CVEs published June 7, 2021
63 CVEs were published on June 7, 2021: 2 critical, 3 high. 1 is now in CISA KEV.
- Published
- 63
- Critical
- 2
- High
- 3
- Medium
- 6
- Low
- 1
- Unrated
- 51
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Google Chrome
- 22
- Atlassian Jira Server · Atlassian Jira Data Center
- 3
- Sharp Display Solutions UN462A · Sharp Display Solution… +10
- 2
- calipso
- 1
- Cloudforms
- 1
- dpgaspar Flask-AppBuilder · flask-appbuilder
- 1
- Easy Preloader
- 1
- Esri ArcGIS Server
- 1
- flarum core · flarum/core
- 1
- FlightLog
- 1
Critical 2
High 3
- CVE-2021-32670Reflected cross-site scripting issue in Datasettesimonw datasette · datasette
- CVE-2021-23391Arbitrary File Write via Archive Extraction (Zip Slip)calipso
- CVE-2021-22222Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture fileThe Wireshark Foundation Wireshark
Medium, low and unrated 58
- CVE-2021-26079The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7,Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-26080EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8.Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-26078The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, andAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-3277Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in
- CVE-2021-20259A flaw was found in the Foreman project.foreman · foreman_fog_proxmox
- CVE-2020-25716A flaw was found in Cloudforms.Cloudforms
- CVE-2020-1750A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amounmachine-config-operator-container
- CVE-2020-1742An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler.nmstate/kubernetes-nmstate-handler
- CVE-2020-1690An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a containeropenstack-selinux
- CVE-2021-30542Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30543Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30540Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing viaGoogle Chrome
- CVE-2021-30538Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass contenGoogle Chrome
- CVE-2021-30539Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass contenGoogle Chrome
- CVE-2021-30537Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crGoogle Chrome
- CVE-2021-30535Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMGoogle Chrome
- CVE-2021-30536Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafGoogle Chrome
- CVE-2021-30533Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restriGoogle Chrome
- CVE-2021-30534Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrGoogle Chrome
- CVE-2021-30532Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass contenGoogle Chrome
- CVE-2021-30530Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory accGoogle Chrome
- CVE-2021-30531Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass contenGoogle Chrome
- CVE-2021-30529Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30527Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to Google Chrome
- CVE-2021-30526Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extenGoogle Chrome
- CVE-2021-30524Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension Google Chrome
- CVE-2021-30525Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30523Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-30521Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memoryGoogle Chrome
- CVE-2021-30522Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2018-25015An issue was discovered in the Linux kernel before 4.14.16.
- CVE-2020-36386An issue was discovered in the Linux kernel before 5.8.1.
- CVE-2020-36387An issue was discovered in the Linux kernel before 5.8.2.
- CVE-2019-25045An issue was discovered in the Linux kernel before 5.0.19.
- CVE-2021-29621Observable Response Discrepancy in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2020-18268Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the co
- CVE-2020-18265Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component
- CVE-2020-18264Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component
- CVE-2021-33896Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators.
- CVE-2020-1719A flaw was found in wildfly.Wildfly · org.wildfly.bom:wildfly
- CVE-2021-20517IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories.IBM WebSphere Application Server ND
- CVE-2020-5008IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters.IBM DataPower Gateway
- CVE-2021-20699Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior Sharp Display Solutions UN462A · Sharp Display Solution… +10
- CVE-2021-20698Sharp NEC Displays (UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior tSharp Display Solutions UN462A · Sharp Display Solution… +10
- CVE-2021-29099There is a SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2021-33904In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS.
- CVE-2021-24337Video Embed <= 1.0 - Authenticated (subscriber+) SQL InjectionVideo Embed
- CVE-2021-24340WP Statistics < 13.0.8 - Unauthenticated SQL InjectionVeronaLabs WP Statistics
- CVE-2021-24342JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)JNews
- CVE-2021-24343iFlyChat – WordPress Chat < 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS)iFlyChat – WordPress Chat
- CVE-2021-24344Easy Preloader <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS)Easy Preloader
- CVE-2021-24336FlightLog <= 3.0.2 - Authenticated (editor+) SQL InjectionFlightLog
- CVE-2020-36383PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.
- CVE-2020-36384PageLayer before 1.3.5 allows reflected XSS via color settings.
- CVE-2021-28382Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.
- CVE-2020-26885An issue was discovered in 2sic 2sxc before 11.22.
- CVE-2020-36385An issue was discovered in the Linux kernel before 5.10.
- CVE-2021-30528Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the rendGoogle Chrome