE-2021-32919An issue was discovered in Prosody before 0.11.9.
- CVE-2021-32918An issue was discovered in Prosody before 0.11.9.
- CVE-2021-32917An issue was discovered in Prosody before 0.11.9.
- CVE-2021-20025SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password that is used at iniSonicWall Email Security Virtual Appliance
- CVE-2020-21342Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.
- CVE-2021-3528A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core NooBaa
- CVE-2020-25713A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_common.raptor2
- CVE-2020-27830A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio_synth without checkkernel
- CVE-2020-28063A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.
- CVE-2020-20092File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type to image/jpeg and pla
- CVE-2020-27823A flaw was found in OpenJPEG’s encoder.openjpeg
- CVE-2020-27824A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function.openjpeg
- CVE-2021-20996WAGO: Managed Switches: Unsecure Cookie settingsWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2021-20995WAGO: Managed Switches: Storage of user credentials in a cookieWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2021-20993WAGO: Managed Switches: Exposure of sensitive information through directory listingWAGO 0852-0303 · WAGO 0852-1305 +3
- CVE-2020-12526BECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA ServerBeckhoff TwinCAT OPC UA Server · Beckhoff IPC Diagnostic… +1
- CVE-2020-14354A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing.c-ares
- CVE-2021-20250A flaw was found in wildfly.wildfly · org.jboss:jboss-ejb-client
- CVE-2021-25693An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer dereference.
- CVE-2021-25694Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll.
- CVE-2021-26311AMD Secure Encrypted VirtualizationAMD SEV/SEV-ES
- CVE-2020-12967AMD Secure Encrypted VirtualizationAMD SEV/SEV-ES
- CVE-2021-22154An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1
- CVE-2021-22153A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a
- CVE-2021-22152A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1
- CVE-2021-20331MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an applicationMongoDB C# Driver · mongodb.driver
- CVE-2021-31215SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlu
- CVE-2020-36198Command Injection Vulnerability in Malware RemoverQNAP Systems Malware Remover
- CVE-2021-21424Prevent user enumeration using Guard or the new Authenticator-based Securitysymfony · symfony/security +6
- CVE-2021-29623Uninitialized variable bug in Exiv2exiv2