CVEs published June 2, 2021
76 CVEs were published on June 2, 2021: 3 critical, 4 high.
- Published
- 76
- Critical
- 3
- High
- 4
- Medium
- 15
- Low
- 1
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- pillow
- 6
- QEMU
- 4
- IBM Engineering Test Management · IBM Rational Quality M… +5
- 3
- IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5
- 3
- McAfee Database Security
- 3
- Red Hat Satellite
- 3
- Synology Photo Station
- 3
- IBM Engineering Test Management · IBM Rational Rhapsody… +5
- 2
- IBM Rational Collaborative Lifecycle Management · IBM Ra… +5
- 2
- IBM Rational DOORS Next Generation · IBM Rational Engine… +5
- 2
Critical 3
- CVE-2021-23895Authorized deserialization of untrusted data in McAfee DBSecMcAfee Database Security
- CVE-2021-23894Unauthorized deserialization of untrusted data in McAfee DBSecMcAfee Database Security
- CVE-2021-29089Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo Synology Photo Station
High 4
- CVE-2020-4495IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access coIBM Engineering Test Management · IBM Rational Quality M… +5
- CVE-2021-32625Redis vulnerability in STRALGO LCS on 32-bit systemsredis
- CVE-2021-29090Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo StatioSynology Photo Station
- CVE-2021-29091Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo Synology Photo Station
Medium, low and unrated 69
- CVE-2020-35442FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/
- CVE-2020-35441FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php.
- CVE-2021-29670IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Test Management · IBM Rational Rhapsody… +5
- CVE-2021-29668IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Test Management · IBM Rational Quality M… +5
- CVE-2021-20371IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is retuIBM Rational Collaborative Lifecycle Management · IBM Ra… +5
- CVE-2021-20348IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5
- CVE-2021-20347IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).IBM Rational DOORS Next Generation · IBM Rational Engine… +5
- CVE-2021-20346IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).IBM Rational Collaborative Lifecycle Management · IBM Ra… +5
- CVE-2021-20345IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5
- CVE-2021-20343IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF).IBM Engineering Test Management · IBM Rational Quality M… +5
- CVE-2021-20338IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Test Management · IBM Rational Rhapsody… +5
- CVE-2020-5030IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5
- CVE-2020-4977IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting.IBM Rational Quality Manager · IBM Rational Rhapsody Mod… +5
- CVE-2020-4732IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security rIBM Rational DOORS Next Generation · IBM Rational Engine… +5
- CVE-2020-22056A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config_input function in af_acrossover.c.
- CVE-2020-22054A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av_dict_set function in dict.c.
- CVE-2020-25362The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphawa
- CVE-2020-24862The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via th
- CVE-2015-1877The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables,
- CVE-2011-3656Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7 allows remote attackers to inject arbitrary web
- CVE-2021-3529A flaw was found in noobaa-core in versions before 5.7.0.noobaa-core
- CVE-2020-22051A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter_frame function in vf_tile.c.
- CVE-2009-0948Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in file before 5.02.
- CVE-2009-0947Multiple integer overflows in the (1) cdf_read_property_info and (2) cdf_read_sat functions in file before 5.02.
- CVE-2020-6950Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.org.glassfish:mojarra-parent
- CVE-2021-3499A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewallopenshift/ovn-kubernetes · github.com/ovn-org/ovn-kubernetes
- CVE-2020-22049A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile_open_sector function in wtvdec.c.
- CVE-2020-22048A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff_frame_pool_get function in framepool.c.
- CVE-2021-31921Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected servi
- CVE-2020-24870Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
- CVE-2020-27661A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU.
- CVE-2021-28677An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2021-28678An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2021-25288An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2021-25287An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2020-22046A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv_float_dsp_allocl function in libavutil/float_dsp.c
- CVE-2021-3468A flaw was found in avahi in versions 0.6 up to 0.8.avahi
- CVE-2021-3522GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags.GStreamer
- CVE-2021-3530A flaw was discovered in GNU libiberty within demangle_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36.binutils
- CVE-2021-28675An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2021-26707The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to imerge-deep
- CVE-2019-12067The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header
- CVE-2018-10195lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that caus
- CVE-2017-8761In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusableswift
- CVE-2021-3546An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including QEMU
- CVE-2021-3545An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includiQEMU
- CVE-2021-3544Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0.QEMU
- CVE-2021-3538A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7satori/go.uuid · github.com/satori/go.uuid
- CVE-2020-35503A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0.QEMU
- CVE-2020-35510A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001.jboss-remoting · org.jboss.remoting:jboss-remoting
- CVE-2020-35514An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift.openshift/machine-config-operator
- CVE-2021-23896Cleartext Transmission of Sensitive Information in McAfee DBSecMcAfee Database Security
- CVE-2021-24012An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connectFortinet FortiOS
- CVE-2020-14388A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforceRed Hat 3scale API Management
- CVE-2021-3520There's a flaw in lz4.lz4
- CVE-2020-14380An account takeover flaw was found in Red Hat Satellite 6.7.2 onward.Red Hat Satellite
- CVE-2020-14371A credential leak vulnerability was found in Red Hat Satellite.Red Hat Satellite
- CVE-2020-14340A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage colXNIO · org.jboss.xnio:xnio-nio
- CVE-2020-14335A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy.Red Hat Satellite
- CVE-2020-14336A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets.Openshift
- CVE-2020-14317It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - CWildfly
- CVE-2020-14326A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes.RESTEasy · org.jboss.resteasy:resteasy-bom
- CVE-2020-10771A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests.Infinispan
- CVE-2020-10743It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercKibana
- CVE-2020-10742A flaw was found in the Linux kernel.Kernel
- CVE-2020-6641Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow Fortinet FortiPresence
- CVE-2021-28676An issue was discovered in Pillow before 8.2.0.pillow
- CVE-2021-30474aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
- CVE-2021-31855KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations.