CVEs published June 10, 2021
75 CVEs were published on June 10, 2021: 0 critical, 2 high.
- Published
- 75
- Critical
- 0
- High
- 2
- Medium
- 7
- Low
- 2
- Unrated
- 64
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Apache Software Foundation Apache HTTP Server
- 7
- Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- 4
- Edge Client for Windows
- 2
- McAfee Agent for Windows
- 2
- openSUSE Leap · openSUSE Factory
- 2
- BIG-IQ
- 1
- BlueZ
- 1
- expand-hash
- 1
- Flask-Unchained
- 1
- Jenkins project Jenkins Kiuwan Plugin · org.jenkins-ci.plug…
- 1
High 2
Medium, low and unrated 73
- CVE-2021-23393Open RedirectFlask-Unchained
- CVE-2021-26199An issue was discovered in JerryScript 2.4.0.
- CVE-2021-26198An issue was discovered in JerryScript 2.4.0.
- CVE-2021-26197An issue was discovered in JerryScript 2.4.0.
- CVE-2021-26195An issue was discovered in JerryScript 2.4.0.
- CVE-2021-26194An issue was discovered in JerryScript 2.4.0.
- CVE-2020-23323There is a heap-buffer-overflow at re-parser.c in re_parse_char_escape in JerryScript 2.2.0.
- CVE-2020-23322There is an Assertion in 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LE
- CVE-2020-23321There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0.
- CVE-2020-23320There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2
- CVE-2020-23319There is an Assertion in '(flags >> CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags >> CBC_STACK_ADJUST_
- CVE-2020-23314There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0.
- CVE-2020-23313There is an Assertion 'scope_stack_p > context_p->scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScri
- CVE-2020-23312There is an Assertion 'context.status_flags & PARSER_SCANNING_SUCCESSFUL' failed at js-parser.c:2185 in parser_parse_source in JerryScript 2
- CVE-2020-23311There is an Assertion 'context_p->token.type == LEXER_RIGHT_BRACE || context_p->token.type == LEXER_ASSIGN || context_p->token.type == LEXER
- CVE-2020-23310There is an Assertion 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_functi
- CVE-2020-23309There is an Assertion 'context_p->stack_depth == context_p->context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements
- CVE-2020-23308There is an Assertion 'context_p->stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScr
- CVE-2020-23306There is a stack-overflow at ecma-regexp-object.c:535 in ecma_regexp_match in JerryScript 2.2.0.
- CVE-2020-23303There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0.
- CVE-2020-23302There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0
- CVE-2021-20329Specific cstrings input may not be properly validated in the Go DriverMongoDB Go Driver · go.mongodb.org/mongo-driver
- CVE-2021-31839Incorrect permissions on McAfee Agent for Windows event folderMcAfee Agent for Windows
- CVE-2021-34557XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs.
- CVE-2021-27345A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS
- CVE-2020-25467A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of servic
- CVE-2021-27347Use after free in lzma_decompress_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted co
- CVE-2021-33031In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user managem
- CVE-2020-24667Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
- CVE-2020-24671Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03.
- CVE-2020-24663Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
- CVE-2020-24668Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03.
- CVE-2021-23022On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder hasEdge Client for Windows
- CVE-2021-34546An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switc
- CVE-2021-31538LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal.
- CVE-2021-31927An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated att
- CVE-2021-34555OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a mult
- CVE-2021-23023On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IPEdge Client for Windows
- CVE-2021-23024On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command executioBIG-IQ
- CVE-2021-31659TP-Link TL-SG2005, TL-SG2008, etc.
- CVE-2021-21665A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to anJenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2021-21666Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a Jenkins project Jenkins Kiuwan Plugin · org.jenkins-ci.plug…
- CVE-2021-21663A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2021-21664An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to coJenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2021-21662A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumeraJenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…
- CVE-2021-21661Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with OveraJenkins project Jenkins Kubernetes CLI Plugin · org.jenkins…
- CVE-2021-31658TP-Link TL-SG2005, TL-SG2008, etc.
- CVE-2020-24662SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS.
- CVE-2021-31928Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator.
- CVE-2021-34547PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation.
- CVE-2021-31929Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as frau
- CVE-2021-3040Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code executionPalo Alto Networks Bridgecrew Checkov
- CVE-2021-3039Prisma Cloud Compute: User role authorization secret for Console leaked through log file exportPalo Alto Networks Prisma Cloud Compute
- CVE-2021-25949Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code set-getter
- CVE-2021-25948Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may leadexpand-hash
- CVE-2021-25322python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to rootopenSUSE Leap · openSUSE Factory
- CVE-2019-25046The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.
- CVE-2021-31997python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to rootopenSUSE Leap · openSUSE Factory
- CVE-2021-21736A smart camera product of ZTE is impacted by a permission and access control vulnerability.ZXHN HS562
- CVE-2021-31998inn: %post calls user owned file allowing local privilege escalation to rootSUSE Linux Enterprise Server 11-SP3 · openSUSE Backports… +1
- CVE-2021-21735A ZTE product has an information leak vulnerability.ZXHN H168N
- CVE-2021-20293A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly hRESTEasy · org.jboss.resteasy:resteasy-bom +1
- CVE-2021-20081Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to executManageEngine ServiceDesk Plus
- CVE-2021-34539An issue was discovered in CubeCoders AMP before 2.1.1.8.
- CVE-2021-34363The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive thefuck
- CVE-2021-30641Unexpected URL matching with 'MergeSlashes OFF'Apache Software Foundation Apache HTTP Server
- CVE-2021-26691Apache HTTP Server mod_session response handling heap overflowApache Software Foundation Apache HTTP Server
- CVE-2021-26690mod_session NULL pointer dereferenceApache Software Foundation Apache HTTP Server
- CVE-2020-13950mod_proxy_http NULL pointer dereferenceApache Software Foundation Apache HTTP Server
- CVE-2020-35452mod_auth_digest possible stack overflow by one nul byteApache Software Foundation Apache HTTP Server
- CVE-2020-13938Improper Handling of Insufficient PrivilegesApache Software Foundation Apache HTTP Server
- CVE-2019-17567mod_proxy_wstunnel tunneling of non Upgraded connectionsApache Software Foundation Apache HTTP Server
- CVE-2021-3588memory contents disclosure in cli_feat_read_cbBlueZ