# CVEs published 2021-06-16

85 CVEs were published on June 16, 2021: 3 critical, 11 high. Days are UTC.

- [CVE-2021-31477](https://cve.now/CVE-2021-31477.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. (CVSS 6.3, GE Reason RPV311)
- [CVE-2021-31476](https://cve.now/CVE-2021-31476.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. (CVSS 7.8, Foxit PhantomPDF)
- [CVE-2021-32690](https://cve.now/CVE-2021-32690.md): Repository credentials passed to alternate domain (CVSS 6.8, helm · helm.sh/helm/v3)
- [CVE-2021-32691](https://cve.now/CVE-2021-32691.md): Auto-merging Person Records Compromised (CVSS 8.8, ApollosProject apollos-apps · @apollosproject/data-connecto…)
- [CVE-2021-32245](https://cve.now/CVE-2021-32245.md): In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. (no CVSS, pagekit/pagekit)
- [CVE-2021-32244](https://cve.now/CVE-2021-32244.md): Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. (no CVSS, moodle/moodle)
- [CVE-2021-32243](https://cve.now/CVE-2021-32243.md): FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated). (no CVSS)
- [CVE-2021-34204](https://cve.now/CVE-2021-34204.md): D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. (no CVSS)
- [CVE-2021-34201](https://cve.now/CVE-2021-34201.md): D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2021-34203](https://cve.now/CVE-2021-34203.md): D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2021-34202](https://cve.now/CVE-2021-34202.md): There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. (no CVSS)
- [CVE-2021-32659](https://cve.now/CVE-2021-32659.md): Automatic room upgrade handling can be used maliciously to bridge a room non-consentually (CVSS 6.5, matrix-org matrix-appservice-bridge · matrix-appservice-bri…)
- [CVE-2020-25755](https://cve.now/CVE-2020-25755.md): An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. (no CVSS)
- [CVE-2020-25754](https://cve.now/CVE-2020-25754.md): An issue was discovered on Enphase Envoy R3.x and D4.x devices. (no CVSS)
- [CVE-2020-25753](https://cve.now/CVE-2020-25753.md): An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. (no CVSS)
- [CVE-2020-25752](https://cve.now/CVE-2020-25752.md): An issue was discovered on Enphase Envoy R3.x and D4.x devices. (no CVSS)
- [CVE-2020-22212](https://cve.now/CVE-2020-22212.md): SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php. (no CVSS)
- [CVE-2020-22211](https://cve.now/CVE-2020-22211.md): SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax\_street.php. (no CVSS)
- [CVE-2020-22210](https://cve.now/CVE-2020-22210.md): SQL Injection in 74cms 3.2.0 via the x parameter to ajax\_officebuilding.php. (no CVSS)
- [CVE-2020-22209](https://cve.now/CVE-2020-22209.md): SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax\_common.php. (no CVSS)
- [CVE-2021-1395](https://cve.now/CVE-2021-1395.md): Cisco Unified Intelligence Center Reflected Cross-Site Scripting Vulnerability (CVSS 4.7, Cisco Unified Contact Center Express)
- [CVE-2021-1542](https://cve.now/CVE-2021-1542.md): Cisco Small Business 220 Series Smart Switches Vulnerabilities (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2021-1543](https://cve.now/CVE-2021-1543.md): Cisco Small Business 220 Series Smart Switches Vulnerabilities (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2021-1566](https://cve.now/CVE-2021-1566.md): Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability (CVSS 7.4, Cisco Web Security Appliance)
- [CVE-2021-1567](https://cve.now/CVE-2021-1567.md): Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1568](https://cve.now/CVE-2021-1568.md): Cisco AnyConnect Secure Mobility Client for Windows Denial of Service Vulnerability (CVSS 5.5, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1569](https://cve.now/CVE-2021-1569.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 6.5, Cisco Jabber)
- [CVE-2021-1570](https://cve.now/CVE-2021-1570.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 6.5, Cisco Jabber)
- [CVE-2021-1571](https://cve.now/CVE-2021-1571.md): Cisco Small Business 220 Series Smart Switches Vulnerabilities (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2020-22208](https://cve.now/CVE-2020-22208.md): SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax\_street.php. (no CVSS)
- [CVE-2021-1541](https://cve.now/CVE-2021-1541.md): Cisco Small Business 220 Series Smart Switches Vulnerabilities (CVSS 7.2, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2021-1524](https://cve.now/CVE-2021-1524.md): Cisco Meeting Server API Denial of Service Vulnerability (CVSS 4.3, Cisco Meeting Server)
- [CVE-2021-34551](https://cve.now/CVE-2021-34551.md): PHPMailer before 6.5.0 on Windows allows remote code execution if lang\_path is untrusted data and has a UNC pathname. (no CVSS, phpmailer/phpmailer)
- [CVE-2020-22206](https://cve.now/CVE-2020-22206.md): SQL Injection in ECShop 3.0 via the aid parameter to admin/affiliate\_ck.php. (no CVSS)
- [CVE-2020-22205](https://cve.now/CVE-2020-22205.md): SQL Injection in ECShop 3.0 via the id parameter to admin/shophelp.php. (no CVSS)
- [CVE-2020-22204](https://cve.now/CVE-2020-22204.md): SQL Injection in ECShop 2.7.6 via the goods\_number parameter to flow.php. (no CVSS)
- [CVE-2021-34813](https://cve.now/CVE-2021-34813.md): Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room (no CVSS)
- [CVE-2020-22203](https://cve.now/CVE-2020-22203.md): SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. (no CVSS)
- [CVE-2020-22201](https://cve.now/CVE-2020-22201.md): phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. (no CVSS)
- [CVE-2020-22200](https://cve.now/CVE-2020-22200.md): Directory Traversal vulnerability in phpCMS 9.1.13 via the q parameter to public\_get\_suggest\_keyword. (no CVSS)
- [CVE-2020-22199](https://cve.now/CVE-2020-22199.md): SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg\_mod parameter to digg\_add.php. (no CVSS)
- [CVE-2021-29702](https://cve.now/CVE-2021-29702.md): Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1.4 and 11.5.5 is vulnerable to a denial of service as the server terminate (CVSS 7.5, IBM DB2 for Linux- UNIX and Windows)
- [CVE-2021-20567](https://cve.now/CVE-2021-20567.md): IBM Resilient SOAR V38.0 could allow a local privileged attacker to obtain sensitive information due to improper or nonexisting encryption.I (CVSS 4.4, IBM Resilient SOAR)
- [CVE-2021-20566](https://cve.now/CVE-2021-20566.md): IBM Resilient SOAR V38.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informa (CVSS 5.9, IBM Resilient SOAR)
- [CVE-2021-20488](https://cve.now/CVE-2021-20488.md): IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD env (CVSS 7.5, IBM Security Identity Manager)
- [CVE-2021-20483](https://cve.now/CVE-2021-20483.md): IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). (CVSS 5.3, IBM Security Identity Manager)
- [CVE-2020-35759](https://cve.now/CVE-2020-35759.md): bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content (Locally/Remotely). (no CVSS)
- [CVE-2020-35760](https://cve.now/CVE-2020-35760.md): bloofoxCMS 0.5.2.1 is infected with Unrestricted File Upload that allows attackers to upload malicious files (ex: php files). (no CVSS)
- [CVE-2020-35761](https://cve.now/CVE-2020-35761.md): bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code. (no CVSS)
- [CVE-2020-35762](https://cve.now/CVE-2020-35762.md): bloofoxCMS 0.5.2.1 is infected with Path traversal in the 'fileurl' parameter that allows attackers to read local files. (no CVSS)
- [CVE-2020-24939](https://cve.now/CVE-2020-24939.md): Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depen (no CVSS, supermixer)
- [CVE-2020-20444](https://cve.now/CVE-2020-20444.md): Jact OpenClinic 0.8.20160412 allows the attacker to read server files after login to the the admin account by an infected 'file' GET paramet (no CVSS)
- [CVE-2020-27339](https://cve.now/CVE-2020-27339.md): In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing (no CVSS)
- [CVE-2020-22198](https://cve.now/CVE-2020-22198.md): SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax\_membergroup.php. (no CVSS)
- [CVE-2021-34803](https://cve.now/CVE-2021-34803.md): TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. (no CVSS)
- [CVE-2021-27610](https://cve.now/CVE-2021-27610.md): SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 804, does not create informat (CVSS 9.0, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-34801](https://cve.now/CVE-2021-34801.md): Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only s (no CVSS, valine)
- [CVE-2021-21668](https://cve.now/CVE-2021-21668.md): Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability expl (no CVSS, Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…)
- [CVE-2021-21667](https://cve.now/CVE-2021-21667.md): Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site (no CVSS, Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…)
- [CVE-2020-8299](https://cve.now/CVE-2020-8299.md): Citrix ADC and Citrix/NetScaler Gateway 13.0 before 13.0-76.29, 12.1-61.18, 11.1-65.20, Citrix ADC 12.1-FIPS before 12.1-55.238, and Citrix (no CVSS, Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP Edition)
- [CVE-2020-8300](https://cve.now/CVE-2020-8300.md): Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from im (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2021-22914](https://cve.now/CVE-2021-22914.md): Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored (no CVSS, Citrix Cloud Connector)
- [CVE-2021-31159](https://cve.now/CVE-2021-31159.md): Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the (no CVSS)
- [CVE-2021-31857](https://cve.now/CVE-2021-31857.md): In Zoho ManageEngine Password Manager Pro before 11.1 build 11104, attackers are able to retrieve credentials via a browser extension for no (no CVSS)
- [CVE-2021-32928](https://cve.now/CVE-2021-32928.md): The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows i (no CVSS, Sentinel LDK Run-Time Environment)
- [CVE-2021-27483](https://cve.now/CVE-2021-27483.md): ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privileg (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-27485](https://cve.now/CVE-2021-27485.md): ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allo (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-27479](https://cve.now/CVE-2021-27479.md): ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-30468](https://cve.now/CVE-2021-30468.md): Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter (no CVSS, Apache Software Foundation Apache CXF · org.apache.cxf:a… +1)
- [CVE-2021-27487](https://cve.now/CVE-2021-27487.md): ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products contain credentials stored in plaintext. (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-27481](https://cve.now/CVE-2021-27481.md): ZOLL Defibrillator Dashboard, v prior to 2.2, The affected products utilize an encryption key in the data exchange process, which is hardcod (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-27489](https://cve.now/CVE-2021-27489.md): ZOLL Defibrillator Dashboard, v prior to 2.2, The web application allows a non-administrative user to upload a malicious file. (no CVSS, ZOLL Defibrillator Dashboard)
- [CVE-2021-34683](https://cve.now/CVE-2021-34683.md): An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. (no CVSS)
- [CVE-2021-32612](https://cve.now/CVE-2021-32612.md): The VeryFitPro (com.veryfit2hr.second) application 3.2.8 for Android does all communication with the backend API over cleartext HTTP. (no CVSS)
- [CVE-2021-32033](https://cve.now/CVE-2021-32033.md): Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. (no CVSS)
- [CVE-2021-28979](https://cve.now/CVE-2021-28979.md): SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. (no CVSS)
- [CVE-2021-33813](https://cve.now/CVE-2021-33813.md): An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request. (no CVSS, org.jdom:jdom2 · org.jdom:jdom)
- [CVE-2021-20094](https://cve.now/CVE-2021-20094.md): A denial of service vulnerability exists in Wibu-Systems CodeMeter versions \< 7.21a. (no CVSS, Wibu-Systems CodeMeter)
- [CVE-2021-20093](https://cve.now/CVE-2021-20093.md): A buffer over-read vulnerability exists in Wibu-Systems CodeMeter versions \< 7.21a. (no CVSS, Wibu-Systems CodeMeter)
- [CVE-2021-21441](https://cve.now/CVE-2021-21441.md): XSS in the ticket overview screens (CVSS 7.5, OTRS AG ((OTRS)) Community Edition · OTRS AG OTRS)
- [CVE-2020-9493](https://cve.now/CVE-2020-9493.md): Java deserialization in Chainsaw (CVSS 9.8, Apache Software Foundation Apache Chainsaw)
- [CVE-2021-28815](https://cve.now/CVE-2021-28815.md): Insecure Storage of Sensitive Information in myQNAPcloud Link (CVSS 6.0, QNAP Systems myQNAPcloud Link)
- [CVE-2021-3535](https://cve.now/CVE-2021-3535.md): Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search f (CVSS 4.3, Rapid7 Nexpose)
- [CVE-2021-32685](https://cve.now/CVE-2021-32685.md): Improper Verification of Cryptographic Signature in tenvoy (CVSS 9.8, TogaTech tEnvoy · tenvoy)
- [CVE-2021-32676](https://cve.now/CVE-2021-32676.md): Session Fixation in Nextcloud Talk (CVSS 6.5, nextcloud security-advisories)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.