CVEs published May 26, 2021
104 CVEs were published on May 26, 2021: 1 critical, 4 high. 1 is now in CISA KEV.
- Published
- 104
- Critical
- 1
- High
- 4
- Medium
- 4
- Low
- 0
- Unrated
- 95
- Now in CISA KEV
- 1
- Fix available
- 9
Most affected products
- homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- 9
- Linux Kernel
- 7
- redhat-certification
- 5
- Triconex Model 3009 MP installed on Tricon V11.3.x systems
- 5
- podofo
- 4
- Joomla! Project Joomla! CMS
- 3
- Versa Director
- 3
- Versa VOS
- 3
- ceph-dashboard
- 2
- dmg2img
- 2
Critical 1
High 4
- CVE-2021-25217A buffer overrun in lease file parsing code can be used to exploit a common vulnerability shared by dhcpd and dhclientISC DHCP
- CVE-2021-20487IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware byIBM Power 9 Systems
- CVE-2019-4588IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrIBM DB2 for Linux, UNIX and Windows
- CVE-2021-22543Improper memory handling in Linux KVMLinux Kernel
Medium, low and unrated 99
- CVE-2021-3509A flaw was found in Red Hat Ceph Storage 4, in the Dashboard component.ceph-dashboard
- CVE-2021-30501An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0.upx
- CVE-2021-30500Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0.upx
- CVE-2021-30499A flaw was found in libcaca.libcaca
- CVE-2020-27831A flaw was found in Red Hat Quay, where it does not properly protect the authorization token when authorizing email addresses for repositoryquay
- CVE-2021-28170In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be The Eclipse Foundation Jakarta Expression Language Imple… +2
- CVE-2021-32614A flaw was found in dmg2img through 20170502.dmg2img
- CVE-2021-30472A flaw was found in PoDoFo 0.9.7.podofo
- CVE-2021-30471A flaw was found in PoDoFo 0.9.7.podofo
- CVE-2021-30470A flaw was found in PoDoFo 0.9.7.podofo
- CVE-2021-30469A flaw was found in PoDoFo 0.9.7.podofo
- CVE-2020-10695An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container.containers/redhat-sso-7
- CVE-2021-3486GLPi 9.5.4 does not sanitize the metadata.glpi
- CVE-2021-3561An Out of Bounds flaw was found fig2dev version 3.2.8a.fig2dev
- CVE-2020-27839A flaw was found in ceph-dashboard.ceph-dashboard
- CVE-2021-20196A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU.qemu
- CVE-2021-3527A flaw was found in the USB redirector device (usb-redir) of QEMU.QEMU
- CVE-2009-3721Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived frytnef
- CVE-2020-25634A flaw was found in Red Hat 3scale’s API docs URL, where it is accessible without credentials.3scale-system
- CVE-2020-25724A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided.resteasy · org.jboss.resteasy:resteasy-bom
- CVE-2021-20177A flaw was found in the Linux kernel's implementation of string matching within a packet.kernel
- CVE-2021-20297A flaw was found in NetworkManager in versions before 1.30.0.NetworkManager
- CVE-2021-3549An out of bounds flaw was found in GNU binutils objdump utility version 2.36.binutils
- CVE-2020-22028Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_vertically_8 at libavfilter/vf_avgblur.c, which could cause a remote Denial of
- CVE-2021-3548A flaw was found in dmg2img through 20170502.dmg2img
- CVE-2020-22026Buffer Overflow vulnerability exists in FFmpeg 4.2 in the config_input function at libavfilter/af_tremolo.c, which could let a remote malici
- CVE-2020-22024Buffer Overflow vulnerability in FFmpeg 4.2 at the lagfun_frame16 function in libavfilter/vf_lagfun.c, which could let a remote malicious us
- CVE-2021-25643An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2.
- CVE-2020-22021Buffer Overflow vulnerability in FFmpeg 4.2 at filter_edges function in libavfilter/vf_yadif.c, which could let a remote malicious user caus
- CVE-2021-22747Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatTriconex Model 3009 MP installed on Tricon V11.3.x systems
- CVE-2021-22746Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatTriconex Model 3009 MP installed on Tricon V11.3.x systems
- CVE-2021-22745Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatTriconex Model 3009 MP installed on Tricon V11.3.x systems
- CVE-2021-22744Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatTriconex Model 3009 MP installed on Tricon V11.3.x systems
- CVE-2021-22743Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex TCM 4351B installed on Tricon V11.3.x systems that couTriconex TCM 4351B installed on Tricon V11.3.x systems.
- CVE-2021-22742Improper Check for Unusual or Exceptional Conditions vulnerability exists in Triconex Model 3009 MP installed on Tricon V11.3.x systems thatTriconex Model 3009 MP installed on Tricon V11.3.x systems
- CVE-2021-22741Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 201…
- CVE-2021-22740Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause information to be expohomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22739Information Exposure vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a device to be compromhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22738Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could chomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22736Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22735Improper Verification of Cryptographic Signature vulnerability exists inhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could ahomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22734Improper Verification of Cryptographic Signature vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22733Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause shell access homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22732Improper Privilege Management vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior which could cause a code executhomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-22731Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior wModicon Managed Switch MCSESM* and MCSESP* V8.21 and prior
- CVE-2021-22705Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthoriHarmony HMI Products Configured by Vijeo Designer (all vers…
- CVE-2021-22699Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of Modicon M241/M251 logic controllers firmware prior to
- CVE-2020-22019Buffer Overflow vulnerability in FFmpeg 4.2 at convolution_y_10bit in libavfilter/vf_vmafmotion.c, which could let a remote malicious user c
- CVE-2020-22020Buffer Overflow vulnerability in FFmpeg 4.2 in the build_diff_map function in libavfilter/vf_fieldmatch.c, which could let a remote maliciou
- CVE-2018-16494In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissiVersa VOS
- CVE-2018-16495In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user sucVersa VOS
- CVE-2018-16496In Versa Director, the un-authentication request found.Versa Director
- CVE-2018-16497In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server.Versa Analytics
- CVE-2018-16498In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files.Versa Director
- CVE-2018-16499In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using manVersa VOS
- CVE-2019-25030In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation functioVersa Director, Versa Analytics, Versa VOS
- CVE-2019-25029In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via Versa Director
- CVE-2020-15076Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinksPrivate Tunnel
- CVE-2018-10868redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticaredhat-certification
- CVE-2018-10867Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove anredhat-certification
- CVE-2018-10866It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiredhat-certification
- CVE-2018-10865It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthentiredhat-certification
- CVE-2018-10863It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/storeredhat-certification
- CVE-2021-33470COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.
- CVE-2021-33469COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the "Admin name" parameter.
- CVE-2020-22015Buffer Overflow vulnerability in FFmpeg 4.2 in mov_write_video_tag due to the out of bounds in libavformat/movenc.c, which could let a remot
- CVE-2021-20492IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batch is vulnerable to an XML External Entity Injection (XXE) attack when pIBM WebSphere Application Server
- CVE-2021-20486IBM Cloud Pak for Data 3.0 could allow an authenticated user to obtain sensitive information when installed with additional plugins.IBM Cloud Pak for Data
- CVE-2020-18221Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during bloc
- CVE-2021-33194golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFrgolang.org/x/net
- CVE-2021-33506jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default.
- CVE-2020-24020Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to me
- CVE-2021-25945Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to rjs-extend
- CVE-2021-21986The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vVMware vCenter Server and VMware Cloud Foundation
- CVE-2021-33038An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4.hyperkitty
- CVE-2021-32457Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which coulTrend Micro Home Network Security
- CVE-2021-22160Authentication with JWT allows use of “none”-algorithmApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2020-27815A flaw was found in the JFS filesystem code in the Linux Kernel which allows a local attacker with the ability to set extended attributes toLinux Kernel
- CVE-2020-25697A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients.xorg-x11-server
- CVE-2020-26677Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.
- CVE-2020-26680In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-
- CVE-2020-26679vFairs 3.3 is affected by Insecure Permissions.
- CVE-2020-26678vFairs 3.3 is affected by Remote Code Execution.
- CVE-2020-25669A vulnerability was found in the Linux Kernel where the function sunkbd_reinit having been scheduled by sunkbd_interrupt before sunkbd beingLinux Kernel
- CVE-2019-14836A vulnerability was found that the 3scale dev portal does not employ mechanisms for protection against login CSRF.Red Hat 3scale API Management
- CVE-2020-25668A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iLinux Kernel
- CVE-2020-25673A vulnerability was found in Linux kernel where non-blocking socket in llcp_sock_connect() leads to leak and eventually hanging-up the systeLinux Kernel
- CVE-2020-25671A vulnerability was found in Linux Kernel, where a refcount leak in llcp_sock_connect() causing use-after-free which might lead to privilegeLinux Kernel
- CVE-2020-25670A vulnerability was found in Linux Kernel where refcount leak in llcp_sock_bind() causing use-after-free which might lead to privilege escalLinux Kernel
- CVE-2021-26034[20210503] - Core - CSRF in data download endpointsJoomla! Project Joomla! CMS
- CVE-2021-26033[20210502] - Core - CSRF in AJAX reordering endpointJoomla! Project Joomla! CMS
- CVE-2021-26032[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUploadJoomla! Project Joomla! CMS
- CVE-2021-27676Centreon version 20.10.2 is affected by a cross-site scripting (XSS) vulnerability.centreon/centreon
- CVE-2021-29253The Tableau integration in RSA Archer 6.4 P1 (6.4.0.1) through 6.9 P2 (6.9.0.2) is affected by an insecure credential storage vulnerability.
- CVE-2021-29252RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability.
- CVE-2021-20178A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wAnsible
- CVE-2021-20191A flaw was found in ansible.ansible
- CVE-2021-22737Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cause unauthohomeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior
- CVE-2021-30498A flaw was found in libcaca.libcaca