# CVEs published 2021-06-10

75 CVEs were published on June 10, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-23393](https://cve.now/CVE-2021-23393.md): Open Redirect (CVSS 5.4, Flask-Unchained)
- [CVE-2021-26199](https://cve.now/CVE-2021-26199.md): An issue was discovered in JerryScript 2.4.0. (no CVSS)
- [CVE-2021-26198](https://cve.now/CVE-2021-26198.md): An issue was discovered in JerryScript 2.4.0. (no CVSS)
- [CVE-2021-26197](https://cve.now/CVE-2021-26197.md): An issue was discovered in JerryScript 2.4.0. (no CVSS)
- [CVE-2021-26195](https://cve.now/CVE-2021-26195.md): An issue was discovered in JerryScript 2.4.0. (no CVSS)
- [CVE-2021-26194](https://cve.now/CVE-2021-26194.md): An issue was discovered in JerryScript 2.4.0. (no CVSS)
- [CVE-2020-23323](https://cve.now/CVE-2020-23323.md): There is a heap-buffer-overflow at re-parser.c in re\_parse\_char\_escape in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-23322](https://cve.now/CVE-2020-23322.md): There is an Assertion in 'context\_p-\>token.type == LEXER\_RIGHT\_BRACE || context\_p-\>token.type == LEXER\_ASSIGN || context\_p-\>token.type == LE (no CVSS)
- [CVE-2020-23321](https://cve.now/CVE-2020-23321.md): There is a heap-buffer-overflow at lit-strings.c:431 in lit\_read\_code\_unit\_from\_utf8 in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-23320](https://cve.now/CVE-2020-23320.md): There is an Assertion in 'context\_p-\>next\_scanner\_info\_p-\>type == SCANNER\_TYPE\_FUNCTION' in parser\_parse\_function\_arguments in JerryScript 2 (no CVSS)
- [CVE-2020-23319](https://cve.now/CVE-2020-23319.md): There is an Assertion in '(flags \>\> CBC\_STACK\_ADJUST\_SHIFT) \>= CBC\_STACK\_ADJUST\_BASE || (CBC\_STACK\_ADJUST\_BASE - (flags \>\> CBC\_STACK\_ADJUST\_ (no CVSS)
- [CVE-2020-23314](https://cve.now/CVE-2020-23314.md): There is an Assertion 'block\_found' failed at js-parser-statm.c:2003 parser\_parse\_try\_statement\_end in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-23313](https://cve.now/CVE-2020-23313.md): There is an Assertion 'scope\_stack\_p \> context\_p-\>scope\_stack\_p' failed at js-scanner-util.c:2510 in scanner\_literal\_is\_created in JerryScri (no CVSS)
- [CVE-2020-23312](https://cve.now/CVE-2020-23312.md): There is an Assertion 'context.status\_flags & PARSER\_SCANNING\_SUCCESSFUL' failed at js-parser.c:2185 in parser\_parse\_source in JerryScript 2 (no CVSS)
- [CVE-2020-23311](https://cve.now/CVE-2020-23311.md): There is an Assertion 'context\_p-\>token.type == LEXER\_RIGHT\_BRACE || context\_p-\>token.type == LEXER\_ASSIGN || context\_p-\>token.type == LEXER (no CVSS)
- [CVE-2020-23310](https://cve.now/CVE-2020-23310.md): There is an Assertion 'context\_p-\>next\_scanner\_info\_p-\>type == SCANNER\_TYPE\_FUNCTION' failed at js-parser-statm.c:733 in parser\_parse\_functi (no CVSS)
- [CVE-2020-23309](https://cve.now/CVE-2020-23309.md): There is an Assertion 'context\_p-\>stack\_depth == context\_p-\>context\_stack\_depth' failed at js-parser-statm.c:2756 in parser\_parse\_statements (no CVSS)
- [CVE-2020-23308](https://cve.now/CVE-2020-23308.md): There is an Assertion 'context\_p-\>stack\_top\_uint8 == LEXER\_EXPRESSION\_START' at js-parser-expr.c:3565 in parser\_parse\_expression in JerryScr (no CVSS)
- [CVE-2020-23306](https://cve.now/CVE-2020-23306.md): There is a stack-overflow at ecma-regexp-object.c:535 in ecma\_regexp\_match in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-23303](https://cve.now/CVE-2020-23303.md): There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem\_pools\_collect\_empty in JerryScript 2.2.0. (no CVSS)
- [CVE-2020-23302](https://cve.now/CVE-2020-23302.md): There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma\_ref\_ecma\_string in JerryScript 2.2.0 (no CVSS)
- [CVE-2021-20329](https://cve.now/CVE-2021-20329.md): Specific cstrings input may not be properly validated in the Go Driver (CVSS 6.8, MongoDB Go Driver · go.mongodb.org/mongo-driver)
- [CVE-2021-31840](https://cve.now/CVE-2021-31840.md): DLL preload vulnerability in McAfee Agent for Windows (CVSS 7.3, McAfee Agent for Windows)
- [CVE-2021-31839](https://cve.now/CVE-2021-31839.md): Incorrect permissions on McAfee Agent for Windows event folder (CVSS 4.8, McAfee Agent for Windows)
- [CVE-2021-34557](https://cve.now/CVE-2021-34557.md): XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. (no CVSS)
- [CVE-2021-27345](https://cve.now/CVE-2021-27345.md): A null pointer dereference was discovered in ucompthread in stream.c in Irzip 0.631 which allows attackers to cause a denial of service (DOS (no CVSS)
- [CVE-2020-25467](https://cve.now/CVE-2020-25467.md): A null pointer dereference was discovered lzo\_decompress\_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of servic (no CVSS)
- [CVE-2021-27347](https://cve.now/CVE-2021-27347.md): Use after free in lzma\_decompress\_buf function in stream.c in Irzip 0.631 allows attackers to cause Denial of Service (DoS) via a crafted co (no CVSS)
- [CVE-2021-33031](https://cve.now/CVE-2021-33031.md): In LabCup before \<v2\_next\_18022, it is possible to use the save API to perform unauthorized actions for users without access to user managem (no CVSS)
- [CVE-2020-24667](https://cve.now/CVE-2020-24667.md): Trace Financial CRESTBridge \<6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. (no CVSS)
- [CVE-2020-24671](https://cve.now/CVE-2020-24671.md): Trace Financial CRESTBridge \<6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. (no CVSS)
- [CVE-2020-24663](https://cve.now/CVE-2020-24663.md): Trace Financial CRESTBridge \<6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. (no CVSS)
- [CVE-2020-24668](https://cve.now/CVE-2020-24668.md): Trace Financial Crest Bridge \<6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. (no CVSS)
- [CVE-2021-23022](https://cve.now/CVE-2021-23022.md): On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, the BIG-IP Edge Client Windows Installer Service's temporary folder has (no CVSS, Edge Client for Windows)
- [CVE-2021-34546](https://cve.now/CVE-2021-34546.md): An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switc (no CVSS)
- [CVE-2021-31538](https://cve.now/CVE-2021-31538.md): LANCOM R&S Unified Firewall (UF) devices running LCOS FX 10.5 allow Relative Path Traversal. (no CVSS)
- [CVE-2021-31927](https://cve.now/CVE-2021-31927.md): An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \<2021.1.0.1 allows any authenticated att (no CVSS)
- [CVE-2021-34555](https://cve.now/CVE-2021-34555.md): OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a mult (no CVSS)
- [CVE-2021-23023](https://cve.now/CVE-2021-23023.md): On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP (no CVSS, Edge Client for Windows)
- [CVE-2021-23024](https://cve.now/CVE-2021-23024.md): On version 8.0.x before 8.0.0.1, and all 6.x and 7.x versions, the BIG-IQ Configuration utility has an authenticated remote command executio (no CVSS, BIG-IQ)
- [CVE-2021-31659](https://cve.now/CVE-2021-31659.md): TP-Link TL-SG2005, TL-SG2008, etc. (no CVSS)
- [CVE-2021-21665](https://cve.now/CVE-2021-21665.md): A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2021-21666](https://cve.now/CVE-2021-21666.md): Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a (no CVSS, Jenkins project Jenkins Kiuwan Plugin · org.jenkins-ci.plug…)
- [CVE-2021-21663](https://cve.now/CVE-2021-21663.md): A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2021-21664](https://cve.now/CVE-2021-21664.md): An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to co (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2021-21662](https://cve.now/CVE-2021-21662.md): A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Overall/Read permission to enumera (no CVSS, Jenkins project Jenkins XebiaLabs XL Deploy Plugin · com.xe…)
- [CVE-2021-21661](https://cve.now/CVE-2021-21661.md): Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overa (no CVSS, Jenkins project Jenkins Kubernetes CLI Plugin · org.jenkins…)
- [CVE-2021-31658](https://cve.now/CVE-2021-31658.md): TP-Link TL-SG2005, TL-SG2008, etc. (no CVSS)
- [CVE-2020-24662](https://cve.now/CVE-2020-24662.md): SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) \<3.1.0 allows XSS. (no CVSS)
- [CVE-2021-31928](https://cve.now/CVE-2021-31928.md): Annex Cloud Loyalty Experience Platform \<2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator. (no CVSS)
- [CVE-2021-34547](https://cve.now/CVE-2021-34547.md): PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation. (no CVSS)
- [CVE-2021-31929](https://cve.now/CVE-2021-31929.md): Annex Cloud Loyalty Experience Platform \<2021.1.0.1 allows any authenticated attacker to modify loyalty campaigns and settings, such as frau (no CVSS)
- [CVE-2021-3041](https://cve.now/CVE-2021-3041.md): Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation (CVSS 7.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2021-3040](https://cve.now/CVE-2021-3040.md): Bridgecrew Checkov: Unsafe deserialization of Terraform files allows code execution (CVSS 6.7, Palo Alto Networks Bridgecrew Checkov)
- [CVE-2021-3039](https://cve.now/CVE-2021-3039.md): Prisma Cloud Compute: User role authorization secret for Console leaked through log file export (CVSS 3.8, Palo Alto Networks Prisma Cloud Compute)
- [CVE-2021-25949](https://cve.now/CVE-2021-25949.md): Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code (no CVSS, set-getter)
- [CVE-2021-25948](https://cve.now/CVE-2021-25948.md): Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead (no CVSS, expand-hash)
- [CVE-2021-25322](https://cve.now/CVE-2021-25322.md): python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root (CVSS 6.8, openSUSE Leap · openSUSE Factory)
- [CVE-2019-25046](https://cve.now/CVE-2019-25046.md): The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document. (no CVSS)
- [CVE-2021-31997](https://cve.now/CVE-2021-31997.md): python-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to root (CVSS 6.8, openSUSE Leap · openSUSE Factory)
- [CVE-2021-21736](https://cve.now/CVE-2021-21736.md): A smart camera product of ZTE is impacted by a permission and access control vulnerability. (no CVSS, ZXHN HS562)
- [CVE-2021-31998](https://cve.now/CVE-2021-31998.md): inn: %post calls user owned file allowing local privilege escalation to root (CVSS 6.8, SUSE Linux Enterprise Server 11-SP3 · openSUSE Backports… +1)
- [CVE-2021-21735](https://cve.now/CVE-2021-21735.md): A ZTE product has an information leak vulnerability. (no CVSS, ZXHN H168N)
- [CVE-2021-20293](https://cve.now/CVE-2021-20293.md): A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly h (no CVSS, RESTEasy · org.jboss.resteasy:resteasy-bom +1)
- [CVE-2021-20081](https://cve.now/CVE-2021-20081.md): Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execut (no CVSS, ManageEngine ServiceDesk Plus)
- [CVE-2021-34539](https://cve.now/CVE-2021-34539.md): An issue was discovered in CubeCoders AMP before 2.1.1.8. (no CVSS)
- [CVE-2021-34363](https://cve.now/CVE-2021-34363.md): The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive (no CVSS, thefuck)
- [CVE-2021-30641](https://cve.now/CVE-2021-30641.md): Unexpected URL matching with 'MergeSlashes OFF' (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-26691](https://cve.now/CVE-2021-26691.md): Apache HTTP Server mod\_session response handling heap overflow (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-26690](https://cve.now/CVE-2021-26690.md): mod\_session NULL pointer dereference (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-13950](https://cve.now/CVE-2020-13950.md): mod\_proxy\_http NULL pointer dereference (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-35452](https://cve.now/CVE-2020-35452.md): mod\_auth\_digest possible stack overflow by one nul byte (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2020-13938](https://cve.now/CVE-2020-13938.md): Improper Handling of Insufficient Privileges (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2019-17567](https://cve.now/CVE-2019-17567.md): mod\_proxy\_wstunnel tunneling of non Upgraded connections (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-3588](https://cve.now/CVE-2021-3588.md): memory contents disclosure in cli\_feat\_read\_cb (CVSS 3.3, BlueZ)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.