# CVEs published 2021-06-11

158 CVEs were published on June 11, 2021: 14 critical, 15 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2020-12988](https://cve.now/CVE-2020-12988.md): A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system wh (no CVSS, 1st/2nd/3rd Gen AMD EPYC™ Processors)
- [CVE-2020-12987](https://cve.now/CVE-2020-12987.md): A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass. (no CVSS, AMD Radeon Software)
- [CVE-2020-12986](https://cve.now/CVE-2020-12986.md): An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may cause arbitrary code execution in the kernel, (no CVSS, AMD Radeon Software)
- [CVE-2020-12985](https://cve.now/CVE-2020-12985.md): An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of (no CVSS, AMD Radeon Software)
- [CVE-2020-12983](https://cve.now/CVE-2020-12983.md): An out of bounds write vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privileges or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12982](https://cve.now/CVE-2020-12982.md): An invalid object pointer free vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of serv (no CVSS, AMD Radeon Software)
- [CVE-2020-12981](https://cve.now/CVE-2020-12981.md): An insufficient input validation in the AMD Graphics Driver for Windows 10 may allow unprivileged users to unload the driver, potentially ca (no CVSS, AMD Radeon Software)
- [CVE-2020-12980](https://cve.now/CVE-2020-12980.md): An out of bounds write and read vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of ser (no CVSS, AMD Radeon Software)
- [CVE-2021-21382](https://cve.now/CVE-2021-21382.md): Unsafe loopback forwarding interface in Restund (CVSS 8.6, wireapp restund)
- [CVE-2021-34679](https://cve.now/CVE-2021-34679.md): Thycotic Password Reset Server before 5.3.0 allows credential disclosure. (CVSS 10.0)
- [CVE-2021-3256](https://cve.now/CVE-2021-3256.md): KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html\_url parameter of the chakanhtml.module.php file. (no CVSS)
- [CVE-2021-27200](https://cve.now/CVE-2021-27200.md): In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. (no CVSS)
- [CVE-2020-7860](https://cve.now/CVE-2020-7860.md): UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is misha (CVSS 7.8, Estsoft UnEGG)
- [CVE-2021-0489](https://cve.now/CVE-2021-0489.md): In memory management driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0490](https://cve.now/CVE-2021-0490.md): In memory management driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0491](https://cve.now/CVE-2021-0491.md): In memory management driver, there is a possible escalation of privilege due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0493](https://cve.now/CVE-2021-0493.md): In memory management driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0494](https://cve.now/CVE-2021-0494.md): In memory management driver, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0495](https://cve.now/CVE-2021-0495.md): In memory management driver, there is a possible out of bounds write due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0496](https://cve.now/CVE-2021-0496.md): In memory management driver, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0497](https://cve.now/CVE-2021-0497.md): In memory management driver, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0498](https://cve.now/CVE-2021-0498.md): In memory management driver, there is a possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2021-0472](https://cve.now/CVE-2021-0472.md): In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-0473](https://cve.now/CVE-2021-0473.md): In rw\_t3t\_process\_error of rw\_t3t.cc, there is a possible double free due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0474](https://cve.now/CVE-2021-0474.md): In avrc\_msg\_cback of avrc\_api.cc, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0475](https://cve.now/CVE-2021-0475.md): In on\_l2cap\_data\_ind of btif\_sock\_l2cap.cc, there is possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0477](https://cve.now/CVE-2021-0477.md): In notifyScreenshotError of ScreenshotNotificationsController.java, there is a possible permission bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-0480](https://cve.now/CVE-2021-0480.md): In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. (no CVSS, Android)
- [CVE-2021-0485](https://cve.now/CVE-2021-0485.md): In getMinimalSize of PipBoundsAlgorithm.java, there is a possible bypass of restrictions on background processes due to a permissions bypass (no CVSS, Android)
- [CVE-2021-0487](https://cve.now/CVE-2021-0487.md): In onCreate of CalendarDebugActivity.java, there is a possible way to export calendar data to the sdcard without user consent due to a tapja (no CVSS, Android)
- [CVE-2021-0492](https://cve.now/CVE-2021-0492.md): In memory management driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0466](https://cve.now/CVE-2021-0466.md): In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. (no CVSS, Android)
- [CVE-2021-0476](https://cve.now/CVE-2021-0476.md): In FindOrCreatePeer of btif\_av.cc, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-0481](https://cve.now/CVE-2021-0481.md): In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpected URI handler. (no CVSS, Android)
- [CVE-2021-0482](https://cve.now/CVE-2021-0482.md): In BinderDiedCallback of MediaCodec.cpp, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0484](https://cve.now/CVE-2021-0484.md): In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-9475](https://cve.now/CVE-2019-9475.md): In /proc/net of the kernel filesystem, there is a possible information leak due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-27410](https://cve.now/CVE-2021-27410.md): The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn me (no CVSS, Welch Allyn medical device management tools)
- [CVE-2021-27408](https://cve.now/CVE-2021-27408.md): The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chai (no CVSS, Welch Allyn medical device management tools)
- [CVE-2021-32930](https://cve.now/CVE-2021-32930.md): The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and e (no CVSS, iView)
- [CVE-2021-32932](https://cve.now/CVE-2021-32932.md): The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versio (no CVSS, iView)
- [CVE-2021-21795](https://cve.now/CVE-2021-21795.md): A heap-based buffer overflow vulnerability exists in the PSD read\_icc\_icCurve\_data functionality of Accusoft ImageGear 19.9. (CVSS 9.8, Accusoft)
- [CVE-2021-21808](https://cve.now/CVE-2021-21808.md): A memory corruption vulnerability exists in the PNG png\_palette\_process functionality of Accusoft ImageGear 19.9. (CVSS 8.1, Accusoft)
- [CVE-2021-21824](https://cve.now/CVE-2021-21824.md): An out-of-bounds write vulnerability exists in the JPG Handle\_JPEG420 functionality of Accusoft ImageGear 19.9. (CVSS 8.1, Accusoft)
- [CVE-2021-21833](https://cve.now/CVE-2021-21833.md): An improper array index validation vulnerability exists in the TIF IP\_planar\_raster\_unpack functionality of Accusoft ImageGear 19.9. (CVSS 9.8, Accusoft)
- [CVE-2021-20591](https://cve.now/CVE-2021-20591.md): Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R00/01/02CPU all versions, R04/08/16/ (no CVSS, MELSEC iQ-R series CPU modules)
- [CVE-2021-22905](https://cve.now/CVE-2021-22905.md): Nextcloud Android App (com.nextcloud.client) before v3.16.0 is vulnerable to information disclosure due to searches for sharees being perfor (no CVSS, Nextcloud Android App)
- [CVE-2021-22906](https://cve.now/CVE-2021-22906.md): Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.1 suffers from a denial of service vulnerability due to permitting any authentic (no CVSS, Nextcloud End-to-End Encryption)
- [CVE-2021-22895](https://cve.now/CVE-2021-22895.md): Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when usin (no CVSS, Nextcloud Desktop Client)
- [CVE-2021-22896](https://cve.now/CVE-2021-22896.md): Nextcloud Mail before 1.9.5 suffers from improper access control due to a missing permission check allowing other authenticated users to cre (no CVSS, Nextcloud Mail)
- [CVE-2021-22897](https://cve.now/CVE-2021-22897.md): curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT\_SSL\_CIPHER\_LIST w (CVSS 5.3, https://github.com/curl/curl)
- [CVE-2021-22901](https://cve.now/CVE-2021-22901.md): curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session t (no CVSS, https://github.com/curl/curl)
- [CVE-2021-22902](https://cve.now/CVE-2021-22902.md): The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible d (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22903](https://cve.now/CVE-2021-22903.md): The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22904](https://cve.now/CVE-2021-22904.md): The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authent (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2021-22915](https://cve.now/CVE-2021-22915.md): Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limit (no CVSS, Nextcloud Server)
- [CVE-2021-22898](https://cve.now/CVE-2021-22898.md): curl 7.7 through 7.76.1 suffers from an information disclosure when the \`-t\` command line option, known as \`CURLOPT\_TELNETOPTIONS\` in libcur (CVSS 3.1, https://github.com/curl/curl)
- [CVE-2021-22912](https://cve.now/CVE-2021-22912.md): Nextcloud iOS before 3.4.2 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by defau (no CVSS, Nextcloud iOS app)
- [CVE-2021-22913](https://cve.now/CVE-2021-22913.md): Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server (no CVSS, Nextcloud Deck)
- [CVE-2021-23140](https://cve.now/CVE-2021-23140.md): Improper Authorization vulnerability in Gallagher Command Centre Server allows command line macros to be modified by an unauthorised Command (CVSS 9.9, Gallagher Command Centre)
- [CVE-2021-23182](https://cve.now/CVE-2021-23182.md): Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be d (CVSS 6.0, Gallagher Command Centre)
- [CVE-2021-23204](https://cve.now/CVE-2021-23204.md): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be e (CVSS 8.1, Gallagher Command Centre)
- [CVE-2021-23205](https://cve.now/CVE-2021-23205.md): Improper Encoding or Escaping in Gallagher Command Centre Server allows a Command Centre Operator to alter the configuration of Controllers (CVSS 8.1, Gallagher Command Centre)
- [CVE-2021-23211](https://cve.now/CVE-2021-23211.md): Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows Cloud end-to-end encryption key (CVSS 6.0, Gallagher Command Centre)
- [CVE-2021-23230](https://cve.now/CVE-2021-23230.md): A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to mod (CVSS 9.9, Gallagher Command Centre)
- [CVE-2021-23136](https://cve.now/CVE-2021-23136.md): Improper Authorization vulnerability in Gallagher Command Centre Server allows macro overrides to be performed by an unprivileged Command Ce (CVSS 6.5, Gallagher Command Centre)
- [CVE-2021-22181](https://cve.now/CVE-2021-22181.md): A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relati (CVSS 7.7, GitLab)
- [CVE-2021-22762](https://cve.now/CVE-2021-22762.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and pri (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22763](https://cve.now/CVE-2021-22763.md): A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic (CVSS 9.8, PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and…)
- [CVE-2021-22764](https://cve.now/CVE-2021-22764.md): A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (se (CVSS 5.3, PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300)
- [CVE-2021-22765](https://cve.now/CVE-2021-22765.md): A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions (CVSS 9.8, PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…)
- [CVE-2021-22766](https://cve.now/CVE-2021-22766.md): A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions (CVSS 7.5, PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…)
- [CVE-2021-22767](https://cve.now/CVE-2021-22767.md): A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions (CVSS 9.8, PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…)
- [CVE-2021-22768](https://cve.now/CVE-2021-22768.md): A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions (CVSS 9.8, PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…)
- [CVE-2021-22769](https://cve.now/CVE-2021-22769.md): A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that coul (CVSS 5.3, Easergy T300 with firmware V2.7.1 and older)
- [CVE-2021-22752](https://cve.now/CVE-2021-22752.md): A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22753](https://cve.now/CVE-2021-22753.md): A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22754](https://cve.now/CVE-2021-22754.md): A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22755](https://cve.now/CVE-2021-22755.md): A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of i (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22756](https://cve.now/CVE-2021-22756.md): A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of in (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22757](https://cve.now/CVE-2021-22757.md): A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of in (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22758](https://cve.now/CVE-2021-22758.md): A CWE-824: Access of uninitialized pointer vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in los (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22759](https://cve.now/CVE-2021-22759.md): A CWE-416: Use after free vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remo (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22760](https://cve.now/CVE-2021-22760.md): A CWE-763: Release of invalid pointer or reference vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could resul (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22761](https://cve.now/CVE-2021-22761.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists inIGSS Definition (Def.exe) V15.0.0. (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22749](https://cve.now/CVE-2021-22749.md): A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and pr (no CVSS, Modicon X80 BMXNOR0200H RTU SV1.70 IR22 and prior)
- [CVE-2021-22750](https://cve.now/CVE-2021-22750.md): A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or (no CVSS, IGSS Definition (Def.exe) V15.0.0.21041 and prior)
- [CVE-2021-22751](https://cve.now/CVE-2021-22751.md): A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of i (no CVSS, IGSS Definition (Def.exe) V15.0.0.21140 and prior)
- [CVE-2021-22175](https://cve.now/CVE-2021-22175.md): When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions (CVSS 6.8, KEV, GitLab)
- [CVE-2021-28210](https://cve.now/CVE-2021-28210.md): An unlimited recursion in DxeCore in EDK II. (no CVSS, TianoCore EDK II)
- [CVE-2021-28211](https://cve.now/CVE-2021-28211.md): A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. (no CVSS, TianoCore EDK II)
- [CVE-2021-28213](https://cve.now/CVE-2021-28213.md): Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. (no CVSS, TianoCore EDK II)
- [CVE-2020-13688](https://cve.now/CVE-2020-13688.md): Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in or (no CVSS, Drupal Core · drupal/core)
- [CVE-2020-13663](https://cve.now/CVE-2020-13663.md): Cross Site Request Forgery vulnerability in Drupal Core Form API does not properly handle certain form input from cross-site requests, which (no CVSS, Drupal Core · drupal/core +1)
- [CVE-2021-28687](https://cve.now/CVE-2021-28687.md): HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disp (no CVSS, xen)
- [CVE-2021-28689](https://cve.now/CVE-2021-28689.md): x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. (no CVSS, Xen)
- [CVE-2021-25399](https://cve.now/CVE-2021-25399.md): Improper configuration in Smart Manager prior to version 11.0.05.0 allows attacker to access the file with system privilege. (no CVSS, Samsung Mobile Smart Manager)
- [CVE-2021-25400](https://cve.now/CVE-2021-25400.md): Intent redirection vulnerability in Samsung Internet prior to version 14.0.1.20 allows attacker to execute privileged action. (no CVSS, Samsung Mobile Samsug Internet)
- [CVE-2021-25401](https://cve.now/CVE-2021-25401.md): Intent redirection vulnerability in Samsung Health prior to version 6.16 allows attacker to execute privileged action. (no CVSS, Samsung Mobile Samsung Health)
- [CVE-2021-25402](https://cve.now/CVE-2021-25402.md): Information Exposure vulnerability in Samsung Notes prior to version 4.2.04.27 allows attacker to access s pen latency information. (no CVSS, Samsung Mobile Samsung Notes)
- [CVE-2021-25403](https://cve.now/CVE-2021-25403.md): Intent redirection vulnerability in Samsung Account prior to version 10.8.0.4 in Android P(9.0) and below, and 12.2.0.9 in Android Q(10.0) a (no CVSS, Samsung Mobile Samsung Account)
- [CVE-2021-25404](https://cve.now/CVE-2021-25404.md): Information Exposure vulnerability in SmartThings prior to version 1.7.64.21 allows attacker to access user information via log. (no CVSS, Samsung Mobile SmartThings)
- [CVE-2021-25405](https://cve.now/CVE-2021-25405.md): An improper access control vulnerability in ScreenOffActivity in Samsung Notes prior to version 4.2.04.27 allows untrusted applications to a (no CVSS, Samsung Mobile Samsung Notes)
- [CVE-2021-25406](https://cve.now/CVE-2021-25406.md): Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT d (no CVSS, Samsung Mobile Gear S Plugin)
- [CVE-2021-25390](https://cve.now/CVE-2021-25390.md): Intent redirection vulnerability in PhotoTable prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25391](https://cve.now/CVE-2021-25391.md): Intent redirection vulnerability in Secure Folder prior to SMR MAY-2021 Release 1 allows attackers to execute privileged action. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25392](https://cve.now/CVE-2021-25392.md): Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive info (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25393](https://cve.now/CVE-2021-25393.md): Improper sanitization of incoming intent in SecSettings prior to SMR MAY-2021 Release 1 allows local attackers to get permissions to access (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2021-25394](https://cve.now/CVE-2021-25394.md): A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio (CVSS 6.4, KEV, Samsung Mobile Devices)
- [CVE-2021-25395](https://cve.now/CVE-2021-25395.md): A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privil (CVSS 6.4, KEV, Samsung Mobile Devices)
- [CVE-2021-25396](https://cve.now/CVE-2021-25396.md): An improper input validation vulnerability in NPU firmware prior to SMR MAY-2021 Release 1 allows arbitrary memory write and code execution. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2021-25397](https://cve.now/CVE-2021-25397.md): An improper access control vulnerability in TelephonyUI prior to SMR MAY-2021 Release 1 allows local attackers to write arbitrary files of t (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2021-25398](https://cve.now/CVE-2021-25398.md): Intent redirection vulnerability in Bixby Voice prior to version 3.1.12 allows attacker to access contacts. (no CVSS, Samsung Mobile Bixby Voice)
- [CVE-2021-25383](https://cve.now/CVE-2021-25383.md): An improper input validation vulnerability in scmn\_mfal\_read() in libsapeextractor library prior to SMR MAY-2021 Release 1 allows attackers (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25384](https://cve.now/CVE-2021-25384.md): An improper input validation vulnerability in sdfffd\_parse\_chunk\_PROP() with Sample Rate Chunk in libsdffextractor library prior to SMR MAY- (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25385](https://cve.now/CVE-2021-25385.md): An improper input validation vulnerability in sdfffd\_parse\_chunk\_PROP() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows a (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25386](https://cve.now/CVE-2021-25386.md): An improper input validation vulnerability in sdfffd\_parse\_chunk\_FVER() in libsdffextractor library prior to SMR MAY-2021 Release 1 allows a (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25387](https://cve.now/CVE-2021-25387.md): An improper input validation vulnerability in sflacfd\_get\_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attacker (CVSS 9.0, Samsung Mobile Devices)
- [CVE-2021-25388](https://cve.now/CVE-2021-25388.md): Improper caller check vulnerability in Knox Core prior to SMR MAY-2021 Release 1 allows attackers to install arbitrary app. (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2021-25389](https://cve.now/CVE-2021-25389.md): Improper running task check in S Secure prior to SMR MAY-2021 Release 1 allows attackers to use locked app without authentication. (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2021-25420](https://cve.now/CVE-2021-25420.md): Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak W (no CVSS, Samsung Mobile Galaxy Watch PlugIn)
- [CVE-2021-25421](https://cve.now/CVE-2021-25421.md): Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak (no CVSS, Samsung Mobile Galaxy Watch3 PlugIn)
- [CVE-2021-25422](https://cve.now/CVE-2021-25422.md): Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak W (no CVSS, Samsung Mobile Watch Active PlugIn)
- [CVE-2021-25423](https://cve.now/CVE-2021-25423.md): Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak (no CVSS, Samsung Mobile Watch Active2 PlugIn)
- [CVE-2021-25424](https://cve.now/CVE-2021-25424.md): Improper authentication vulnerability in Tizen bluetooth-frwk prior to Firmware update JUN-2021 Release allows bluetooth attacker to take ov (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25425](https://cve.now/CVE-2021-25425.md): Improper check vulnerability in Samsung Health prior to version 6.17 allows attacker to read internal cache data via exported component. (no CVSS, Samsung Mobile Samsung Health)
- [CVE-2021-25412](https://cve.now/CVE-2021-25412.md): An improper access control vulnerability in genericssoservice prior to SMR JUN-2021 Release 1 allows local attackers to execute protected ac (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25413](https://cve.now/CVE-2021-25413.md): Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to get permissions to ac (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25414](https://cve.now/CVE-2021-25414.md): Improper sanitization of incoming intent in Samsung Contacts prior to SMR JUN-2021 Release 1 allows local attackers to copy or overwrite arb (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25415](https://cve.now/CVE-2021-25415.md): Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to remap EL2 memor (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25416](https://cve.now/CVE-2021-25416.md): Assuming EL1 is compromised, an improper address validation in RKP prior to SMR JUN-2021 Release 1 allows local attackers to create executab (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25417](https://cve.now/CVE-2021-25417.md): Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage. (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25418](https://cve.now/CVE-2021-25418.md): Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrar (no CVSS, Samsung Mobile Samsung Internet)
- [CVE-2021-25419](https://cve.now/CVE-2021-25419.md): Non-compliance of recommended secure coding scheme in Samsung Internet prior to version 14.0.1.62 allows attackers to display fake URL in ad (no CVSS, Samsung Mobile Samsung Internet)
- [CVE-2021-25407](https://cve.now/CVE-2021-25407.md): A possible out of bounds write vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write. (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25408](https://cve.now/CVE-2021-25408.md): A possible buffer overflow vulnerability in NPU driver prior to SMR JUN-2021 Release 1 allows arbitrary memory write and code execution. (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25409](https://cve.now/CVE-2021-25409.md): Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25410](https://cve.now/CVE-2021-25410.md): Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files wi (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25411](https://cve.now/CVE-2021-25411.md): Improper address validation vulnerability in RKP api prior to SMR JUN-2021 Release 1 allows root privileged local attackers to write read-on (no CVSS, Samsung Mobile Devices)
- [CVE-2021-29754](https://cve.now/CVE-2021-29754.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a privilege escalation vulnerability when using the SAML Web Inboun (CVSS 4.2, IBM WebSphere Application Server)
- [CVE-2021-20396](https://cve.now/CVE-2021-20396.md): IBM QRadar Analyst Workflow App 1.0 through 1.18.0 for IBM QRadar SIEM allows web pages to be stored locally which can be read by another us (CVSS 4.0, IBM QRadar Analyst Workflow)
- [CVE-2020-5003](https://cve.now/CVE-2020-5003.md): IBM Financial Transaction Manager 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 6.5, IBM Financial Transaction Manager)
- [CVE-2021-26993](https://cve.now/CVE-2021-26993.md): E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploit (no CVSS, E-Series SANtricity OS Controller Software 11.x)
- [CVE-2021-26995](https://cve.now/CVE-2021-26995.md): E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploit (no CVSS, E-Series SANtricity OS Controller Software 11.x)
- [CVE-2021-26996](https://cve.now/CVE-2021-26996.md): E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploit (no CVSS, E-Series SANtricity OS Controller Software 11.x)
- [CVE-2021-26997](https://cve.now/CVE-2021-26997.md): E-Series SANtricity OS Controller Software 11.x versions prior to 11.70.1 are susceptible to a vulnerability which when successfully exploit (no CVSS, E-Series SANtricity OS Controller Software 11.x)
- [CVE-2021-33205](https://cve.now/CVE-2021-33205.md): Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content (no CVSS)
- [CVE-2021-34540](https://cve.now/CVE-2021-34540.md): Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. (no CVSS)
- [CVE-2021-3013](https://cve.now/CVE-2021-3013.md): ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--sea (no CVSS, grep-cli · ripgrep)
- [CVE-2021-26828](https://cve.now/CVE-2021-26828.md): OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP f (CVSS 8.8, KEV)
- [CVE-2021-26829](https://cve.now/CVE-2021-26829.md): OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system\_settings.shtm. (CVSS 5.4, KEV)
- [CVE-2021-28814](https://cve.now/CVE-2021-28814.md): Improper Access Control Vulnerability in Helpdesk (CVSS 8.8, QNAP Systems Helpdesk)
- [CVE-2021-28805](https://cve.now/CVE-2021-28805.md): Inclusion of Sensitive Information in QSS (CVSS 7.8, QNAP Systems QSS)
- [CVE-2021-28801](https://cve.now/CVE-2021-28801.md): Out-of-Bounds Read Vulnerability in QSS (CVSS 3.1, QNAP Systems QSS)
- [CVE-2021-24035](https://cve.now/CVE-2021-24035.md): A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 (no CVSS, Facebook WhatsApp Business for Android · Facebook WhatsApp…)
- [CVE-2021-25684](https://cve.now/CVE-2021-25684.md): apport can be stalled by reading a FIFO (CVSS 8.8, Canonical apport)
- [CVE-2021-25683](https://cve.now/CVE-2021-25683.md): apport improperly parses /proc/pid/stat (CVSS 8.8, Canonical apport)
- [CVE-2021-25682](https://cve.now/CVE-2021-25682.md): apport improperly parses /proc/pid/status (CVSS 8.8, Canonical apport)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.