# CVEs published 2021-06-07

63 CVEs were published on June 7, 2021: 2 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-26079](https://cve.now/CVE-2021-26079.md): The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26080](https://cve.now/CVE-2021-26080.md): EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version 8.13.6, and from 8. (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26078](https://cve.now/CVE-2021-26078.md): The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-32671](https://cve.now/CVE-2021-32671.md): XSS vulnerability with translator (CVSS 10.0, flarum core · flarum/core)
- [CVE-2021-32670](https://cve.now/CVE-2021-32670.md): Reflected cross-site scripting issue in Datasette (CVSS 7.2, simonw datasette · datasette)
- [CVE-2021-3277](https://cve.now/CVE-2021-3277.md): Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in (no CVSS)
- [CVE-2021-29504](https://cve.now/CVE-2021-29504.md): Improper Certificate Validation in WP-CLI framework (CVSS 9.1, wp-cli · wp-cli/wp-cli)
- [CVE-2021-23391](https://cve.now/CVE-2021-23391.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 7.3, calipso)
- [CVE-2021-20259](https://cve.now/CVE-2021-20259.md): A flaw was found in the Foreman project. (no CVSS, foreman · foreman\_fog\_proxmox)
- [CVE-2020-25716](https://cve.now/CVE-2020-25716.md): A flaw was found in Cloudforms. (no CVSS, Cloudforms)
- [CVE-2020-1750](https://cve.now/CVE-2020-1750.md): A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amoun (no CVSS, machine-config-operator-container)
- [CVE-2020-1742](https://cve.now/CVE-2020-1742.md): An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. (no CVSS, nmstate/kubernetes-nmstate-handler)
- [CVE-2020-1690](https://cve.now/CVE-2020-1690.md): An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container (no CVSS, openstack-selinux)
- [CVE-2021-30542](https://cve.now/CVE-2021-30542.md): Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30543](https://cve.now/CVE-2021-30543.md): Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30540](https://cve.now/CVE-2021-30540.md): Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via (no CVSS, Google Chrome)
- [CVE-2021-30538](https://cve.now/CVE-2021-30538.md): Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten (no CVSS, Google Chrome)
- [CVE-2021-30539](https://cve.now/CVE-2021-30539.md): Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten (no CVSS, Google Chrome)
- [CVE-2021-30537](https://cve.now/CVE-2021-30537.md): Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a cr (no CVSS, Google Chrome)
- [CVE-2021-30535](https://cve.now/CVE-2021-30535.md): Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM (no CVSS, Google Chrome)
- [CVE-2021-30536](https://cve.now/CVE-2021-30536.md): Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a craf (no CVSS, Google Chrome)
- [CVE-2021-30533](https://cve.now/CVE-2021-30533.md): Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restri (CVSS 6.5, KEV, Google Chrome)
- [CVE-2021-30534](https://cve.now/CVE-2021-30534.md): Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restr (no CVSS, Google Chrome)
- [CVE-2021-30532](https://cve.now/CVE-2021-30532.md): Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten (no CVSS, Google Chrome)
- [CVE-2021-30530](https://cve.now/CVE-2021-30530.md): Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory acc (no CVSS, Google Chrome)
- [CVE-2021-30531](https://cve.now/CVE-2021-30531.md): Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass conten (no CVSS, Google Chrome)
- [CVE-2021-30529](https://cve.now/CVE-2021-30529.md): Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30527](https://cve.now/CVE-2021-30527.md): Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to (no CVSS, Google Chrome)
- [CVE-2021-30526](https://cve.now/CVE-2021-30526.md): Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious exten (no CVSS, Google Chrome)
- [CVE-2021-30524](https://cve.now/CVE-2021-30524.md): Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30525](https://cve.now/CVE-2021-30525.md): Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30523](https://cve.now/CVE-2021-30523.md): Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-30521](https://cve.now/CVE-2021-30521.md): Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory (no CVSS, Google Chrome)
- [CVE-2021-30522](https://cve.now/CVE-2021-30522.md): Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2018-25015](https://cve.now/CVE-2018-25015.md): An issue was discovered in the Linux kernel before 4.14.16. (no CVSS)
- [CVE-2020-36386](https://cve.now/CVE-2020-36386.md): An issue was discovered in the Linux kernel before 5.8.1. (no CVSS)
- [CVE-2020-36387](https://cve.now/CVE-2020-36387.md): An issue was discovered in the Linux kernel before 5.8.2. (no CVSS)
- [CVE-2019-25045](https://cve.now/CVE-2019-25045.md): An issue was discovered in the Linux kernel before 5.0.19. (no CVSS)
- [CVE-2021-29621](https://cve.now/CVE-2021-29621.md): Observable Response Discrepancy in Flask-AppBuilder (CVSS 5.3, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2020-18268](https://cve.now/CVE-2020-18268.md): Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the co (no CVSS)
- [CVE-2020-18265](https://cve.now/CVE-2020-18265.md): Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component (no CVSS)
- [CVE-2020-18264](https://cve.now/CVE-2020-18264.md): Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component (no CVSS)
- [CVE-2021-33896](https://cve.now/CVE-2021-33896.md): Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. (no CVSS)
- [CVE-2020-1719](https://cve.now/CVE-2020-1719.md): A flaw was found in wildfly. (no CVSS, Wildfly · org.wildfly.bom:wildfly)
- [CVE-2021-20517](https://cve.now/CVE-2021-20517.md): IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. (CVSS 6.4, IBM WebSphere Application Server ND)
- [CVE-2020-5008](https://cve.now/CVE-2020-5008.md): IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. (CVSS 3.7, IBM DataPower Gateway)
- [CVE-2021-20699](https://cve.now/CVE-2021-20699.md): Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior (no CVSS, Sharp Display Solutions UN462A · Sharp Display Solution… +10)
- [CVE-2021-20698](https://cve.now/CVE-2021-20698.md): Sharp NEC Displays (UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492VS R1.300 and prior t (no CVSS, Sharp Display Solutions UN462A · Sharp Display Solution… +10)
- [CVE-2021-22222](https://cve.now/CVE-2021-22222.md): Infinite loop in DVB-S2-BB dissector in Wireshark 3.4.0 to 3.4.5 allows denial of service via packet injection or crafted capture file (CVSS 7.5, The Wireshark Foundation Wireshark)
- [CVE-2021-29099](https://cve.now/CVE-2021-29099.md): There is a SQL injection vulnerability in ArcGIS Server (CVSS 5.3, Esri ArcGIS Server)
- [CVE-2021-33904](https://cve.now/CVE-2021-33904.md): In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. (no CVSS)
- [CVE-2021-24337](https://cve.now/CVE-2021-24337.md): Video Embed \<= 1.0 - Authenticated (subscriber+) SQL Injection (no CVSS, Video Embed)
- [CVE-2021-24340](https://cve.now/CVE-2021-24340.md): WP Statistics \< 13.0.8 - Unauthenticated SQL Injection (no CVSS, VeronaLabs WP Statistics)
- [CVE-2021-24342](https://cve.now/CVE-2021-24342.md): JNews \< 8.0.6 - Reflected Cross-Site Scripting (XSS) (no CVSS, JNews)
- [CVE-2021-24343](https://cve.now/CVE-2021-24343.md): iFlyChat – WordPress Chat \< 4.7.0 - Admin+ Stored Cross-Site Scripting (XSS) (no CVSS, iFlyChat – WordPress Chat)
- [CVE-2021-24344](https://cve.now/CVE-2021-24344.md): Easy Preloader \<= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Easy Preloader)
- [CVE-2021-24336](https://cve.now/CVE-2021-24336.md): FlightLog \<= 3.0.2 - Authenticated (editor+) SQL Injection (no CVSS, FlightLog)
- [CVE-2020-36383](https://cve.now/CVE-2020-36383.md): PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. (CVSS 6.1)
- [CVE-2020-36384](https://cve.now/CVE-2020-36384.md): PageLayer before 1.3.5 allows reflected XSS via color settings. (CVSS 6.1)
- [CVE-2021-28382](https://cve.now/CVE-2021-28382.md): Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. (no CVSS)
- [CVE-2020-26885](https://cve.now/CVE-2020-26885.md): An issue was discovered in 2sic 2sxc before 11.22. (no CVSS)
- [CVE-2020-36385](https://cve.now/CVE-2020-36385.md): An issue was discovered in the Linux kernel before 5.10. (no CVSS)
- [CVE-2021-30528](https://cve.now/CVE-2021-30528.md): Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the rend (no CVSS, Google Chrome)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.