CVEs published May 24, 2021
90 CVEs were published on May 24, 2021: 2 critical, 9 high. 1 is now in CISA KEV.
- Published
- 90
- Critical
- 2
- High
- 9
- Medium
- 14
- Low
- 3
- Unrated
- 62
- Now in CISA KEV
- 1
- Fix available
- 21
Most affected products
- zephyrproject-rtos zephyr
- 12
- IBM Security Guardium
- 8
- VMware Workstation Pro / Player (Workstation), VMware Horiz…
- 3
- com.shopizer:shopizer
- 2
- github.com/dutchcoders/transfer.sh
- 2
- WAGO Series PFC200 Controller · WAGO Series Ethernet Contro…
- 2
- @ronomon/opened
- 1
- All in One SEO Team All in One SEO – Best WordPress SEO Plu…
- 1
- ArangoDB
- 1
- Autoptimize
- 1
Critical 2
High 9
- CVE-2020-13600Malformed SPI in response for eswifi can corrupt kernel memoryzephyrproject-rtos zephyr
- CVE-2020-10064Improper Input Frame Validation in ieee802154 Processingzephyrproject-rtos zephyr
- CVE-2021-29256.
- CVE-2021-32624Private Field data leakkeystonejs keystone-5 · @keystonejs/keystone
- CVE-2021-32629Memory access due to code generation flaw in Cranelift modulebytecodealliance wasmtime · cranelift-codegen +1
- CVE-2021-20557IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crIBM Security Guardium
- CVE-2021-20385IBM Security Guardium 11.2 could allow a remote authenticated attacker to execute arbitrary commands on the system.IBM Security Guardium
- CVE-2020-4990IBM Security Guardium 11.2 is vulnerable to SQL injection.IBM Security Guardium
- CVE-2021-20722Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prioFUJITSU LIMITED and PFU LIMITED The installers of ScanSnap…
Medium, low and unrated 79
- CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username.phanan/koel
- CVE-2021-33561A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML vcom.shopizer:shopizer
- CVE-2021-33562A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTMcom.shopizer:shopizer
- CVE-2021-3320Type Confusion in 802154 ACK Frames Handlingzephyrproject-rtos zephyr
- CVE-2020-13603Integer Overflow in memory allocating functionszephyrproject-rtos zephyr
- CVE-2020-13602Remote Denial of Service in LwM2M do_write_op_tlvzephyrproject-rtos zephyr
- CVE-2020-13599Security problem with settings and littlefszephyrproject-rtos zephyr
- CVE-2020-13598FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_statzephyrproject-rtos zephyr
- CVE-2020-10072Improper Handling of Insufficient Permissions or Privileges in zephyrzephyrproject-rtos zephyr
- CVE-2020-10069Zephyr Bluetooth unchecked packet data results in denial of servicezephyrproject-rtos zephyr
- CVE-2020-10066Incorrect Error Handling in Bluetooth HCI corezephyrproject-rtos zephyr
- CVE-2020-10065Missing Size Checks in Bluetooth HCI over SPIzephyrproject-rtos zephyr
- CVE-2021-33525EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacharacters in the nagios_path par
- CVE-2021-30108Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability.feehi/cms
- CVE-2020-20178Ethereum 0xe933c0cd9784414d5f278c114904f5a84b396919#code.sol latest version is affected by a denial of service vulnerability in the affected
- CVE-2021-23387Open Redirecttrailing-slash
- CVE-2020-20907MetInfo 7.0 beta is affected by a file modification vulnerability.
- CVE-2021-30083An issue was discovered in Mediat 1.4.1.
- CVE-2021-30082An issue was discovered in Gris CMS v0.1.
- CVE-2021-30081An issue was discovered in emlog 6.0.0stable.
- CVE-2020-26555Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spo
- CVE-2020-26556Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on
- CVE-2020-21041Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user
- CVE-2020-26557Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (without possession of the AuthValue used in the pr
- CVE-2020-26558Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to ide
- CVE-2020-26559Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device (participating in the provisioning protoc
- CVE-2020-26560Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence f
- CVE-2021-33502The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of servicenormalize-url
- CVE-2021-29300The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute c@ronomon/opened
- CVE-2019-12348An issue was discovered in zzcms 2019.
- CVE-2021-33516An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5.
- CVE-2021-20428IBM Security Guardium 11.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnedIBM Security Guardium
- CVE-2021-20426IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound autheIBM Security Guardium
- CVE-2021-20419IBM Security Guardium 11.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive inforIBM Security Guardium
- CVE-2021-20389IBM Security Guardium 11.2 stores user credentials in plain clear text which can be read by a local user.IBM Security Guardium
- CVE-2021-20386IBM Security Guardium 11.2 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2021-3485Improper Input Validation in Bitdefender Endpoint Security Tools for LinuxBitdefender Endpoint Security Tools for Linux
- CVE-2020-25408A Cross-Site Request Forgery (CSRF) vulnerability exists in ProjectWorlds College Management System Php 1.0 that allows a remote attacker to
- CVE-2020-28911Incorrect Access Control in Nagios Fusion 4.1.8 and earlier allows low-privileged authenticated users to extract passwords used to manage fu
- CVE-2020-28910Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of s
- CVE-2020-28909Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts.
- CVE-2020-28908Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.
- CVE-2020-28907Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Execution as root via ve
- CVE-2020-28906Incorrect File Permissions in Nagios XI 5.7.5 and earlier and Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root.
- CVE-2020-28905Improper Input Validation in Nagios Fusion 4.1.8 and earlier allows an authenticated attacker to execute remote code via table pagination.
- CVE-2020-28904Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via installation of a mal
- CVE-2020-28903Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary H
- CVE-2020-28902Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.
- CVE-2020-28901Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrup
- CVE-2020-28900Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows for Escalation of P
- CVE-2021-32075Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.
- CVE-2020-26006Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php.
- CVE-2020-25411Projectworlds Online Examination System 1.0 is vulnerable to CSRF, which allows a remote attacker to delete the existing user.
- CVE-2020-25409Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters.
- CVE-2021-3559A flaw was found in libvirt in the virConnectListAllNodeDevices API in versions before 7.0.0.libvirt
- CVE-2021-21989VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in thVMware Workstation Pro / Player (Workstation), VMware Horiz…
- CVE-2021-21988VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in thVMware Workstation Pro / Player (Workstation), VMware Horiz…
- CVE-2021-21987VMware Workstation (16.x prior to 16.1.2) and Horizon Client for Windows (5.x prior to 5.5.2) contain out-of-bounds read vulnerability in thVMware Workstation Pro / Player (Workstation), VMware Horiz…
- CVE-2021-21000WAGO: PFC200 Denial of Service due to the number of connections to the runtimeWAGO Series PFC200 Controller · WAGO Series Ethernet Contro…
- CVE-2021-24306Ultimate Member < 2.1.20 - Authenticated Reflected Cross-Site Scripting (XSS)Ultimate Member – User Profile, User Registration, Login &…
- CVE-2021-24307All in One SEO Pack < 4.1.0.2 - Admin RCE via unserializeAll in One SEO Team All in One SEO – Best WordPress SEO Plu…
- CVE-2021-24308LifterLMS < 4.21.1 - Authenticated Stored XSS in Edit ProfileLMS by LifterLMS – Online Course, Membership & Learning Man…
- CVE-2021-24332Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)Autoptimize
- CVE-2021-24296WP Customer Reviews < 3.5.6 - Authenticated Stored Cross-Site Scripting (XSS)Go Web Solutions WP Customer Reviews
- CVE-2021-24297Goto < 2.1 - Reflected Cross-Site Scripting (XSS)Goto
- CVE-2021-24298Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)Igor Benic Simple Giveaways – Grow your business, email lis…
- CVE-2021-24300PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)PickPlugins Product Slider for WooCommerce
- CVE-2021-24301Hotjar Connecticator <= 1.1.1 - Authenticated Stored Cross-Site Scripting (XSS)Blue Medicine Labs Hotjar Connecticator
- CVE-2021-24302Hana Flv Player <= 3.1.3 - Authenticated Stored Cross-Site Scripting (XSS)HanaDaddy Hana Flv Player
- CVE-2021-24305Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence KeyTargetFirst Target First Plugin
- CVE-2021-24294DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)Michael Leithold DSGVO All in one for WP
- CVE-2021-25938In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validation of the .zip file nArangoDB
- CVE-2021-33497Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.github.com/dutchcoders/transfer.sh
- CVE-2021-33496Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.github.com/dutchcoders/transfer.sh
- CVE-2021-20726Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbThe Installer of Overwolf
- CVE-2021-20725Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker toPHP Factory [Calendar01] free edition
- CVE-2021-20723Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descripPHP Factory [MailForm01] free edition
- CVE-2021-20724Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inPHP Factory [Telop01] free edition
- CVE-2021-20713Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can log in to the PC whereQualitySoft QND Advance/Premium/Standard