CVEs published May 28, 2021
62 CVEs were published on May 28, 2021: 3 critical, 7 high.
- Published
- 62
- Critical
- 3
- High
- 7
- Medium
- 9
- Low
- 0
- Unrated
- 43
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- QEMU
- 3
- SysJust CTS Web
- 3
- FreeBSD
- 2
- Hundred Plus 101EIP
- 2
- kernel
- 2
- keycloak · org.keycloak:keycloak-core
- 2
- xwiki-platform · org.xwiki.commons:xwiki-commons-core
- 2
- zeromq
- 2
- 389-ds-base
- 1
- authelia · github.com/authelia/authelia/v4
- 1
Critical 3
- CVE-2021-32619Static imports inside dynamically imported modules do not adhere to permission checksdenoland deno · deno
- CVE-2021-32637Authentication bypassed with malformed request URIauthelia · github.com/authelia/authelia/v4
- CVE-2020-15782A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP Siemens SIMATIC Drive Controller family · Siemens SIMATI… +8
High 7
- CVE-2021-32647Post-authentication Remote Code Execution (RCE) in emissary:emissaryNationalSecurityAgency emissary
- CVE-2021-32620Users registered with email verification can self re-activate their disabled accountsxwiki-platform · org.xwiki.commons:xwiki-commons-core
- CVE-2021-32621Script injection without script or programming rights through Gadget titlesxwiki-platform · org.xwiki.commons:xwiki-commons-core
- CVE-2021-29492Bypass of path matching rules using escaped slash charactersenvoyproxy envoy
- CVE-2021-29505XStream is vulnerable to a Remote Command Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-32616Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1CDNonedotprojects cdn
- CVE-2021-32642Missing input validation in dynamic discovery example scripts.radsecproxy
Medium, low and unrated 52
- CVE-2021-29507dlt-daemon could crash if there is special character in dlt.confGENIVI dlt-daemon
- CVE-2020-36375Stack overflow vulnerability in parse_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2020-36373Stack overflow vulnerability in parse_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fi
- CVE-2020-36374Stack overflow vulnerability in parse_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafte
- CVE-2020-36369Stack overflow vulnerability in parse_statement_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a cr
- CVE-2020-36372Stack overflow vulnerability in parse_plus_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafte
- CVE-2020-36367Stack overflow vulnerability in parse_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil
- CVE-2020-36368Stack overflow vulnerability in parse_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2020-36370Stack overflow vulnerability in parse_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil
- CVE-2020-18392Stack overflow vulnerability in parse_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil
- CVE-2020-36371Stack overflow vulnerability in parse_mul_div_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a craft
- CVE-2020-36366Stack overflow vulnerability in parse_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil
- CVE-2020-18395A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial of service (DOS) via
- CVE-2021-32635Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpointsylabs singularity · github.com/sylabs/singularity
- CVE-2020-26641A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts
- CVE-2020-26642A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arb
- CVE-2021-22519Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018SiteScope
- CVE-2021-20267A flaw was found in openstack-neutron's default Open vSwitch firewall rules.openstack-neutron · neutron
- CVE-2021-32646Escalation of permissions in roomerDav-Git Dav-Cogs
- CVE-2013-4536An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process qemu
- CVE-2021-29629In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-RELFreeBSD
- CVE-2021-29628In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a systemFreeBSD
- CVE-2020-1729A flaw was found in SmallRye's API through version 1.6.1.SmallRye · io.smallrye.config:smallrye-config
- CVE-2020-1716A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deployiceph-ansible
- CVE-2010-3843The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file.ettercap
- CVE-2021-21734Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command.ZTE PON MDU devices
- CVE-2021-27032Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues.Autodesk Licensing Installer
- CVE-2021-33591An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted HNaver Comic Viewer
- CVE-2021-20292There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau_sgdma.c in nouveau_sgdma_create_ttm ikernel
- CVE-2021-20278An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used.kiali · github.com/kiali/kiali
- CVE-2021-20240A flaw was found in gdk-pixbuf in versions before 2.42.0.gdk-pixbuf
- CVE-2021-20239A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol.kernel
- CVE-2021-20237An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3.zeromq
- CVE-2021-20236A flaw was found in the ZeroMQ server in versions before 4.3.3.zeromq
- CVE-2021-20201A flaw was found in spice in versions before 0.14.92.spice
- CVE-2021-20195A flaw was found in keycloak in versions before 13.0.0.keycloak · org.keycloak:keycloak-core
- CVE-2020-35506A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handlinQEMU
- CVE-2020-35505A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0.QEMU
- CVE-2020-35504A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0.QEMU
- CVE-2020-27847A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation.dexidp/dex · github.com/dexidp/dex +1
- CVE-2020-27826A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API.keycloak · org.keycloak:keycloak-core
- CVE-2020-25715A flaw was found in pki-core 10.9.0.pki-core
- CVE-2020-25710A flaw was found in OpenLDAP in versions before 2.4.56.openldap
- CVE-2021-32543SysJust CTS Web - Broken AuthenticationSysJust CTS Web
- CVE-2021-32542SysJust CTS Web - Reflected XSSSysJust CTS Web
- CVE-2021-32541SysJust CTS Web - Broken Access ControlSysJust CTS Web
- CVE-2021-32540Hundred Plus 101EIP - Stored XSS-2Hundred Plus 101EIP
- CVE-2021-32539Hundred Plus 101EIP - Stored XSS-1Hundred Plus 101EIP
- CVE-2021-33587The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size css-what
- CVE-2021-33620Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTT
- CVE-2021-33623The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS)trim-newlines
- CVE-2021-3514When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query389-ds-base