CVEs published May 17, 2021
76 CVEs were published on May 17, 2021: 1 critical, 2 high.
- Published
- 76
- Critical
- 1
- High
- 2
- Medium
- 7
- Low
- 1
- Unrated
- 65
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- com.liferay.portal:release.portal.bom · com.liferay.portal:…
- 8
- SITEL CAP/PRX
- 4
- 404 SEO Redirection
- 2
- IBM Planning Analytics Local
- 2
- All 404 Redirect to Homepage
- 1
- Automattic WooCommerce · woocommerce/woocommerce
- 1
- BoostifyThemes Goto
- 1
- ceph
- 1
- Drupal Core · drupal/core +1
- 1
- exiv2
- 1
Critical 1
High 2
Medium, low and unrated 73
- CVE-2020-21831A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.
- CVE-2020-21844GNU LibreDWG 0.10 is affected by: memcpy-param-overlap.
- CVE-2020-24755In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory.
- CVE-2020-21843A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318.
- CVE-2020-18198Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the c
- CVE-2020-18195Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via th
- CVE-2020-18194Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new b
- CVE-2020-21842A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.
- CVE-2020-21841A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135.
- CVE-2020-21840A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985.
- CVE-2020-21839An issue was discovered in GNU LibreDWG 0.10.
- CVE-2020-21838A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:2842.
- CVE-2020-21836A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_preview ../../src/decode.c:3175.
- CVE-2020-21835A null pointer deference issue exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2337.
- CVE-2020-21834A null pointer deference issue exists in GNU LibreDWG 0.10 via get_bmp ../../programs/dwgbmp.c:164.
- CVE-2020-21833A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:2440.
- CVE-2020-21832A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2417.
- CVE-2020-21830A heap based buffer overflow vulneraibility exists in GNU LibreDWG 0.10 via bit_calc_CRC ../../src/bits.c:2213.
- CVE-2020-21827A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2379.
- CVE-2021-32622File upload local preview can run embedded scripts after user interactionmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2020-29205XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field
- CVE-2020-21819A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641via htmlescape ../../programs/escape.c:51.
- CVE-2020-21818A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48.
- CVE-2020-21817A null pointer dereference issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:29.
- CVE-2020-21815A null pointer deference issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114, which causes a denial of servi
- CVE-2020-24993There is a cross site scripting vulnerability on CmsWing 1.3.7.
- CVE-2020-24992There is a cross site scripting vulnerability on CmsWing 1.3.7.
- CVE-2020-21816A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46.
- CVE-2020-21814A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.
- CVE-2021-32618Open Redirect VulnerabilityFlask-Middleware flask-security · flask-security-too
- CVE-2020-21813A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114.
- CVE-2021-32456SITEL CAP/PRX cleartext transmission of sensitive informationSITEL CAP/PRX
- CVE-2021-23384Open Redirectkoa-remove-trailing-slashes
- CVE-2021-29747IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain highly sensitive information due to a vulnerability in the auIBM InfoSphere Information Server
- CVE-2021-25264In multiple versions of Sophos Endpoint products for MacOS, a local attacker could execute arbitrary code with administrator privileges.Sophos Intercept X for MacOS · Sophos Home for MacOS
- CVE-2020-13667Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.Drupal Core · drupal/core +1
- CVE-2021-24325404 SEO Redirection <= 1.3 - Reflected Cross-Site Scripting (XSS)404 SEO Redirection
- CVE-2021-24326All 404 Redirect to Homepage < 1.21 - Authenticated Reflected Cross-Site Scripting (XSS)All 404 Redirect to Homepage
- CVE-2021-24327SEO Redirection < 6.4 - Authenticated Stored Cross-Site Scripting (XSS)SEO Redirection Plugin – 301 Redirect Manager
- CVE-2021-24290Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)Store Locator Plus® Store Locator Plus for WordPress
- CVE-2021-24292Happy Addons for Elementor Free < 2.24.0 and Pro < 1.17.0 - Contributor+ Stored XSSweDevs Happy Addons for Elementor · weDevs Happy Addons Pro…
- CVE-2021-24295Time-based Blind SQL Injection in Spam protection, AntiSpam, FireWall by CleanTalk < 5.153.4СleanTalk Spam protection, AntiSpam, FireWall by CleanTalk
- CVE-2021-24299ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)Reservation Diary ReDi Restaurant Reservation
- CVE-2021-24314Goto < 2.1 - Unauthenticated Blind SQL InjectionBoostifyThemes Goto
- CVE-2021-24315Give WP < 2.10.4 - Authenticated Stored Cross-Site Scripting (XSS)GiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-24323Woocommerce < 5.2.0 - Authenticated Stored Cross-Site Scripting (XSS)Automattic WooCommerce · woocommerce/woocommerce
- CVE-2021-24324404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)404 SEO Redirection
- CVE-2021-24288AcyMailing < 7.5.0 - Unauthenticated Open RedirectNewsletter via SMTP, Sendinblue, Sendgrid, Mailgun - AcyMai…
- CVE-2021-24289Store Locator Plus <= 5.5.14 - Authenticated Privilege EscalationStore Locator Plus for WordPress
- CVE-2021-32453SITEL CAP/PRX information exposureSITEL CAP/PRX
- CVE-2021-32455SITEL CAP/PRX vulnerable to a denial of service attackSITEL CAP/PRX
- CVE-2021-33041vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').exvmd
- CVE-2019-14827A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contextsMoodle
- CVE-2021-27734Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the crede
- CVE-2021-32403Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mechanisms for token prot
- CVE-2021-32402Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurat
- CVE-2021-27342An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote a
- CVE-2021-31728Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.
- CVE-2021-31727Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestrict
- CVE-2007-5967A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.Mozilla Firefox
- CVE-2021-3483A flaw was found in the Nosy driver in the Linux kernel.Linux kernel
- CVE-2021-29052The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permissions in DataDefinicom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29048Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.2 com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29051Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29044Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5,com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29043The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before ficom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29053Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29046Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and Liferay DXP 7.3 befcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29045Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, andcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-29023InvoicePlane 1.5.11 doesn't have any rate-limiting for password reset and the reset token is generated using a weak mechanism that is predic
- CVE-2021-29024In InvoicePlane 1.5.11 a misconfigured web server allows unauthenticated directory listing and file download.
- CVE-2021-32617Denial of service in Exiv2exiv2
- CVE-2021-3524A flaw was found in the Red Hat Ceph Storage RadosGW (Ceph Object Gateway) in versions before 14.2.21.ceph