# CVEs published 2021-06-04

60 CVEs were published on June 4, 2021: 0 critical, 12 high. Days are UTC.

- [CVE-2021-32641](https://cve.now/CVE-2021-32641.md): Reflected XSS when using flashMessages (CVSS 8.1, auth0 lock · auth0-lock)
- [CVE-2021-31249](https://cve.now/CVE-2021-31249.md): A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of (no CVSS)
- [CVE-2021-31250](https://cve.now/CVE-2021-31250.md): Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to (no CVSS)
- [CVE-2021-31251](https://cve.now/CVE-2021-31251.md): An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows o (no CVSS)
- [CVE-2021-31252](https://cve.now/CVE-2021-31252.md): An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology (no CVSS)
- [CVE-2021-26928](https://cve.now/CVE-2021-26928.md): BIRD through 2.0.7 does not provide functionality for password authentication of BGP peers. (CVSS 6.8)
- [CVE-2021-29500](https://cve.now/CVE-2021-29500.md): Missing validation of JWT signature (CVSS 7.5, fxbin bubble-fireworks)
- [CVE-2020-29321](https://cve.now/CVE-2020-29321.md): The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an (no CVSS, D-Link Router DIR-868L)
- [CVE-2020-29324](https://cve.now/CVE-2020-29324.md): The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that all (no CVSS, D-Link Router DIR-895L)
- [CVE-2020-29323](https://cve.now/CVE-2020-29323.md): The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware (no CVSS, D-Link Router DIR-885L-MFC)
- [CVE-2020-29322](https://cve.now/CVE-2020-29322.md): The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an (no CVSS, D-Link Router DIR-880L)
- [CVE-2021-30520](https://cve.now/CVE-2021-30520.md): Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2021-30519](https://cve.now/CVE-2021-30519.md): Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments (no CVSS, Google Chrome)
- [CVE-2021-30517](https://cve.now/CVE-2021-30517.md): Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30518](https://cve.now/CVE-2021-30518.md): Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-30516](https://cve.now/CVE-2021-30516.md): Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process t (no CVSS, Google Chrome)
- [CVE-2021-30514](https://cve.now/CVE-2021-30514.md): Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2021-30515](https://cve.now/CVE-2021-30515.md): Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-30513](https://cve.now/CVE-2021-30513.md): Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30511](https://cve.now/CVE-2021-30511.md): Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2021-30512](https://cve.now/CVE-2021-30512.md): Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process t (no CVSS, Google Chrome)
- [CVE-2021-30510](https://cve.now/CVE-2021-30510.md): Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2021-30508](https://cve.now/CVE-2021-30508.md): Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain featu (no CVSS, Google Chrome)
- [CVE-2021-30509](https://cve.now/CVE-2021-30509.md): Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2021-30507](https://cve.now/CVE-2021-30507.md): Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the (no CVSS, Google Chrome)
- [CVE-2021-30506](https://cve.now/CVE-2021-30506.md): Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to ins (no CVSS, Google Chrome)
- [CVE-2021-1564](https://cve.now/CVE-2021-1564.md): Cisco Video Surveillance 7000 Series IP Cameras Cisco Discovery and Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1563](https://cve.now/CVE-2021-1563.md): Cisco Video Surveillance 7000 Series IP Cameras Cisco Discovery and Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1544](https://cve.now/CVE-2021-1544.md): Cisco Webex Meetings Client Software Logging Information Disclosure Vulnerability (CVSS 5.5, Cisco Webex Meetings)
- [CVE-2021-1540](https://cve.now/CVE-2021-1540.md): Cisco ASR 5000 Series Software Authorization Bypass Vulnerabilities (CVSS 8.1, Cisco ASR 5000 Series Software)
- [CVE-2021-1539](https://cve.now/CVE-2021-1539.md): Cisco ASR 5000 Series Software Authorization Bypass Vulnerabilities (CVSS 8.1, Cisco ASR 5000 Series Software)
- [CVE-2021-1538](https://cve.now/CVE-2021-1538.md): Cisco Common Services Platform Collector Command Injection Vulnerability (CVSS 4.7, Cisco Common Services Platform Collector Software)
- [CVE-2021-1537](https://cve.now/CVE-2021-1537.md): Cisco ThousandEyes Recorder Information Disclosure Vulnerability (CVSS 6.2, Cisco ThousandEyes Recorder Application)
- [CVE-2021-1536](https://cve.now/CVE-2021-1536.md): Cisco Webex Meetings, Webex Network Recording Player, and Webex Teams DLL Injection Vulnerability (CVSS 4.8, Cisco Webex Teams)
- [CVE-2021-1528](https://cve.now/CVE-2021-1528.md): Cisco SD-WAN Software Privilege Escalation Vulnerability (CVSS 7.8, Cisco SD-WAN Solution)
- [CVE-2021-1527](https://cve.now/CVE-2021-1527.md): Cisco Webex Player Memory Corruption Vulnerability (CVSS 5.3, Cisco Webex Meetings)
- [CVE-2021-1526](https://cve.now/CVE-2021-1526.md): Cisco Webex Player Memory Corruption Vulnerability (CVSS 7.8, Cisco Webex Meetings)
- [CVE-2021-1525](https://cve.now/CVE-2021-1525.md): Cisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability (CVSS 4.7, Cisco WebEx Meetings Server)
- [CVE-2021-1517](https://cve.now/CVE-2021-1517.md): Cisco Webex Meetings and Webex Meetings Server Multimedia Sharing Security Bypass Vulnerability (CVSS 5.0, Cisco WebEx Meetings Server)
- [CVE-2021-1503](https://cve.now/CVE-2021-1503.md): Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability (CVSS 7.8, Cisco Webex Meetings)
- [CVE-2021-1502](https://cve.now/CVE-2021-1502.md): Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability (CVSS 7.8, Cisco Webex Meetings)
- [CVE-2020-36139](https://cve.now/CVE-2020-36139.md): BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter. (no CVSS)
- [CVE-2020-36140](https://cve.now/CVE-2020-36140.md): BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=e (no CVSS)
- [CVE-2020-36141](https://cve.now/CVE-2020-36141.md): BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Conte (no CVSS)
- [CVE-2020-36142](https://cve.now/CVE-2020-36142.md): BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. (no CVSS)
- [CVE-2021-33054](https://cve.now/CVE-2021-33054.md): SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. (no CVSS)
- [CVE-2021-28091](https://cve.now/CVE-2021-28091.md): Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. (no CVSS)
- [CVE-2021-27657](https://cve.now/CVE-2021-27657.md): Metasys Improper Privilege Management (CVSS 8.8, Johnson Controls Metasys)
- [CVE-2020-27302](https://cve.now/CVE-2020-27302.md): A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "memcpy" function, when (no CVSS)
- [CVE-2020-27301](https://cve.now/CVE-2020-27301.md): A stack buffer overflow in Realtek RTL8710 (and other Ameba-based devices) can lead to remote code execution via the "AES\_UnWRAP" function, (no CVSS)
- [CVE-2021-22516](https://cve.now/CVE-2021-22516.md): Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. (no CVSS, Secure API Manager (SAPIM).)
- [CVE-2020-7469](https://cve.now/CVE-2020-7469.md): In FreeBSD 12.2-STABLE before r367402, 11.4-STABLE before r368202, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p (no CVSS, FreeBSD)
- [CVE-2021-3565](https://cve.now/CVE-2021-3565.md): A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. (no CVSS, tpm2-tools)
- [CVE-2021-26994](https://cve.now/CVE-2021-26994.md): Clustered Data ONTAP versions prior to 9.7P13 and 9.8P3 are susceptible to a vulnerability which could allow single workloads to cause a Den (no CVSS, Clustered Data ONTAP)
- [CVE-2020-36382](https://cve.now/CVE-2020-36382.md): OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authent (no CVSS, OpenVPN Access Server)
- [CVE-2020-15077](https://cve.now/CVE-2020-15077.md): OpenVPN Access Server 2.8.7 and earlier versions allows a remote attackers to bypass authentication and access control channel data on serve (no CVSS, OpenVPN Access Server)
- [CVE-2021-3491](https://cve.now/CVE-2021-3491.md): Linux kernel io\_uring PROVIDE\_BUFFERS MAX\_RW\_COUNT bypass (CVSS 7.8, Linux kernel)
- [CVE-2021-3490](https://cve.now/CVE-2021-3490.md): Linux kernel eBPF bitwise ops ALU32 bounds tracking (CVSS 7.8, Linux kernel)
- [CVE-2021-3489](https://cve.now/CVE-2021-3489.md): Linux kernel eBPF RINGBUF map oversized allocation (CVSS 7.8, Linux kernel)
- [CVE-2021-30475](https://cve.now/CVE-2021-30475.md): aom\_dsp/noise\_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.