CVEs published June 16, 2021
85 CVEs were published on June 16, 2021: 3 critical, 11 high.
- Published
- 85
- Critical
- 3
- High
- 11
- Medium
- 14
- Low
- 0
- Unrated
- 57
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- ZOLL Defibrillator Dashboard
- 6
- Cisco Small Business 220 Series Smart Plus Switches
- 4
- Cisco AnyConnect Secure Mobility Client
- 2
- Cisco Jabber
- 2
- IBM Resilient SOAR
- 2
- IBM Security Identity Manager
- 2
- Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…
- 2
- Wibu-Systems CodeMeter
- 2
- Apache Software Foundation Apache Chainsaw
- 1
- Apache Software Foundation Apache CXF · org.apache.cxf:a… +1
- 1
Critical 3
- CVE-2021-27610SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create informatSAP SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2020-9493Java deserialization in ChainsawApache Software Foundation Apache Chainsaw
- CVE-2021-32685Improper Verification of Cryptographic Signature in tenvoyTogaTech tEnvoy · tenvoy
High 11
- CVE-2021-31476This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598.Foxit PhantomPDF
- CVE-2021-32691Auto-merging Person Records CompromisedApollosProject apollos-apps · @apollosproject/data-connecto…
- CVE-2021-1542Cisco Small Business 220 Series Smart Switches VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-1543Cisco Small Business 220 Series Smart Switches VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-1566Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation VulnerabilityCisco Web Security Appliance
- CVE-2021-1567Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-1571Cisco Small Business 220 Series Smart Switches VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-1541Cisco Small Business 220 Series Smart Switches VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-29702Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminateIBM DB2 for Linux- UNIX and Windows
- CVE-2021-20488IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD envIBM Security Identity Manager
- CVE-2021-21441XSS in the ticket overview screensOTRS AG ((OTRS)) Community Edition · OTRS AG OTRS
Medium, low and unrated 71
- CVE-2021-31477This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03.GE Reason RPV311
- CVE-2021-32690Repository credentials passed to alternate domainhelm · helm.sh/helm/v3
- CVE-2021-32245In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.pagekit/pagekit
- CVE-2021-32244Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.moodle/moodle
- CVE-2021-32243FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).
- CVE-2021-34204D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials.
- CVE-2021-34201D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow.
- CVE-2021-34203D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control.
- CVE-2021-34202There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04.
- CVE-2021-32659Automatic room upgrade handling can be used maliciously to bridge a room non-consentuallymatrix-org matrix-appservice-bridge · matrix-appservice-bri…
- CVE-2020-25755An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices.
- CVE-2020-25754An issue was discovered on Enphase Envoy R3.x and D4.x devices.
- CVE-2020-25753An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software.
- CVE-2020-25752An issue was discovered on Enphase Envoy R3.x and D4.x devices.
- CVE-2020-22212SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.
- CVE-2020-22211SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.
- CVE-2020-22210SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.
- CVE-2020-22209SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.
- CVE-2021-1395Cisco Unified Intelligence Center Reflected Cross-Site Scripting VulnerabilityCisco Unified Contact Center Express
- CVE-2021-1568Cisco AnyConnect Secure Mobility Client for Windows Denial of Service VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-1569Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco Jabber
- CVE-2021-1570Cisco Jabber Desktop and Mobile Client Software VulnerabilitiesCisco Jabber
- CVE-2020-22208SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.
- CVE-2021-1524Cisco Meeting Server API Denial of Service VulnerabilityCisco Meeting Server
- CVE-2021-34551PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.phpmailer/phpmailer
- CVE-2020-22206SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate_ck.php.
- CVE-2020-22205SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php.
- CVE-2020-22204SQL Injection in ECShop 2.7.6 via the goods_number parameter to flow.php.
- CVE-2021-34813Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room
- CVE-2020-22203SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php.
- CVE-2020-22201phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
- CVE-2020-22200Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public_get_suggest_keyword.
- CVE-2020-22199SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php.
- CVE-2021-20567IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.IIBM Resilient SOAR
- CVE-2021-20566IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informaIBM Resilient SOAR
- CVE-2021-20483IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF).IBM Security Identity Manager
- CVE-2020-35759bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely).
- CVE-2020-35760bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files).
- CVE-2020-35761bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.
- CVE-2020-35762bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files.
- CVE-2020-24939Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depensupermixer
- CVE-2020-20444Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET paramet
- CVE-2020-27339In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing
- CVE-2020-22198SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php.
- CVE-2021-34803TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.
- CVE-2021-34801Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only svaline
- CVE-2021-21668Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability explJenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…
- CVE-2021-21667Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…
- CVE-2020-8299Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP Edition
- CVE-2020-8300Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from imCitrix ADC, Citrix Gateway
- CVE-2021-22914Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored Citrix Cloud Connector
- CVE-2021-31159Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the
- CVE-2021-31857In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for no
- CVE-2021-32928The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows iSentinel LDK Run-Time Environment
- CVE-2021-27483ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilegZOLL Defibrillator Dashboard
- CVE-2021-27485ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could alloZOLL Defibrillator Dashboard
- CVE-2021-27479ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters toZOLL Defibrillator Dashboard
- CVE-2021-30468Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriterApache Software Foundation Apache CXF · org.apache.cxf:a… +1
- CVE-2021-27487ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext.ZOLL Defibrillator Dashboard
- CVE-2021-27481ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcodZOLL Defibrillator Dashboard
- CVE-2021-27489ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file.ZOLL Defibrillator Dashboard
- CVE-2021-34683An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0.
- CVE-2021-32612The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP.
- CVE-2021-32033Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations.
- CVE-2021-28979SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks.
- CVE-2021-33813An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.org.jdom:jdom2 · org.jdom:jdom
- CVE-2021-20094A denial of service vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a.Wibu-Systems CodeMeter
- CVE-2021-20093A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions < 7.21a.Wibu-Systems CodeMeter
- CVE-2021-28815Insecure Storage of Sensitive Information in myQNAPcloud LinkQNAP Systems myQNAPcloud Link
- CVE-2021-3535Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search fRapid7 Nexpose
- CVE-2021-32676Session Fixation in Nextcloud Talknextcloud security-advisories