CVEs published May 27, 2021
83 CVEs were published on May 27, 2021: 1 critical, 4 high. 4 are now in CISA KEV.
- Published
- 83
- Critical
- 1
- High
- 4
- Medium
- 2
- Low
- 0
- Unrated
- 76
- Now in CISA KEV
- 4
- Fix available
- 14
Most affected products
- Tower
- 6
- Datakit Software libraries embedded in Luxion KeyShot softw…
- 5
- pleaser
- 3
- Pulse Connect Secure
- 3
- libvirt
- 2
- Rocket.Chat server
- 2
- Trend Micro Home Network Security
- 2
- Adobe ColdFusion
- 1
- Ansible
- 1
- Apache Software Foundation Apache Fineract
- 1
Critical 1
High 4
- CVE-2020-10145The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2Adobe ColdFusion
- CVE-2021-22900A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administraPulse Secure Secure
- CVE-2021-22899A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote coPulse Connect Secure
- CVE-2021-22894A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary cPulse Connect Secure
Medium, low and unrated 78
- CVE-2021-33408Local File Inclusion vulnerability in Ab Initio Control>Center before 4.0.2.6 allows remote attackers to retrieve arbitrary files.
- CVE-2020-15180A flaw was found in the mysql-wsrep component of mariadb.mariadb
- CVE-2020-1761A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage.openshift/console
- CVE-2020-1702A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprcontainers/image
- CVE-2020-1701A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler.virt-handler · kubevirt.io/kubevirt
- CVE-2020-14387A flaw was found in rsync in versions since 3.2.0pre1.rsync
- CVE-2020-14329A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoTower
- CVE-2020-14328A flaw was found in Ansible Tower in versions before 3.7.2.Tower
- CVE-2020-14327A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2.Tower
- CVE-2020-14301An information disclosure vulnerability was found in libvirt in versions before 6.3.0.libvirt
- CVE-2021-20026A vulnerability in the SonicWall NSM On-Prem product allows an authenticated attacker to perform OS command injection using a crafted HTTP rSonicWall NSM On-Prem
- CVE-2020-22034A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c, which might lead to memory corruption and other
- CVE-2020-10774A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/kkernel
- CVE-2020-10729A flaw was found in the use of insufficiently random values in Ansible.Ansible
- CVE-2020-10716A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view.rubygem-foreman_ansible
- CVE-2020-10709A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application.Tower
- CVE-2020-10701A missing authorization flaw was found in the libvirt API responsible for changing the QEMU agent response timeout.libvirt
- CVE-2020-10698A flaw was found in Ansible Tower when running jobs.Tower
- CVE-2020-10697A flaw was found in Ansible Tower when running Openshift.Tower
- CVE-2020-10688A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly haRESTEasy · org.jboss.resteasy:resteasy-bom +1
- CVE-2020-22033A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit, which could let a remote
- CVE-2020-22032A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur, which might lead to memory cor
- CVE-2020-22016A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files, which might lead to memory corrup
- CVE-2020-22017A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c, which might lead to memory
- CVE-2021-33394Cubecart 6.4.2 allows Session Fixation.
- CVE-2020-22022A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c, which might lead to memory c
- CVE-2020-22023A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c, which might lead to memo
- CVE-2020-22025A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c, which might lead to memory corruption and
- CVE-2020-22027A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c, which might lead to memory corrupt
- CVE-2020-22030A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp, which might lead to mem
- CVE-2020-22029A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative, which crossfade
- CVE-2020-22031A Heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_w3fdif.c in filter16_complex_low, which might lead to memo
- CVE-2021-32643StaticFile.fromUrl can leak presence of a directoryhttp4s · org.http4s:http4s-core
- CVE-2021-32645Open Redirect in tenancytenancy multi-tenant · hyn/multi-tenant
- CVE-2021-27490Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior Datakit Software libraries embedded in Luxion KeyShot softw…
- CVE-2021-27492When opening a specially crafted 3DXML file, the application containing Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dReaDatakit Software libraries embedded in Luxion KeyShot softw…
- CVE-2021-27488Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior Datakit Software libraries embedded in Luxion KeyShot softw…
- CVE-2021-27496Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior Datakit Software libraries embedded in Luxion KeyShot softw…
- CVE-2021-27494Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior Datakit Software libraries embedded in Luxion KeyShot softw…
- CVE-2020-18229Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg
- CVE-2020-18230Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg
- CVE-2021-22118In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege esSpring Framework · org.springframework:spring-web
- CVE-2020-27832A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a repository's notificaquay
- CVE-2021-22360There is a resource management error vulnerability in the verisions V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 of USG9500.USG9500
- CVE-2021-22364There is a denial of service vulnerability in the versions 10.1.0.126(C00E125R5P3) of HUAWEI Mate 30 and 10.1.0.152(C00E136R7P2) of HUAWEI MHUAWEI Mate 30;HUAWEI Mate
- CVE-2021-22359There is a denial of service vulnerability in the verisions V200R005C00SPC500 of S5700 and V200R005C00SPC500 of S6700.S5700;S6700
- CVE-2021-22358There is an insufficient input validation vulnerability in FusionCompute 8.0.0.FusionCompute
- CVE-2008-2544Mounting /proc filesystem via chroot command silently mounts it in read-write mode.
- CVE-2021-31535LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code.
- CVE-2021-22362There is an out of bounds write vulnerability in some Huawei products.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-31525net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to Regolang.org/x/net · stdlib
- CVE-2021-22411There is an out-of-bounds write vulnerability in some Huawei products.NGFW Module;Secospace USG6300;Secospace USG6500;Secospace U…
- CVE-2021-31155Failure to normalize the umask in please before 0.4 allows a local attacker to gain full root privileges if they are allowed to execute at lpleaser
- CVE-2021-31154pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory.pleaser
- CVE-2020-17514disabled hostname verificiationApache Software Foundation Apache Fineract
- CVE-2021-31153please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locationspleaser
- CVE-2021-22885A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymhttps://github.com/rails/rails · actionpack
- CVE-2021-22891A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.10.1 and 5.11.18 mayCitrix ShareFile Storage Zones Controller
- CVE-2021-22892An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be dRocket.Chat server
- CVE-2021-22911A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injectioRocket.Chat server
- CVE-2021-22909A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack duEdgeMAX EdgeRouter
- CVE-2021-22908A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browsePulse Connect Secure
- CVE-2021-22907An improper access control vulnerability exists in Citrix Workspace App for Windows potentially allows privilege escalation in CR versions pCitrix Workspace App for Windows
- CVE-2021-33590GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.
- CVE-2021-32459Trend Micro Home Network Security version 6.6.604 and earlier contains a hard-coded password vulnerability in the log collection server whicTrend Micro Home Network Security
- CVE-2021-32458Trend Micro Home Network Security version 6.6.604 and earlier is vulnerable to an iotcl stack-based buffer overflow vulnerability which coulTrend Micro Home Network Security
- CVE-2021-20727Cross-site scripting vulnerability in Zettlr from 0.20.0 to 1.8.8 allows an attacker to execute an arbitrary script by loading a file or codHendrik Erz Zettlr
- CVE-2021-33586InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "m
- CVE-2021-31920Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escap
- CVE-2020-12403A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55.nss
- CVE-2021-28651An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.
- CVE-2021-28652An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.
- CVE-2021-28662An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6.
- CVE-2021-30465runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal.github.com/opencontainers/runc
- CVE-2021-31806An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.
- CVE-2021-31808An issue was discovered in Squid before 4.15 and 5.x before 5.0.6.
- CVE-2021-33200kernel/bpf/verifier.c in the Linux kernel through 5.12.7 enforces incorrect limits for pointer arithmetic operations, aka CID-bb01a1bba579.
- CVE-2021-33558Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, l