CVEs published May 20, 2021
59 CVEs were published on May 20, 2021: 1 critical, 2 high.
- Published
- 59
- Critical
- 1
- High
- 2
- Medium
- 10
- Low
- 3
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- IBM Security Identity Manager
- 7
- Emerson Rosemount X-STREAM Gas Analyzer
- 6
- OpenNMS · org.opennms:opennms
- 3
- kujirahand KonaWiki2
- 2
- ManageOne
- 2
- admidio
- 1
- Certain HP LaserJet products and Samsung product printers,…
- 1
- dns-packet
- 1
- IBM Spectrum Scale
- 1
- NIPPON ANTENNA Co. RFNTPS
- 1
Critical 1
High 2
Medium, low and unrated 56
- CVE-2020-27209The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversary to extract the pri
- CVE-2020-18220Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt o
- CVE-2021-22339There is a denial of service vulnerability in some versions of ManageOne.ManageOne
- CVE-2021-33477rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certa
- CVE-2021-22409There is a denial of service vulnerability in some versions of ManageOne.ManageOne
- CVE-2021-28906In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL.
- CVE-2021-28905In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL.
- CVE-2021-28904In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL.
- CVE-2021-28903A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem().
- CVE-2021-28902In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL.
- CVE-2021-27956Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e
- CVE-2020-21345Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user e
- CVE-2021-29258An issue was discovered in Envoy 1.14.0.
- CVE-2021-28683An issue was discovered in Envoy through 1.71.1.
- CVE-2021-28682An issue was discovered in Envoy through 1.71.1.
- CVE-2021-32632CSRF allowing modification of commands, modules, banphrases through hidden iFramespajbot
- CVE-2020-21057Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder va
- CVE-2020-21056Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale t
- CVE-2020-21055A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2
- CVE-2021-3313Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functiplone
- CVE-2020-21054Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsa
- CVE-2020-35580A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrar
- CVE-2021-27432OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled recursion, which may aOPC Foundation OPC UA .NET Standard and OPC UA .NET Legacy
- CVE-2021-29692IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable IBM Security Identity Manager
- CVE-2021-29691IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inboIBM Security Identity Manager
- CVE-2021-29688IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message isIBM Security Identity Manager
- CVE-2021-29687IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalidIBM Security Identity Manager
- CVE-2021-29686IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have accesIBM Security Identity Manager
- CVE-2021-29683IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user.IBM Security Identity Manager
- CVE-2021-29682IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message isIBM Security Identity Manager
- CVE-2020-4850IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused bIBM Spectrum Scale
- CVE-2021-25933In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through OpenNMS · org.opennms:opennms
- CVE-2020-21053Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via
- CVE-2021-25929In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through OpenNMS · org.opennms:opennms
- CVE-2021-25930In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through OpenNMS · org.opennms:opennms +1
- CVE-2021-27434Products with Unified Automation .NET based OPC UA Client/Server SDK Bundle: Versions V3.0.7 and prior (.NET 4.5, 4.0, and 3.5 Framework verOPC UA Products Built with the .NET Framework 4.5, 4.0, and
- CVE-2021-3438A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalatioCertain HP LaserJet products and Samsung product printers,…
- CVE-2021-28112Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to remote code execution by an authenticated attacker
- CVE-2021-28111Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote code execution by an authenticated attacker.
- CVE-2020-24395The USB firmware update script of homee Brain Cube v2 (2.28.2 and 2.28.4) devices allows an attacker with physical access to install comprom
- CVE-2020-24396homee Brain Cube v2 (2.28.2 and 2.28.4) devices have sensitive SSH keys within downloadable and unencrypted firmware images.
- CVE-2021-29659ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure.
- CVE-2021-3536A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible twildfly · org.wildfly:wildfly-parent
- CVE-2021-3480A flaw was found in slapi-nis in versions before 0.56.7.slapi-nis
- CVE-2021-27461A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2021-27459A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2021-27457A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2020-15522Bouncy Castle BC Java before 1.66, BC C# .NET before 1.8.7, BC-FJA before 1.0.1.2, 1.0.2.1, and BC-FNA before 1.0.1.1 have a timing issue wiorg.bouncycastle:bc-fips · org.bouncycastle:bcprov-ext-j… +7
- CVE-2021-27467A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2021-27465A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2021-27463A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer.Emerson Rosemount X-STREAM Gas Analyzer
- CVE-2021-20721KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors.kujirahand KonaWiki2
- CVE-2021-20720SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL commands and to obtainkujirahand KonaWiki2
- CVE-2021-20718mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.ZmartZone mod_auth_openidc
- CVE-2021-20719RFNTPS firmware versions System_01000004 and earlier, and Web_01000004 and earlier allow an attacker on the same network segment to execute NIPPON ANTENNA Co. RFNTPS
- CVE-2021-3426There's a flaw in Python 3's pydoc.python · libpython +1