# CVEs published 2021-06-03

53 CVEs were published on June 3, 2021: 0 critical, 4 high. Days are UTC.

- [CVE-2021-33838](https://cve.now/CVE-2021-33838.md): Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Ch (no CVSS)
- [CVE-2021-33839](https://cve.now/CVE-2021-33839.md): Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Publi (no CVSS)
- [CVE-2021-33840](https://cve.now/CVE-2021-33840.md): The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) (no CVSS)
- [CVE-2020-36009](https://cve.now/CVE-2020-36009.md): OBottle 2.0 in \\c\\g.php contains an arbitrary file download vulnerability. (no CVSS)
- [CVE-2020-36008](https://cve.now/CVE-2020-36008.md): OBottle 2.0 in \\c\\t.php contains an arbitrary file write vulnerability. (no CVSS)
- [CVE-2020-36007](https://cve.now/CVE-2020-36007.md): AppCMS 2.0.101 in /admin/template/tpl\_app.php has a cross site scripting attack vulnerability which allows the attacker to obtain sensitive (no CVSS)
- [CVE-2020-36006](https://cve.now/CVE-2020-36006.md): AppCMS 2.0.101 in /admin/info.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. (no CVSS)
- [CVE-2020-36005](https://cve.now/CVE-2020-36005.md): AppCMS 2.0.101 in /admin/app.php has an arbitrary file deletion vulnerability which allows attackers to delete arbitrary files on the site. (no CVSS)
- [CVE-2020-36004](https://cve.now/CVE-2020-36004.md): AppCMS 2.0.101 in /admin/download\_frame.php has a SQL injection vulnerability which allows attackers to obtain sensitive database informatio (no CVSS)
- [CVE-2021-32662](https://cve.now/CVE-2021-32662.md): TechDocs mkdocs.yml path traversal (CVSS 6.5, backstage · @backstage/techdocs-common)
- [CVE-2021-32666](https://cve.now/CVE-2021-32666.md): Asset DoS vulnerability (CVSS 6.5, wireapp wire-ios)
- [CVE-2021-32665](https://cve.now/CVE-2021-32665.md): Verified groups not reliable (CVSS 8.8, wireapp wire-ios)
- [CVE-2020-35970](https://cve.now/CVE-2020-35970.md): An issue was discovered in YzmCMS 5.8. (no CVSS)
- [CVE-2020-35971](https://cve.now/CVE-2020-35971.md): A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin (no CVSS)
- [CVE-2020-35972](https://cve.now/CVE-2020-35972.md): An issue was discovered in YzmCMS V5.8. (no CVSS)
- [CVE-2020-35973](https://cve.now/CVE-2020-35973.md): An issue was discovered in zzcms2020. (no CVSS)
- [CVE-2019-14584](https://cve.now/CVE-2019-14584.md): Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access. (no CVSS, Tianocore EDK2)
- [CVE-2021-25947](https://cve.now/CVE-2021-25947.md): Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to r (no CVSS, nestie)
- [CVE-2021-3469](https://cve.now/CVE-2021-3469.md): Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. (no CVSS, Foreman)
- [CVE-2021-22334](https://cve.now/CVE-2021-22334.md): There is an Improper Access Control vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22335](https://cve.now/CVE-2021-22335.md): There is a Memory Buffer Improper Operation Limit vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22337](https://cve.now/CVE-2021-22337.md): There is an Information Disclosure vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22333](https://cve.now/CVE-2021-22333.md): There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-32661](https://cve.now/CVE-2021-32661.md): TechDocs object element script injection (CVSS 6.8, backstage · @backstage/plugin-techdocs)
- [CVE-2021-32660](https://cve.now/CVE-2021-32660.md): TechDocs content sanitization bypass (CVSS 6.8, backstage · @backstage/techdocs-common)
- [CVE-2021-22336](https://cve.now/CVE-2021-22336.md): There is an Improper Control of Generation of Code vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22324](https://cve.now/CVE-2021-22324.md): There is a Credentials Management Errors vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22325](https://cve.now/CVE-2021-22325.md): There is an Information Disclosure vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22322](https://cve.now/CVE-2021-22322.md): There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22316](https://cve.now/CVE-2021-22316.md): There is a Missing Authentication for Critical Function vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22317](https://cve.now/CVE-2021-22317.md): There is an Information Disclosure vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22313](https://cve.now/CVE-2021-22313.md): There is a Security Function vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22308](https://cve.now/CVE-2021-22308.md): There is a Business Logic Errors vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2020-28469](https://cve.now/CVE-2020-28469.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, glob-parent)
- [CVE-2021-20380](https://cve.now/CVE-2021-20380.md): IBM QRadar Advisor With Watson App 1.1 through 2.5 as used on IBM QRadar SIEM 7.4 could allow a remote user to obtain sensitive information (CVSS 5.3, IBM Qradar Advisor)
- [CVE-2020-21003](https://cve.now/CVE-2020-21003.md): Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php. (no CVSS)
- [CVE-2020-21005](https://cve.now/CVE-2020-21005.md): WellCMS 2.0 beta3 is vulnerable to File Upload. (no CVSS)
- [CVE-2021-32926](https://cve.now/CVE-2021-32926.md): When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that include (CVSS 5.9, Micro800, MicroLogix)
- [CVE-2021-33806](https://cve.now/CVE-2021-33806.md): The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data in ObjectInputStrea (no CVSS)
- [CVE-2021-28848](https://cve.now/CVE-2021-28848.md): Mintty before 3.4.5 allows remote servers to cause a denial of service (Windows GUI hang) by telling the Mintty window to change its title r (no CVSS)
- [CVE-2021-3569](https://cve.now/CVE-2021-3569.md): A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. (no CVSS, libtpms)
- [CVE-2021-26584](https://cve.now/CVE-2021-26584.md): A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. (no CVSS, HPE OneView for VMware vCenter with Operations Manager and…)
- [CVE-2021-28847](https://cve.now/CVE-2021-28847.md): MobaXterm before 21.0 allows remote servers to cause a denial of service (Windows GUI hang) via tab title change requests that are sent repe (no CVSS)
- [CVE-2021-32923](https://cve.now/CVE-2021-32923.md): HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those withi (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-32460](https://cve.now/CVE-2021-32460.md): The Trend Micro Maximum Security 2021 (v17) consumer product is vulnerable to an improper access control vulnerability in the installer whic (no CVSS, Trend Micro Maxmium Security)
- [CVE-2021-24023](https://cve.now/CVE-2021-24023.md): An improper input validation in FortiAI v1.4.0 and earlier may allow an authenticated user to gain system shell access via a malicious paylo (CVSS 7.8, Fortinet FortiAI)
- [CVE-2021-22130](https://cve.now/CVE-2021-22130.md): A stack-based buffer overflow vulnerability in FortiProxy physical appliance CLI 2.0.0 to 2.0.1, 1.2.0 to 1.2.9, 1.1.0 to 1.1.6, 1.0.0 to 1. (CVSS 6.7, Fortinet FortiProxy)
- [CVE-2021-31830](https://cve.now/CVE-2021-31830.md): Cross site Scripting (XSS) vulnerability in McAfee DBSec (CVSS 5.9, McAfee Database Security)
- [CVE-2021-31831](https://cve.now/CVE-2021-31831.md): Incorrect access to deleted scripts vulnerability in McAfee DBSec (CVSS 4.9, McAfee Database Security)
- [CVE-2021-28812](https://cve.now/CVE-2021-28812.md): Command Injection Vulnerability in Video Station (CVSS 8.8, QNAP Systems Video Station)
- [CVE-2021-28807](https://cve.now/CVE-2021-28807.md): Post-Authentication Reflected XSS Vulnerability in Q'center (CVSS 7.7, QNAP Systems Q’center)
- [CVE-2021-28806](https://cve.now/CVE-2021-28806.md): DOM-Based XSS Vulnerability in QTS and QuTS hero (CVSS 5.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2021-33815](https://cve.now/CVE-2021-33815.md): dwa\_uncompress in libavcodec/exr.c in FFmpeg 4.4 allows an out-of-bounds array access because dc\_count is not strictly checked. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.