CVEs published June 1, 2021
75 CVEs were published on June 1, 2021: 0 critical, 10 high.
- Published
- 75
- Critical
- 0
- High
- 10
- Medium
- 4
- Low
- 3
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- nextcloud security-advisories
- 6
- Nginx Controller
- 4
- BoldThemes Bello - Directory & Listing
- 3
- purethemes Listeo
- 2
- Synology DiskStation Manager
- 2
- 3Scale
- 1
- Automattic WP Super Cache
- 1
- broker
- 1
- Business-central
- 1
- Car Repair Services & Auto Mechanic
- 1
High 10
- CVE-2021-32656Trusted servers exchange can be triggered by attackernextcloud security-advisories
- CVE-2021-32654Attacker can obtain write access to any federated share/public linknextcloud security-advisories
- CVE-2021-22123An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a rFortinet FortiWeb
- CVE-2021-32652Missing permission check on email metadata retrievalnextcloud security-advisories
- CVE-2021-29740IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerabiliIBM Spectrum Scale
- CVE-2021-33184Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote Synology Download Station
- CVE-2021-33183Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in SynoloSynology Docker
- CVE-2021-29088Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) beforeSynology DiskStation Manager
- CVE-2021-29092Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 alloSynology Photo Station
- CVE-2021-33180Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media ServerSynology Media Server
Medium, low and unrated 65
- CVE-2021-32657Malicious user could break user administration pagenextcloud security-advisories
- CVE-2021-32655Files Drop public link can be added as federated sharenextcloud security-advisories
- CVE-2020-22044A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url_open_dyn_buf_internal function in libavformat/aviobuf
- CVE-2020-22043A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo_alloc_common function in libavutil/fifo.c.
- CVE-2021-26111A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 andFortinet FortiSwitch
- CVE-2020-22042A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link_filter_inouts function i
- CVE-2021-32653Default settings leak federated cloud ID to lookup server of all usersnextcloud security-advisories
- CVE-2020-22041A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_buffersrc_add_frame_flags function in buffersrc.
- CVE-2020-22039A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi_add_ientry function.
- CVE-2020-22038A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_v4l2_m2m_create_context function in v4l2_m2m.c.
- CVE-2020-22037A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec_alloc_context3 at options.c.
- CVE-2020-22040A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v_frame_alloc function in frame.c.
- CVE-2021-3425A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfilebroker
- CVE-2021-3424A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible.keycloak · org.keycloak:keycloak-services
- CVE-2020-22036A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might lead to memory corrup
- CVE-2020-22035A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might lead to memory corrup
- CVE-2021-32924Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\fr
- CVE-2021-32651LDAP injection via OneDev may leak some LDAP directory informationtheonedev onedev
- CVE-2020-27377A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14
- CVE-2020-17541Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component.
- CVE-2020-26693A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbit
- CVE-2021-31643An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a la
- CVE-2021-31642A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, an
- CVE-2020-26670A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands t
- CVE-2020-26669A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to
- CVE-2020-26668A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attac
- CVE-2021-31641An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W
- CVE-2021-3412It was found that all versions of 3Scale developer portal lacked brute force protections.3Scale
- CVE-2021-3516There's a flaw in libxml2's xmllint in versions before 2.9.11.libxml2
- CVE-2021-20306A flaw was found in the BPMN editor in version jBPM 7.51.0.Final.Business-central
- CVE-2021-3515A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26.pglogical
- CVE-2021-3495An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7.kiali/kiali-operator · github.com/kiali/kiali
- CVE-2021-3543A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave fikernel
- CVE-2020-27748A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer.xdg-utils
- CVE-2021-23017A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cauNginx Web Server, Nginx Plus
- CVE-2021-23021The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission biNginx Controller
- CVE-2021-23020The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predictaNginx Controller
- CVE-2021-23019The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included iNginx Controller
- CVE-2021-23018Intra-cluster communication does not use TLS.Nginx Controller
- CVE-2020-1920A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resoFacebook react-native · react-native
- CVE-2021-24322Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS)Delicious Brains Database Backup for WordPress
- CVE-2021-24328WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)WP Login Security and History
- CVE-2021-24329WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)WP Super Cache
- CVE-2021-24330Funnel Builder by CartFlows < 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics IDFunnel Builder by CartFlows – Create High Converting Sales…
- CVE-2021-24331Smooth Scroll Page Up/Down Buttons < 1.4 - Authenticated Stored XSSSmooth Scroll Page Up/Down Buttons
- CVE-2021-24333Content Copy Protection & Prevent Image Save <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)Content Copy Protection & Prevent Image Save
- CVE-2021-24334Instant Images WordPress Plugin < 4.4.0.1 - Authenticated Stored XSS & XFSInstant Images – One Click Unsplash Uploads
- CVE-2021-24335Car Repair Services < 4.0 - Unauthenticated Reflected XSS & XFSCar Repair Services & Auto Mechanic
- CVE-2021-24312WP Super Cache < 1.7.3 - Authenticated Remote Code ExecutionAutomattic WP Super Cache
- CVE-2021-24313WP Prayer < 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS)WP Prayer
- CVE-2021-24316Mediumish <= 1.0.47 - Unauthenticated Reflected Cross-Site Scripting (XSS)WowThemes Mediumish
- CVE-2021-24317Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilitiespurethemes Listeo
- CVE-2021-24318Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilitiespurethemes Listeo
- CVE-2021-24319Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSBoldThemes Bello - Directory & Listing
- CVE-2021-24320Bello < 1.6.0 - Unauthenticated Reflected XSS & XFSBoldThemes Bello - Directory & Listing
- CVE-2021-24321Bello < 1.6.0 - Unauthenticated Blind SQL InjectionBoldThemes Bello - Directory & Listing
- CVE-2021-24309Weekly Schedule < 3.4.3 - Authenticated Stored XSSWeekly Schedule
- CVE-2021-24310Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery TitlePhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2021-24311External Media < 1.0.34 - Authenticated Arbitrary File UploadExternal Media
- CVE-2021-27828SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content
- CVE-2021-25932In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through OpenNMS
- CVE-2021-33181Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticateSynology Video Station
- CVE-2021-33182Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStationSynology DiskStation Manager
- CVE-2021-31684A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of senet.minidev:json-smart
- CVE-2021-32027A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22.postgresql