# CVEs published 2021-06-01

75 CVEs were published on June 1, 2021: 0 critical, 10 high. Days are UTC.

- [CVE-2021-32657](https://cve.now/CVE-2021-32657.md): Malicious user could break user administration page (CVSS 4.3, nextcloud security-advisories)
- [CVE-2021-32656](https://cve.now/CVE-2021-32656.md): Trusted servers exchange can be triggered by attacker (CVSS 8.6, nextcloud security-advisories)
- [CVE-2021-32655](https://cve.now/CVE-2021-32655.md): Files Drop public link can be added as federated share (CVSS 3.5, nextcloud security-advisories)
- [CVE-2021-32654](https://cve.now/CVE-2021-32654.md): Attacker can obtain write access to any federated share/public link (CVSS 8.1, nextcloud security-advisories)
- [CVE-2020-22044](https://cve.now/CVE-2020-22044.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the url\_open\_dyn\_buf\_internal function in libavformat/aviobuf (no CVSS)
- [CVE-2021-22123](https://cve.now/CVE-2021-22123.md): An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a r (CVSS 7.6, Fortinet FortiWeb)
- [CVE-2020-22043](https://cve.now/CVE-2020-22043.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak at the fifo\_alloc\_common function in libavutil/fifo.c. (no CVSS)
- [CVE-2021-26111](https://cve.now/CVE-2021-26111.md): A missing release of memory after effective lifetime vulnerability in FortiSwitch 6.4.0 to 6.4.6, 6.2.0 to 6.2.6, 6.0.0 to 6.0.6, 3.6.11 and (CVSS 6.5, Fortinet FortiSwitch)
- [CVE-2020-22042](https://cve.now/CVE-2020-22042.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak is affected by: memory leak in the link\_filter\_inouts function i (no CVSS)
- [CVE-2021-32653](https://cve.now/CVE-2021-32653.md): Default settings leak federated cloud ID to lookup server of all users (CVSS 2.7, nextcloud security-advisories)
- [CVE-2020-22041](https://cve.now/CVE-2020-22041.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av\_buffersrc\_add\_frame\_flags function in buffersrc. (no CVSS)
- [CVE-2020-22039](https://cve.now/CVE-2020-22039.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the inavi\_add\_ientry function. (no CVSS)
- [CVE-2020-22038](https://cve.now/CVE-2020-22038.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff\_v4l2\_m2m\_create\_context function in v4l2\_m2m.c. (no CVSS)
- [CVE-2020-22037](https://cve.now/CVE-2020-22037.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in avcodec\_alloc\_context3 at options.c. (no CVSS)
- [CVE-2020-22040](https://cve.now/CVE-2020-22040.md): A Denial of Service vulnerability exists in FFmpeg 4.2 idue to a memory leak in the v\_frame\_alloc function in frame.c. (no CVSS)
- [CVE-2021-3425](https://cve.now/CVE-2021-3425.md): A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile (no CVSS, broker)
- [CVE-2021-32652](https://cve.now/CVE-2021-32652.md): Missing permission check on email metadata retrieval (CVSS 8.8, nextcloud security-advisories)
- [CVE-2021-3424](https://cve.now/CVE-2021-3424.md): A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. (no CVSS, keycloak · org.keycloak:keycloak-services)
- [CVE-2020-22036](https://cve.now/CVE-2020-22036.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter\_intra at libavfilter/vf\_bwdif.c, which might lead to memory corrup (no CVSS)
- [CVE-2020-22035](https://cve.now/CVE-2020-22035.md): A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get\_block\_row at libavfilter/vf\_bm3d.c, which might lead to memory corrup (no CVSS)
- [CVE-2021-32924](https://cve.now/CVE-2021-32924.md): Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\\cms\\modules\\fr (no CVSS)
- [CVE-2021-32651](https://cve.now/CVE-2021-32651.md): LDAP injection via OneDev may leak some LDAP directory information (CVSS 3.1, theonedev onedev)
- [CVE-2020-27377](https://cve.now/CVE-2020-27377.md): A cross-site scripting (XSS) vulnerability was discovered in the Administrator panel on the 'Setting News' module on CMS Made Simple 2.2.14 (no CVSS)
- [CVE-2020-17541](https://cve.now/CVE-2020-17541.md): Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. (no CVSS)
- [CVE-2020-26693](https://cve.now/CVE-2020-26693.md): A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbit (no CVSS)
- [CVE-2021-31643](https://cve.now/CVE-2021-31643.md): An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a la (no CVSS)
- [CVE-2021-31642](https://cve.now/CVE-2021-31642.md): A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, an (no CVSS)
- [CVE-2020-26670](https://cve.now/CVE-2020-26670.md): A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands t (no CVSS)
- [CVE-2020-26669](https://cve.now/CVE-2020-26669.md): A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to (no CVSS)
- [CVE-2020-26668](https://cve.now/CVE-2020-26668.md): A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an authenticated attac (no CVSS)
- [CVE-2021-31641](https://cve.now/CVE-2021-31641.md): An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W (no CVSS)
- [CVE-2021-29740](https://cve.now/CVE-2021-29740.md): IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerabili (CVSS 8.4, IBM Spectrum Scale)
- [CVE-2021-3412](https://cve.now/CVE-2021-3412.md): It was found that all versions of 3Scale developer portal lacked brute force protections. (no CVSS, 3Scale)
- [CVE-2021-3516](https://cve.now/CVE-2021-3516.md): There's a flaw in libxml2's xmllint in versions before 2.9.11. (no CVSS, libxml2)
- [CVE-2021-20306](https://cve.now/CVE-2021-20306.md): A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. (no CVSS, Business-central)
- [CVE-2021-3515](https://cve.now/CVE-2021-3515.md): A shell injection flaw was found in pglogical in versions before 2.3.4 and before 3.6.26. (no CVSS, pglogical)
- [CVE-2021-3495](https://cve.now/CVE-2021-3495.md): An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. (no CVSS, kiali/kiali-operator · github.com/kiali/kiali)
- [CVE-2021-3543](https://cve.now/CVE-2021-3543.md): A flaw null pointer dereference in the Nitro Enclaves kernel driver was found in the way that Enclaves VMs forces closures on the enclave fi (no CVSS, kernel)
- [CVE-2020-27748](https://cve.now/CVE-2020-27748.md): A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. (no CVSS, xdg-utils)
- [CVE-2021-23017](https://cve.now/CVE-2021-23017.md): A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cau (no CVSS, Nginx Web Server, Nginx Plus)
- [CVE-2021-23021](https://cve.now/CVE-2021-23021.md): The Nginx Controller 3.x before 3.7.0 agent configuration file /etc/controller-agent/agent.conf is world readable with current permission bi (no CVSS, Nginx Controller)
- [CVE-2021-23020](https://cve.now/CVE-2021-23020.md): The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predicta (no CVSS, Nginx Controller)
- [CVE-2021-23019](https://cve.now/CVE-2021-23019.md): The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included i (no CVSS, Nginx Controller)
- [CVE-2021-23018](https://cve.now/CVE-2021-23018.md): Intra-cluster communication does not use TLS. (no CVSS, Nginx Controller)
- [CVE-2020-1920](https://cve.now/CVE-2020-1920.md): A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive reso (no CVSS, Facebook react-native · react-native)
- [CVE-2021-24322](https://cve.now/CVE-2021-24322.md): Database Backup for WordPress \< 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) (no CVSS, Delicious Brains Database Backup for WordPress)
- [CVE-2021-24328](https://cve.now/CVE-2021-24328.md): WP Login Security and History \<= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, WP Login Security and History)
- [CVE-2021-24329](https://cve.now/CVE-2021-24329.md): WP Super Cache \< 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, WP Super Cache)
- [CVE-2021-24330](https://cve.now/CVE-2021-24330.md): Funnel Builder by CartFlows \< 1.6.13 - Authenticated Stored XSS via FB Pixel ID and Google Analytics ID (no CVSS, Funnel Builder by CartFlows – Create High Converting Sales…)
- [CVE-2021-24331](https://cve.now/CVE-2021-24331.md): Smooth Scroll Page Up/Down Buttons \< 1.4 - Authenticated Stored XSS (no CVSS, Smooth Scroll Page Up/Down Buttons)
- [CVE-2021-24333](https://cve.now/CVE-2021-24333.md): Content Copy Protection & Prevent Image Save \<= 1.3 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, Content Copy Protection & Prevent Image Save)
- [CVE-2021-24334](https://cve.now/CVE-2021-24334.md): Instant Images WordPress Plugin \< 4.4.0.1 - Authenticated Stored XSS & XFS (no CVSS, Instant Images – One Click Unsplash Uploads)
- [CVE-2021-24335](https://cve.now/CVE-2021-24335.md): Car Repair Services \< 4.0 - Unauthenticated Reflected XSS & XFS (no CVSS, Car Repair Services & Auto Mechanic)
- [CVE-2021-24312](https://cve.now/CVE-2021-24312.md): WP Super Cache \< 1.7.3 - Authenticated Remote Code Execution (no CVSS, Automattic WP Super Cache)
- [CVE-2021-24313](https://cve.now/CVE-2021-24313.md): WP Prayer \< 1.6.2 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, WP Prayer)
- [CVE-2021-24316](https://cve.now/CVE-2021-24316.md): Mediumish \<= 1.0.47 - Unauthenticated Reflected Cross-Site Scripting (XSS) (no CVSS, WowThemes Mediumish)
- [CVE-2021-24317](https://cve.now/CVE-2021-24317.md): Listeo \< 1.6.11 - Multiple XSS & XFS vulnerabilities (no CVSS, purethemes Listeo)
- [CVE-2021-24318](https://cve.now/CVE-2021-24318.md): Listeo \< 1.6.11 - Multiple Authenticated IDOR Vulnerabilities (no CVSS, purethemes Listeo)
- [CVE-2021-24319](https://cve.now/CVE-2021-24319.md): Bello \< 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS (no CVSS, BoldThemes Bello - Directory & Listing)
- [CVE-2021-24320](https://cve.now/CVE-2021-24320.md): Bello \< 1.6.0 - Unauthenticated Reflected XSS & XFS (no CVSS, BoldThemes Bello - Directory & Listing)
- [CVE-2021-24321](https://cve.now/CVE-2021-24321.md): Bello \< 1.6.0 - Unauthenticated Blind SQL Injection (no CVSS, BoldThemes Bello - Directory & Listing)
- [CVE-2021-24309](https://cve.now/CVE-2021-24309.md): Weekly Schedule \< 3.4.3 - Authenticated Stored XSS (no CVSS, Weekly Schedule)
- [CVE-2021-24310](https://cve.now/CVE-2021-24310.md): Photo Gallery \< 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2021-24311](https://cve.now/CVE-2021-24311.md): External Media \< 1.0.34 - Authenticated Arbitrary File Upload (no CVSS, External Media)
- [CVE-2021-27828](https://cve.now/CVE-2021-27828.md): SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content (no CVSS)
- [CVE-2021-25932](https://cve.now/CVE-2021-25932.md): In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through (no CVSS, OpenNMS)
- [CVE-2021-33181](https://cve.now/CVE-2021-33181.md): Server-Side Request Forgery (SSRF) vulnerability in webapi component in Synology Video Station before 2.4.10-1632 allows remote authenticate (CVSS 6.6, Synology Video Station)
- [CVE-2021-33182](https://cve.now/CVE-2021-33182.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in PDF Viewer component in Synology DiskStation (CVSS 5.0, Synology DiskStation Manager)
- [CVE-2021-33184](https://cve.now/CVE-2021-33184.md): Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15-3563 allows remote (CVSS 7.7, Synology Download Station)
- [CVE-2021-33183](https://cve.now/CVE-2021-33183.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management component in Synolo (CVSS 7.9, Synology Docker)
- [CVE-2021-29088](https://cve.now/CVE-2021-29088.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation Manager (DSM) before (CVSS 7.8, Synology DiskStation Manager)
- [CVE-2021-29092](https://cve.now/CVE-2021-29092.md): Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allo (CVSS 8.8, Synology Photo Station)
- [CVE-2021-33180](https://cve.now/CVE-2021-33180.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in Synology Media Server (CVSS 7.3, Synology Media Server)
- [CVE-2021-31684](https://cve.now/CVE-2021-31684.md): A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which causes a denial of se (no CVSS, net.minidev:json-smart)
- [CVE-2021-32027](https://cve.now/CVE-2021-32027.md): A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. (no CVSS, postgresql)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.