# CVEs published 2021-06-08

108 CVEs were published on June 8, 2021: 4 critical, 46 high. 7 are now in CISA KEV. Days are UTC.

- [CVE-2021-33742](https://cve.now/CVE-2021-33742.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 7.5, KEV, Microsoft Windows)
- [CVE-2021-33739](https://cve.now/CVE-2021-33739.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 8.4, KEV, Microsoft Windows)
- [CVE-2021-33741](https://cve.now/CVE-2021-33741.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Edge)
- [CVE-2021-31985](https://cve.now/CVE-2021-31985.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2021-31980](https://cve.now/CVE-2021-31980.md): Microsoft Intune Management Extension Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Intune management extension)
- [CVE-2021-31983](https://cve.now/CVE-2021-31983.md): Paint 3D Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Paint)
- [CVE-2021-31978](https://cve.now/CVE-2021-31978.md): Microsoft Defender Denial of Service Vulnerability (CVSS 5.5, Microsoft Malware Protection Engine)
- [CVE-2021-31976](https://cve.now/CVE-2021-31976.md): Server for NFS Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-31977](https://cve.now/CVE-2021-31977.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 8.6, Microsoft Windows)
- [CVE-2021-31975](https://cve.now/CVE-2021-31975.md): Server for NFS Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-31973](https://cve.now/CVE-2021-31973.md): Windows GPSVC Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31974](https://cve.now/CVE-2021-31974.md): Server for NFS Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-31972](https://cve.now/CVE-2021-31972.md): Event Tracing for Windows Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31971](https://cve.now/CVE-2021-31971.md): Windows HTML Platforms Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Ser… +1)
- [CVE-2021-31969](https://cve.now/CVE-2021-31969.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31970](https://cve.now/CVE-2021-31970.md): Windows TCP/IP Driver Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31968](https://cve.now/CVE-2021-31968.md): Windows Remote Desktop Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-31966](https://cve.now/CVE-2021-31966.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31967](https://cve.now/CVE-2021-31967.md): VP9 Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft VP9 Video Extensions)
- [CVE-2021-31965](https://cve.now/CVE-2021-31965.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 5.7, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31963](https://cve.now/CVE-2021-31963.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31964](https://cve.now/CVE-2021-31964.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31962](https://cve.now/CVE-2021-31962.md): Kerberos AppContainer Security Feature Bypass Vulnerability (CVSS 9.4, Microsoft Windows)
- [CVE-2021-31960](https://cve.now/CVE-2021-31960.md): Windows Bind Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-31958](https://cve.now/CVE-2021-31958.md): Windows NTLM Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-31959](https://cve.now/CVE-2021-31959.md): Scripting Engine Memory Corruption Vulnerability (CVSS 6.4, Microsoft Windows)
- [CVE-2021-31957](https://cve.now/CVE-2021-31957.md): ASP.NET Core Denial of Service Vulnerability (CVSS 5.9, Microsoft Visual Studio · Microsoft .NET Core +3)
- [CVE-2021-31955](https://cve.now/CVE-2021-31955.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, KEV, Microsoft Windows)
- [CVE-2021-31956](https://cve.now/CVE-2021-31956.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-31954](https://cve.now/CVE-2021-31954.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31952](https://cve.now/CVE-2021-31952.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31953](https://cve.now/CVE-2021-31953.md): Windows Filter Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31951](https://cve.now/CVE-2021-31951.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31949](https://cve.now/CVE-2021-31949.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31950](https://cve.now/CVE-2021-31950.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31948](https://cve.now/CVE-2021-31948.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-31945](https://cve.now/CVE-2021-31945.md): Paint 3D Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Paint)
- [CVE-2021-31946](https://cve.now/CVE-2021-31946.md): Paint 3D Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Paint)
- [CVE-2021-31944](https://cve.now/CVE-2021-31944.md): 3D Viewer Information Disclosure Vulnerability (CVSS 5.0, Microsoft 3D Viewer)
- [CVE-2021-31942](https://cve.now/CVE-2021-31942.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2021-31943](https://cve.now/CVE-2021-31943.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2021-31941](https://cve.now/CVE-2021-31941.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2021-31939](https://cve.now/CVE-2021-31939.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Online Server · Microsoft Office +2)
- [CVE-2021-31940](https://cve.now/CVE-2021-31940.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2021-31938](https://cve.now/CVE-2021-31938.md): Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code - Kubernetes Tools)
- [CVE-2021-31199](https://cve.now/CVE-2021-31199.md): Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability (CVSS 5.2, KEV, Microsoft Windows)
- [CVE-2021-31201](https://cve.now/CVE-2021-31201.md): Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability (CVSS 5.2, KEV, Microsoft Windows)
- [CVE-2021-26420](https://cve.now/CVE-2021-26420.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-1675](https://cve.now/CVE-2021-1675.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-26414](https://cve.now/CVE-2021-26414.md): Windows DCOM Server Security Feature Bypass (CVSS 4.8, Microsoft Windows)
- [CVE-2021-33712](https://cve.now/CVE-2021-33712.md): A vulnerability has been identified in Mendix SAML Module (All versions \< V2.1.2). (no CVSS, Siemens Mendix SAML Module)
- [CVE-2021-27387](https://cve.now/CVE-2021-27387.md): A vulnerability has been identified in Simcenter Femap 2020.2 (All versions \< V2020.2.MP3), Simcenter Femap 2021.1 (All versions \< V2021.1.M (no CVSS, Siemens Simcenter Femap)
- [CVE-2021-27390](https://cve.now/CVE-2021-27390.md): A vulnerability has been identified in JT2Go (All versions \< V13.1.0.3), Teamcenter Visualization (All versions \< V13.1.0.3). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2021-27399](https://cve.now/CVE-2021-27399.md): A vulnerability has been identified in Simcenter Femap 2020.2 (All versions \< V2020.2.MP3), Simcenter Femap 2021.1 (All versions \< V2021.1.M (no CVSS, Siemens Simcenter Femap)
- [CVE-2021-31340](https://cve.now/CVE-2021-31340.md): A vulnerability has been identified in SIMATIC RF166C (All versions \> V1.1 and \< V1.3.2), SIMATIC RF185C (All versions \> V1.1 and \< V1.3.2), (no CVSS, Siemens SIMATIC RF166C · Siemens SIMATIC RF185C +23)
- [CVE-2021-31342](https://cve.now/CVE-2021-31342.md): The ugeom2d.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack pro (no CVSS, Siemens Solid Edge)
- [CVE-2021-31343](https://cve.now/CVE-2021-31343.md): The jutil.dll library in all versions of Solid Edge SE2020 before 2020MP14 and all versions of Solid Edge SE2021 before SE2021MP5 lack prope (no CVSS, Siemens Solid Edge)
- [CVE-2020-26136](https://cve.now/CVE-2020-26136.md): In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication. (no CVSS, silverstripe/graphql)
- [CVE-2021-22216](https://cve.now/CVE-2021-22216.md): A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolle (CVSS 6.5, GitLab)
- [CVE-2021-22220](https://cve.now/CVE-2021-22220.md): An issue has been discovered in GitLab affecting all versions starting with 13.10. (CVSS 6.1, GitLab)
- [CVE-2020-28713](https://cve.now/CVE-2020-28713.md): Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notif (no CVSS)
- [CVE-2021-22221](https://cve.now/CVE-2021-22221.md): An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before (CVSS 6.5, GitLab)
- [CVE-2021-26474](https://cve.now/CVE-2021-26474.md): UNAUTHENTICATED SERVER SIDE REQUEST FORGERY IN VEMBU PRODUCTS (CVSS 8.6)
- [CVE-2021-26473](https://cve.now/CVE-2021-26473.md): Unauthenticated arbitrary file upload and command execution in Vembu products (CVSS 9.8)
- [CVE-2021-22219](https://cve.now/CVE-2021-22219.md): All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting fr (CVSS 4.4, GitLab)
- [CVE-2021-26472](https://cve.now/CVE-2021-26472.md): Unauthenticated remote command execution with SYSTEM privileges in Vembu products (CVSS 10.0)
- [CVE-2021-26471](https://cve.now/CVE-2021-26471.md): Unauthenticated remote command execution in Vembu products (CVSS 9.8)
- [CVE-2021-32658](https://cve.now/CVE-2021-32658.md): Sensitive data may not be removed from storage on account removal (CVSS 4.7, nextcloud security-advisories)
- [CVE-2021-22217](https://cve.now/CVE-2021-22217.md): A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolle (CVSS 6.5, GitLab)
- [CVE-2021-21559](https://cve.now/CVE-2021-21559.md): Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the (CVSS 7.1, Dell NetWorker)
- [CVE-2021-21558](https://cve.now/CVE-2021-21558.md): Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. (CVSS 8.2, Dell NetWorker)
- [CVE-2021-22213](https://cve.now/CVE-2021-22213.md): A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access tok (CVSS 8.8, GitLab)
- [CVE-2021-28293](https://cve.now/CVE-2021-28293.md): Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Password feature. (no CVSS)
- [CVE-2020-25817](https://cve.now/CVE-2020-25817.md): SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. (no CVSS, silverstripe/framework)
- [CVE-2021-33203](https://cve.now/CVE-2021-33203.md): Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. (no CVSS, django)
- [CVE-2021-32674](https://cve.now/CVE-2021-32674.md): Remote Code Execution via traversal in TAL expressions (CVSS 8.8, zopefoundation Zope · zope)
- [CVE-2020-26138](https://cve.now/CVE-2020-26138.md): In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation. (no CVSS, silverstripe/framework)
- [CVE-2021-32673](https://cve.now/CVE-2021-32673.md): Remote Command Execution in reg-keygen-git-hash-plugin (CVSS 8.8, reg-viz reg-suit · reg-keygen-git-hash-plugin)
- [CVE-2021-32015](https://cve.now/CVE-2021-32015.md): In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized a (no CVSS)
- [CVE-2021-22215](https://cve.now/CVE-2021-22215.md): An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' (CVSS 7.5, GitLab)
- [CVE-2021-33190](https://cve.now/CVE-2021-33190.md): Bypass network access control (no CVSS, Apache Software Foundation Apache APISIX Dashboard)
- [CVE-2021-22218](https://cve.now/CVE-2021-22218.md): All versions of GitLab CE/EE starting from 12.8 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting f (CVSS 2.6, GitLab)
- [CVE-2021-22214](https://cve.now/CVE-2021-22214.md): When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all ve (CVSS 6.8, GitLab)
- [CVE-2021-33176](https://cve.now/CVE-2021-33176.md): VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to (no CVSS, vernemq)
- [CVE-2021-33175](https://cve.now/CVE-2021-33175.md): EMQ X Broker versions prior to 4.2.8 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the han (no CVSS, EMQ Technologies EMQ X Broker)
- [CVE-2021-34280](https://cve.now/CVE-2021-34280.md): Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a (no CVSS)
- [CVE-2021-30357](https://cve.now/CVE-2021-30357.md): SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supplied, which allows p (no CVSS, SSL Network Extender Client for Linux)
- [CVE-2021-22550](https://cve.now/CVE-2021-22550.md): Enclave memory overwrite/overread vulnerability in Asylo UntrustedCacheMalloc::GetBuffer (CVSS 6.5, Google Asylo)
- [CVE-2021-22549](https://cve.now/CVE-2021-22549.md): Arbitrary enclave memory overwrite vulnerability in Asylo TrustedPrimitives::UntrustedCall (CVSS 6.5, Google Asylo)
- [CVE-2021-22548](https://cve.now/CVE-2021-22548.md): Arbitrary enclave memory overread vulnerability in Asylo TrustedPrimitives::UntrustedCall (CVSS 6.5, Google Asylo)
- [CVE-2020-26515](https://cve.now/CVE-2020-26515.md): An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. (no CVSS)
- [CVE-2020-26517](https://cve.now/CVE-2020-26517.md): A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. (no CVSS)
- [CVE-2021-32106](https://cve.now/CVE-2021-32106.md): In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the (no CVSS, icecoder/icecoder)
- [CVE-2020-26516](https://cve.now/CVE-2020-26516.md): A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. (no CVSS)
- [CVE-2021-22212](https://cve.now/CVE-2021-22212.md): ntpkeygen can generate keys that ntpd fails to parse. (CVSS 4.0, ntpsec)
- [CVE-2021-3564](https://cve.now/CVE-2021-3564.md): A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user attach malicious HCI (no CVSS, kernel)
- [CVE-2021-26945](https://cve.now/CVE-2021-26945.md): An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. (no CVSS, OpenEXR)
- [CVE-2021-22116](https://cve.now/CVE-2021-22116.md): RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client con (no CVSS, RabbitMQ)
- [CVE-2021-31738](https://cve.now/CVE-2021-31738.md): Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. (no CVSS)
- [CVE-2021-23392](https://cve.now/CVE-2021-23392.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, locutus)
- [CVE-2021-28811](https://cve.now/CVE-2021-28811.md): Vulnerability in Roon Server (CVSS 7.2, Roon Labs Roon Server)
- [CVE-2021-28810](https://cve.now/CVE-2021-28810.md): Vulnerability in Roon Server (CVSS 7.5, Roon Labs Roon Server)
- [CVE-2021-23169](https://cve.now/CVE-2021-23169.md): A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. (no CVSS, OpenEXR)
- [CVE-2021-23215](https://cve.now/CVE-2021-23215.md): An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. (no CVSS, OpenEXR)
- [CVE-2021-26260](https://cve.now/CVE-2021-26260.md): An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. (no CVSS, OpenEXR)
- [CVE-2021-31807](https://cve.now/CVE-2021-31807.md): An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. (no CVSS)
- [CVE-2021-33560](https://cve.now/CVE-2021-33560.md): Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel att (CVSS 7.5)
- [CVE-2021-33571](https://cve.now/CVE-2021-33571.md): In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate\_ipv4\_address, and validate\_ipv46\_address do not (no CVSS, django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.