CVEs published May 31, 2021
20 CVEs were published on May 31, 2021: 2 critical, 4 high.
- Published
- 20
- Critical
- 2
- High
- 4
- Medium
- 9
- Low
- 0
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM Cognos Analytics
- 10
- IBM Security Verify Access
- 4
- Apache Software Foundation Apache Dubbo · org.apache.dub… +1
- 2
- Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- 1
- forms
- 1
Critical 2
- CVE-2020-4561IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions.IBM Cognos Analytics
- CVE-2021-29665IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a locaIBM Security Verify Access
High 4
- CVE-2020-4520IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim IBM Cognos Analytics
- CVE-2020-4300IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Cognos Analytics
- CVE-2019-4730IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM Cognos Analytics
- CVE-2021-20576IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the applicationIBM Security Verify Access
Medium, low and unrated 14
- CVE-2020-4354IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4724IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settIBM Cognos Analytics
- CVE-2019-4723IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settIBM Cognos Analytics
- CVE-2019-4722IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of cerIBM Cognos Analytics
- CVE-2019-4653IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2019-4471IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flIBM Cognos Analytics
- CVE-2021-20585IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against tIBM Security Verify Access
- CVE-2021-20575IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system.IBM Security Verify Access
- CVE-2021-23388Regular Expression Denial of Service (ReDoS)forms
- CVE-2020-10666The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a
- CVE-2021-30180Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2021-30179Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filterApache Software Foundation Apache Dubbo · org.apache.dub… +1
- CVE-2021-25640Open Redirect or SSRF vulnerability usage of parseURLApache Software Foundation Apache Dubbo · org.apache.dub… +1
- CVE-2021-33790The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as p