# CVEs published 2021-05-31

20 CVEs were published on May 31, 2021: 2 critical, 4 high. Days are UTC.

- [CVE-2020-4561](https://cve.now/CVE-2020-4561.md): IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. (CVSS 10.0, IBM Cognos Analytics)
- [CVE-2020-4520](https://cve.now/CVE-2020-4520.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the authenticated victim (CVSS 7.1, IBM Cognos Analytics)
- [CVE-2020-4354](https://cve.now/CVE-2020-4354.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2020-4300](https://cve.now/CVE-2020-4300.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 8.2, IBM Cognos Analytics)
- [CVE-2019-4730](https://cve.now/CVE-2019-4730.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM Cognos Analytics)
- [CVE-2019-4724](https://cve.now/CVE-2019-4724.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete sett (CVSS 4.6, IBM Cognos Analytics)
- [CVE-2019-4723](https://cve.now/CVE-2019-4723.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete sett (CVSS 4.6, IBM Cognos Analytics)
- [CVE-2019-4722](https://cve.now/CVE-2019-4722.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information via a stack trace due to mishandling of cer (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2019-4653](https://cve.now/CVE-2019-4653.md): IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2019-4471](https://cve.now/CVE-2019-4471.md): IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure fl (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2021-29665](https://cve.now/CVE-2021-29665.md): IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow a loca (CVSS 9.0, IBM Security Verify Access)
- [CVE-2021-20585](https://cve.now/CVE-2021-20585.md): IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against t (CVSS 5.3, IBM Security Verify Access)
- [CVE-2021-20576](https://cve.now/CVE-2021-20576.md): IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could cause the application (CVSS 7.5, IBM Security Verify Access)
- [CVE-2021-20575](https://cve.now/CVE-2021-20575.md): IBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Security Verify Access)
- [CVE-2021-23388](https://cve.now/CVE-2021-23388.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, forms)
- [CVE-2020-10666](https://cve.now/CVE-2020-10666.md): The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a (no CVSS)
- [CVE-2021-30180](https://cve.now/CVE-2021-30180.md): Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2021-30179](https://cve.now/CVE-2021-30179.md): Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dub… +1)
- [CVE-2021-25640](https://cve.now/CVE-2021-25640.md): Open Redirect or SSRF vulnerability usage of parseURL (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dub… +1)
- [CVE-2021-33790](https://cve.now/CVE-2021-33790.md): The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-05-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.