# CVEs published 2021-05-28

62 CVEs were published on May 28, 2021: 3 critical, 7 high. Days are UTC.

- [CVE-2021-32647](https://cve.now/CVE-2021-32647.md): Post-authentication Remote Code Execution (RCE) in emissary:emissary (CVSS 8.0, NationalSecurityAgency emissary)
- [CVE-2021-32620](https://cve.now/CVE-2021-32620.md): Users registered with email verification can self re-activate their disabled accounts (CVSS 8.8, xwiki-platform · org.xwiki.commons:xwiki-commons-core)
- [CVE-2021-32621](https://cve.now/CVE-2021-32621.md): Script injection without script or programming rights through Gadget titles (CVSS 8.8, xwiki-platform · org.xwiki.commons:xwiki-commons-core)
- [CVE-2021-29492](https://cve.now/CVE-2021-29492.md): Bypass of path matching rules using escaped slash characters (CVSS 8.1, envoyproxy envoy)
- [CVE-2021-29505](https://cve.now/CVE-2021-29505.md): XStream is vulnerable to a Remote Command Execution attack (CVSS 7.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-29507](https://cve.now/CVE-2021-29507.md): dlt-daemon could crash if there is special character in dlt.conf (CVSS 5.7, GENIVI dlt-daemon)
- [CVE-2021-32619](https://cve.now/CVE-2021-32619.md): Static imports inside dynamically imported modules do not adhere to permission checks (CVSS 9.8, denoland deno · deno)
- [CVE-2020-36375](https://cve.now/CVE-2020-36375.md): Stack overflow vulnerability in parse\_equality Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted (no CVSS)
- [CVE-2020-36373](https://cve.now/CVE-2020-36373.md): Stack overflow vulnerability in parse\_shifts Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fi (no CVSS)
- [CVE-2020-36374](https://cve.now/CVE-2020-36374.md): Stack overflow vulnerability in parse\_comparison Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafte (no CVSS)
- [CVE-2020-36369](https://cve.now/CVE-2020-36369.md): Stack overflow vulnerability in parse\_statement\_list Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a cr (no CVSS)
- [CVE-2020-36372](https://cve.now/CVE-2020-36372.md): Stack overflow vulnerability in parse\_plus\_minus Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafte (no CVSS)
- [CVE-2020-36367](https://cve.now/CVE-2020-36367.md): Stack overflow vulnerability in parse\_block Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil (no CVSS)
- [CVE-2020-36368](https://cve.now/CVE-2020-36368.md): Stack overflow vulnerability in parse\_statement Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted (no CVSS)
- [CVE-2020-36370](https://cve.now/CVE-2020-36370.md): Stack overflow vulnerability in parse\_unary Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil (no CVSS)
- [CVE-2020-18392](https://cve.now/CVE-2020-18392.md): Stack overflow vulnerability in parse\_array Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil (no CVSS)
- [CVE-2020-36371](https://cve.now/CVE-2020-36371.md): Stack overflow vulnerability in parse\_mul\_div\_rem Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a craft (no CVSS)
- [CVE-2020-36366](https://cve.now/CVE-2020-36366.md): Stack overflow vulnerability in parse\_value Cesanta MJS 1.20.1, allows remote attackers to cause a Denial of Service (DoS) via a crafted fil (no CVSS)
- [CVE-2020-18395](https://cve.now/CVE-2020-18395.md): A NULL-pointer deference issue was discovered in GNU\_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial of service (DOS) via (no CVSS)
- [CVE-2021-32616](https://cve.now/CVE-2021-32616.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in 1CDN (CVSS 8.1, onedotprojects cdn)
- [CVE-2021-32635](https://cve.now/CVE-2021-32635.md): Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint (CVSS 6.3, sylabs singularity · github.com/sylabs/singularity)
- [CVE-2020-26641](https://cve.now/CVE-2020-26641.md): A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute arbitrary web scripts (no CVSS)
- [CVE-2020-26642](https://cve.now/CVE-2020-26642.md): A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arb (no CVSS)
- [CVE-2021-22519](https://cve.now/CVE-2021-22519.md): Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50), 2018.08(11.51), 2018 (no CVSS, SiteScope)
- [CVE-2021-20267](https://cve.now/CVE-2021-20267.md): A flaw was found in openstack-neutron's default Open vSwitch firewall rules. (no CVSS, openstack-neutron · neutron)
- [CVE-2021-32646](https://cve.now/CVE-2021-32646.md): Escalation of permissions in roomer (CVSS 5.3, Dav-Git Dav-Cogs)
- [CVE-2021-32637](https://cve.now/CVE-2021-32637.md): Authentication bypassed with malformed request URI (CVSS 10.0, authelia · github.com/authelia/authelia/v4)
- [CVE-2013-4536](https://cve.now/CVE-2013-4536.md): An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process (no CVSS, qemu)
- [CVE-2021-32642](https://cve.now/CVE-2021-32642.md): Missing input validation in dynamic discovery example scripts. (CVSS 7.0, radsecproxy)
- [CVE-2020-15782](https://cve.now/CVE-2020-15782.md): A vulnerability has been identified in SIMATIC Drive Controller family (All versions \< V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP (CVSS 9.8, Siemens SIMATIC Drive Controller family · Siemens SIMATI… +8)
- [CVE-2021-29629](https://cve.now/CVE-2021-29629.md): In FreeBSD 13.0-STABLE before n245765-bec0d2c9c841, 12.2-STABLE before r369859, 11.4-STABLE before r369866, 13.0-RELEASE before p1, 12.2-REL (no CVSS, FreeBSD)
- [CVE-2021-29628](https://cve.now/CVE-2021-29628.md): In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system (no CVSS, FreeBSD)
- [CVE-2020-1729](https://cve.now/CVE-2020-1729.md): A flaw was found in SmallRye's API through version 1.6.1. (no CVSS, SmallRye · io.smallrye.config:smallrye-config)
- [CVE-2020-1716](https://cve.now/CVE-2020-1716.md): A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deployi (no CVSS, ceph-ansible)
- [CVE-2010-3843](https://cve.now/CVE-2010-3843.md): The GTK version of ettercap uses a global settings file at /tmp/.ettercap\_gtk and does not verify ownership of this file. (no CVSS, ettercap)
- [CVE-2021-21734](https://cve.now/CVE-2021-21734.md): Some PON MDU devices of ZTE stored sensitive information in plaintext, and users with login authority can obtain it by inputing command. (no CVSS, ZTE PON MDU devices)
- [CVE-2021-27032](https://cve.now/CVE-2021-27032.md): Autodesk Licensing Installer was found to be vulnerable to privilege escalation issues. (no CVSS, Autodesk Licensing Installer)
- [CVE-2021-33591](https://cve.now/CVE-2021-33591.md): An exposed remote debugging port in Naver Comic Viewer prior to 1.0.15.0 allowed a remote attacker to execute arbitrary code via a crafted H (no CVSS, Naver Comic Viewer)
- [CVE-2021-20292](https://cve.now/CVE-2021-20292.md): There is a flaw reported in the Linux kernel in versions before 5.9 in drivers/gpu/drm/nouveau/nouveau\_sgdma.c in nouveau\_sgdma\_create\_ttm i (no CVSS, kernel)
- [CVE-2021-20278](https://cve.now/CVE-2021-20278.md): An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy \`OpenID\` is used. (no CVSS, kiali · github.com/kiali/kiali)
- [CVE-2021-20240](https://cve.now/CVE-2021-20240.md): A flaw was found in gdk-pixbuf in versions before 2.42.0. (no CVSS, gdk-pixbuf)
- [CVE-2021-20239](https://cve.now/CVE-2021-20239.md): A flaw was found in the Linux kernel in versions before 5.4.92 in the BPF protocol. (no CVSS, kernel)
- [CVE-2021-20237](https://cve.now/CVE-2021-20237.md): An uncontrolled resource consumption (memory leak) flaw was found in ZeroMQ's src/xpub.cpp in versions before 4.3.3. (no CVSS, zeromq)
- [CVE-2021-20236](https://cve.now/CVE-2021-20236.md): A flaw was found in the ZeroMQ server in versions before 4.3.3. (no CVSS, zeromq)
- [CVE-2021-20201](https://cve.now/CVE-2021-20201.md): A flaw was found in spice in versions before 0.14.92. (no CVSS, spice)
- [CVE-2021-20195](https://cve.now/CVE-2021-20195.md): A flaw was found in keycloak in versions before 13.0.0. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2020-35506](https://cve.now/CVE-2020-35506.md): A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handlin (no CVSS, QEMU)
- [CVE-2020-35505](https://cve.now/CVE-2020-35505.md): A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. (no CVSS, QEMU)
- [CVE-2020-35504](https://cve.now/CVE-2020-35504.md): A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. (no CVSS, QEMU)
- [CVE-2020-27847](https://cve.now/CVE-2020-27847.md): A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. (no CVSS, dexidp/dex · github.com/dexidp/dex +1)
- [CVE-2020-27826](https://cve.now/CVE-2020-27826.md): A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. (no CVSS, keycloak · org.keycloak:keycloak-core)
- [CVE-2020-25715](https://cve.now/CVE-2020-25715.md): A flaw was found in pki-core 10.9.0. (no CVSS, pki-core)
- [CVE-2020-25710](https://cve.now/CVE-2020-25710.md): A flaw was found in OpenLDAP in versions before 2.4.56. (no CVSS, openldap)
- [CVE-2021-32543](https://cve.now/CVE-2021-32543.md): SysJust CTS Web - Broken Authentication (CVSS 6.5, SysJust CTS Web)
- [CVE-2021-32542](https://cve.now/CVE-2021-32542.md): SysJust CTS Web - Reflected XSS (CVSS 4.7, SysJust CTS Web)
- [CVE-2021-32541](https://cve.now/CVE-2021-32541.md): SysJust CTS Web - Broken Access Control (CVSS 5.3, SysJust CTS Web)
- [CVE-2021-32540](https://cve.now/CVE-2021-32540.md): Hundred Plus 101EIP - Stored XSS-2 (CVSS 5.4, Hundred Plus 101EIP)
- [CVE-2021-32539](https://cve.now/CVE-2021-32539.md): Hundred Plus 101EIP - Stored XSS-1 (CVSS 5.4, Hundred Plus 101EIP)
- [CVE-2021-33587](https://cve.now/CVE-2021-33587.md): The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size (no CVSS, css-what)
- [CVE-2021-33620](https://cve.now/CVE-2021-33620.md): Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTT (CVSS 6.5)
- [CVE-2021-33623](https://cve.now/CVE-2021-33623.md): The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) (no CVSS, trim-newlines)
- [CVE-2021-3514](https://cve.now/CVE-2021-3514.md): When using a sync\_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query (no CVSS, 389-ds-base)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.