CVEs published May 25, 2021
55 CVEs were published on May 25, 2021: 0 critical, 0 high. 1 is now in CISA KEV.
- Published
- 55
- Critical
- 0
- High
- 0
- Medium
- 6
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- 10
- IBM 8335-GTB · IBM 8335-GTA +1
- 2
- Apache Software Foundation Apache Wicket · org.apache.wicke…
- 1
- deep-defaults
- 1
- github codeql-action
- 1
- IBM Spectrum Scale
- 1
- Jenkins project Jenkins Filesystem Trigger Plugin · org.jen…
- 1
- Jenkins project Jenkins Markdown Formatter Plugin · io.jenk…
- 1
- Jenkins project Jenkins Nuget Plugin · org.jenkins-ci.plugi…
- 1
- Jenkins project Jenkins URLTrigger Plugin · org.jenkins-ci.…
- 1
Medium, low and unrated 55
- CVE-2021-31924Yubico pam-u2f before 1.1.1 has a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local P
- CVE-2021-33575The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of usinruby-jss
- CVE-2021-33570Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table.
- CVE-2016-20011libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the cont
- CVE-2020-25672A memory leak vulnerability was found in Linux kernel in llcp_sock_connectLinux Kernel
- CVE-2021-20209A memory leak vulnerability was found in Privoxy before 3.0.29 in the show-status CGI handler when no action files are configured.privoxy
- CVE-2020-20453FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aaccoder, which allows a remote malicious user to cause a Denial of Service
- CVE-2021-25946Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead nconf-toml
- CVE-2020-20451Denial of Service issue in FFmpeg 4.2 due to resource management errors via fftools/cmdutils.c.
- CVE-2021-25934In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meOpenNMS · org.opennms:opennms
- CVE-2021-25935In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meOpenNMS
- CVE-2021-27562In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the printing out of secure da
- CVE-2021-25944Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead deep-defaults
- CVE-2021-32640ReDoS in Sec-Websocket-Protocol headerwebsockets ws · ws
- CVE-2020-20450FFmpeg 4.2 is affected by null pointer dereference passed as argument to libavformat/aviobuf.c, which could cause a Denial of Service.
- CVE-2020-20448FFmpeg 4.1.3 is affected by a Divide By Zero issue via libavcodec/ratecontrol.c, which allows a remote malicious user to cause a Denial of S
- CVE-2020-20446FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/aacpsy.c, which allows a remote malicious user to cause a Denial of Service.
- CVE-2020-20445FFmpeg 4.2 is affected by a Divide By Zero issue via libavcodec/lpc.h, which allows a remote malicious user to cause a Denial of Service.
- CVE-2021-32638CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecatedgithub codeql-action
- CVE-2021-29708IBM Spectrum Scale 5.1.0.1 could allow a local with access to the GUI pod container to obtain sensitive cryptographic keys that could allow IBM Spectrum Scale
- CVE-2021-29695IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system.IBM 8335-GTB · IBM 8335-GTA +1
- CVE-2020-4839IBM Host firmware for LC-class Systems is vulnerable to a stack based buffer overflow, caused by improper bounds checking.IBM 8335-GTB · IBM 8335-GTA +1
- CVE-2021-29209A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE IntegrateHPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29208A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE IntegrateHPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29211A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29210A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE IntegrateHPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-21660Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting (Jenkins project Jenkins Markdown Formatter Plugin · io.jenk…
- CVE-2021-21659Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins URLTrigger Plugin · org.jenkins-ci.…
- CVE-2021-21657Jenkins Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Filesystem Trigger Plugin · org.jen…
- CVE-2021-21658Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Nuget Plugin · org.jenkins-ci.plugi…
- CVE-2021-29207A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29206A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-27823An information disclosure vulnerability was discovered in /index.class.php (via port 8181) on NetWave System 1.0 which allows unauthenticate
- CVE-2021-33425A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers
- CVE-2021-27821The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.
- CVE-2021-29205A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29204A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29202A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-29201A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; H…
- CVE-2021-30195CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
- CVE-2021-30188CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
- CVE-2021-30186CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
- CVE-2021-30194CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
- CVE-2021-30193CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
- CVE-2021-30192CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
- CVE-2021-30191CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
- CVE-2021-30190CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
- CVE-2021-30189CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
- CVE-2021-30187CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
- CVE-2021-20096Cross-site request forgery in OpenOversight 0.6.4 allows a remote attacker to perform sensitive application actions by tricking legitimate uOpenOversight
- CVE-2020-9452An issue was discovered in Acronis True Image 2020 24.5.22510.
- CVE-2020-9450An issue was discovered in Acronis True Image 2020 24.5.22510.
- CVE-2020-9451An issue was discovered in Acronis True Image 2020 24.5.22510.
- CVE-2021-23937DNS proxy and possible amplification attackApache Software Foundation Apache Wicket · org.apache.wicke…
- CVE-2021-33574The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free.