CVEs published May 21, 2021
43 CVEs were published on May 21, 2021: 1 critical, 9 high.
- Published
- 43
- Critical
- 1
- High
- 9
- Medium
- 2
- Low
- 1
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- libwebp
- 11
- plone
- 6
- Dell Wyse Windows Embedded
- 1
- Dell XtremIO
- 1
- Foxit Reader
- 1
- IBM InfoSphere Information Server
- 1
- Linux Kernel
- 1
- NationalSecurityAgency emissary
- 1
- openid
- 1
- products-cmfcore · plone +1
- 1
Critical 1
High 9
- CVE-2021-33514Certain NETGEAR devices are affected by command injection by an unauthenticated attacker via the vulnerable /sqfs/lib/libsal.so.0.0 library
- CVE-2021-21549Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS.Dell XtremIO
- CVE-2021-33500PuTTY before 0.75 on Windows allows remote servers to cause a denial of service (Windows GUI hang) by telling the PuTTY window to change its
- CVE-2021-32634Deserialization of Untrusted Data in EmissaryNationalSecurityAgency emissary
- CVE-2021-31475This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HFSolarWinds Orion Job Scheduler
- CVE-2021-31473This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37598.Foxit Reader
- CVE-2021-31440This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15.Linux Kernel
- CVE-2021-28798Relative Path Traversal Vulnerability in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2021-31439This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager.Synology DiskStation Manager
Medium, low and unrated 33
- CVE-2021-33507Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow products-cmfcore · plone +1
- CVE-2021-33508Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.plone
- CVE-2021-33509Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transformplone
- CVE-2021-33510Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.plone
- CVE-2021-33511Plone though 5.2.4 allows SSRF via the lxml parser.plone
- CVE-2021-33512Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.plone
- CVE-2021-33513Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.plone
- CVE-2021-21552Dell Wyse Windows Embedded System versions WIE10 LTSC 2019 and earlier contain an improper authorization vulnerability.Dell Wyse Windows Embedded
- CVE-2008-3280It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Randopenid
- CVE-2021-29681IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information by injecting parameters into an HTML query.IBM InfoSphere Information Server
- CVE-2020-23768An information disclosure vulnerability was discovered in alipay_function.php in the log file of Alibaba payment interface on PHPPYUN prior
- CVE-2021-27811A code injection vulnerability has been discovered in the Upgrade function of QibosoftX1 v1.0.
- CVE-2020-23766An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any
- CVE-2020-23765A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0.
- CVE-2018-25014A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().libwebp
- CVE-2018-25013A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().libwebp
- CVE-2018-25012A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().libwebp
- CVE-2018-25011A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().libwebp
- CVE-2018-25010A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().libwebp
- CVE-2018-25009A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().libwebp
- CVE-2020-36332A flaw was found in libwebp in versions before 1.0.1.libwebp
- CVE-2020-36331A flaw was found in libwebp in versions before 1.0.1.libwebp
- CVE-2020-36330A flaw was found in libwebp in versions before 1.0.1.libwebp
- CVE-2020-36329A flaw was found in libwebp in versions before 1.0.1.libwebp
- CVE-2020-36328A flaw was found in libwebp in versions before 1.0.1.libwebp
- CVE-2021-32633Remote Code Execution via traversal in TAL expressionszopefoundation Zope · zope
- CVE-2020-27211Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels.
- CVE-2020-27212STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control.
- CVE-2021-29414STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.
- CVE-2021-29415The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the NordicSemiconductor
- CVE-2020-27208The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.0.0 & Somu and the N
- CVE-2020-12061An issue was discovered in Nitrokey FIDO U2F firmware through 1.1.
- CVE-2021-32032In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) c