# CVEs published 2021-06-02

76 CVEs were published on June 2, 2021: 3 critical, 4 high. Days are UTC.

- [CVE-2020-35442](https://cve.now/CVE-2020-35442.md): FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background via Front/lib/Action/ (no CVSS)
- [CVE-2020-35441](https://cve.now/CVE-2020-35441.md): FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.class.php. (no CVSS)
- [CVE-2021-29670](https://cve.now/CVE-2021-29670.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Test Management · IBM Rational Rhapsody… +5)
- [CVE-2021-29668](https://cve.now/CVE-2021-29668.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Test Management · IBM Rational Quality M… +5)
- [CVE-2021-20371](https://cve.now/CVE-2021-20371.md): IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an error message is retu (CVSS 4.3, IBM Rational Collaborative Lifecycle Management · IBM Ra… +5)
- [CVE-2021-20348](https://cve.now/CVE-2021-20348.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5)
- [CVE-2021-20347](https://cve.now/CVE-2021-20347.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Rational DOORS Next Generation · IBM Rational Engine… +5)
- [CVE-2021-20346](https://cve.now/CVE-2021-20346.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM Ra… +5)
- [CVE-2021-20345](https://cve.now/CVE-2021-20345.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5)
- [CVE-2021-20343](https://cve.now/CVE-2021-20343.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Engineering Test Management · IBM Rational Quality M… +5)
- [CVE-2021-20338](https://cve.now/CVE-2021-20338.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Test Management · IBM Rational Rhapsody… +5)
- [CVE-2020-5030](https://cve.now/CVE-2020-5030.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Rhapsody Model Manager · IBM Rational Quali… +5)
- [CVE-2020-4977](https://cve.now/CVE-2020-4977.md): IBM Engineering Lifecycle Optimization - Publishing is vulnerable to stored cross-site scripting. (CVSS 5.4, IBM Rational Quality Manager · IBM Rational Rhapsody Mod… +5)
- [CVE-2020-4732](https://cve.now/CVE-2020-4732.md): IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to obtain sensitive information due to lack of security r (CVSS 4.3, IBM Rational DOORS Next Generation · IBM Rational Engine… +5)
- [CVE-2020-4495](https://cve.now/CVE-2020-4495.md): IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access co (CVSS 8.8, IBM Engineering Test Management · IBM Rational Quality M… +5)
- [CVE-2021-32625](https://cve.now/CVE-2021-32625.md): Redis vulnerability in STRALGO LCS on 32-bit systems (CVSS 7.5, redis)
- [CVE-2020-22056](https://cve.now/CVE-2020-22056.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the config\_input function in af\_acrossover.c. (no CVSS)
- [CVE-2020-22054](https://cve.now/CVE-2020-22054.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the av\_dict\_set function in dict.c. (no CVSS)
- [CVE-2020-25362](https://cve.now/CVE-2020-25362.md): The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphawa (no CVSS)
- [CVE-2020-24862](https://cve.now/CVE-2020-24862.md): The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via th (no CVSS)
- [CVE-2015-1877](https://cve.now/CVE-2015-1877.md): The open\_generic\_xdg\_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, (no CVSS)
- [CVE-2011-3656](https://cve.now/CVE-2011-3656.md): Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7 allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2021-3529](https://cve.now/CVE-2021-3529.md): A flaw was found in noobaa-core in versions before 5.7.0. (no CVSS, noobaa-core)
- [CVE-2020-22051](https://cve.now/CVE-2020-22051.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the filter\_frame function in vf\_tile.c. (no CVSS)
- [CVE-2009-0948](https://cve.now/CVE-2009-0948.md): Multiple buffer overflows in the (1) cdf\_read\_sat, (2) cdf\_read\_long\_sector\_chain, and (3) cdf\_read\_ssat function in file before 5.02. (no CVSS)
- [CVE-2009-0947](https://cve.now/CVE-2009-0947.md): Multiple integer overflows in the (1) cdf\_read\_property\_info and (2) cdf\_read\_sat functions in file before 5.02. (no CVSS)
- [CVE-2020-6950](https://cve.now/CVE-2020-6950.md): Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. (no CVSS, org.glassfish:mojarra-parent)
- [CVE-2021-3499](https://cve.now/CVE-2021-3499.md): A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewall (no CVSS, openshift/ovn-kubernetes · github.com/ovn-org/ovn-kubernetes)
- [CVE-2020-22049](https://cve.now/CVE-2020-22049.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the wtvfile\_open\_sector function in wtvdec.c. (no CVSS)
- [CVE-2020-22048](https://cve.now/CVE-2020-22048.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the ff\_frame\_pool\_get function in framepool.c. (no CVSS)
- [CVE-2021-31921](https://cve.now/CVE-2021-31921.md): Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can access unexpected servi (no CVSS)
- [CVE-2020-24870](https://cve.now/CVE-2020-24870.md): Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify\_process\_dng\_fields in identify.cpp. (no CVSS)
- [CVE-2020-27661](https://cve.now/CVE-2020-27661.md): A divide-by-zero issue was found in dwc2\_handle\_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. (no CVSS)
- [CVE-2021-28677](https://cve.now/CVE-2021-28677.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2021-28678](https://cve.now/CVE-2021-28678.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2021-25288](https://cve.now/CVE-2021-25288.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2021-25287](https://cve.now/CVE-2021-25287.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2020-22046](https://cve.now/CVE-2020-22046.md): A Denial of Service vulnerability exists in FFmpeg 4.2 due to a memory leak in the avpriv\_float\_dsp\_allocl function in libavutil/float\_dsp.c (no CVSS)
- [CVE-2021-3468](https://cve.now/CVE-2021-3468.md): A flaw was found in avahi in versions 0.6 up to 0.8. (no CVSS, avahi)
- [CVE-2021-3522](https://cve.now/CVE-2021-3522.md): GStreamer before 1.18.4 may perform an out-of-bounds read when handling certain ID3v2 tags. (CVSS 5.5, GStreamer)
- [CVE-2021-3530](https://cve.now/CVE-2021-3530.md): A flaw was discovered in GNU libiberty within demangle\_path() in rust-demangle.c, as distributed in GNU Binutils version 2.36. (no CVSS, binutils)
- [CVE-2021-28675](https://cve.now/CVE-2021-28675.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2021-26707](https://cve.now/CVE-2021-26707.md): The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to i (no CVSS, merge-deep)
- [CVE-2019-12067](https://cve.now/CVE-2019-12067.md): The ahci\_commit\_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header (no CVSS)
- [CVE-2018-10195](https://cve.now/CVE-2018-10195.md): lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that caus (no CVSS)
- [CVE-2017-8761](https://cve.now/CVE-2017-8761.md): In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusable (no CVSS, swift)
- [CVE-2021-3546](https://cve.now/CVE-2021-3546.md): An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including (no CVSS, QEMU)
- [CVE-2021-3545](https://cve.now/CVE-2021-3545.md): An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includi (no CVSS, QEMU)
- [CVE-2021-3544](https://cve.now/CVE-2021-3544.md): Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. (no CVSS, QEMU)
- [CVE-2021-3538](https://cve.now/CVE-2021-3538.md): A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7 (no CVSS, satori/go.uuid · github.com/satori/go.uuid)
- [CVE-2020-35503](https://cve.now/CVE-2020-35503.md): A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. (no CVSS, QEMU)
- [CVE-2020-35510](https://cve.now/CVE-2020-35510.md): A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. (no CVSS, jboss-remoting · org.jboss.remoting:jboss-remoting)
- [CVE-2020-35514](https://cve.now/CVE-2020-35514.md): An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. (no CVSS, openshift/machine-config-operator)
- [CVE-2021-23896](https://cve.now/CVE-2021-23896.md): Cleartext Transmission of Sensitive Information in McAfee DBSec (CVSS 3.2, McAfee Database Security)
- [CVE-2021-23895](https://cve.now/CVE-2021-23895.md): Authorized deserialization of untrusted data in McAfee DBSec (CVSS 9.0, McAfee Database Security)
- [CVE-2021-23894](https://cve.now/CVE-2021-23894.md): Unauthorized deserialization of untrusted data in McAfee DBSec (CVSS 9.6, McAfee Database Security)
- [CVE-2021-24012](https://cve.now/CVE-2021-24012.md): An improper following of a certificate's chain of trust vulnerability in FortiGate versions 6.4.0 to 6.4.4 may allow an LDAP user to connect (CVSS 6.5, Fortinet FortiOS)
- [CVE-2020-14388](https://cve.now/CVE-2020-14388.md): A flaw was found in the Red Hat 3scale API Management Platform, where member permissions for an API's admin portal were not properly enforce (no CVSS, Red Hat 3scale API Management)
- [CVE-2021-3520](https://cve.now/CVE-2021-3520.md): There's a flaw in lz4. (no CVSS, lz4)
- [CVE-2020-14380](https://cve.now/CVE-2020-14380.md): An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. (no CVSS, Red Hat Satellite)
- [CVE-2020-14371](https://cve.now/CVE-2020-14371.md): A credential leak vulnerability was found in Red Hat Satellite. (no CVSS, Red Hat Satellite)
- [CVE-2020-14340](https://cve.now/CVE-2020-14340.md): A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage col (no CVSS, XNIO · org.jboss.xnio:xnio-nio)
- [CVE-2020-14335](https://cve.now/CVE-2020-14335.md): A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. (no CVSS, Red Hat Satellite)
- [CVE-2020-14336](https://cve.now/CVE-2020-14336.md): A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. (no CVSS, Openshift)
- [CVE-2020-14317](https://cve.now/CVE-2020-14317.md): It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - C (no CVSS, Wildfly)
- [CVE-2020-14326](https://cve.now/CVE-2020-14326.md): A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. (no CVSS, RESTEasy · org.jboss.resteasy:resteasy-bom)
- [CVE-2020-10771](https://cve.now/CVE-2020-10771.md): A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. (no CVSS, Infinispan)
- [CVE-2020-10743](https://cve.now/CVE-2020-10743.md): It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to interc (no CVSS, Kibana)
- [CVE-2020-10742](https://cve.now/CVE-2020-10742.md): A flaw was found in the Linux kernel. (no CVSS, Kernel)
- [CVE-2020-6641](https://cve.now/CVE-2020-6641.md): Two authorization bypass through user-controlled key vulnerabilities in the Fortinet FortiPresence 2.1.0 administration interface may allow (CVSS 4.3, Fortinet FortiPresence)
- [CVE-2021-29089](https://cve.now/CVE-2021-29089.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail component in Synology Photo (CVSS 9.8, Synology Photo Station)
- [CVE-2021-29090](https://cve.now/CVE-2021-29090.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in Synology Photo Statio (CVSS 7.2, Synology Photo Station)
- [CVE-2021-29091](https://cve.now/CVE-2021-29091.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management component in Synology Photo (CVSS 7.7, Synology Photo Station)
- [CVE-2021-28676](https://cve.now/CVE-2021-28676.md): An issue was discovered in Pillow before 8.2.0. (no CVSS, pillow)
- [CVE-2021-30474](https://cve.now/CVE-2021-30474.md): aom\_dsp/grain\_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free. (no CVSS)
- [CVE-2021-31855](https://cve.now/CVE-2021-31855.md): KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.