CVEs published June 17, 2021
33 CVEs were published on June 17, 2021: 0 critical, 2 high.
- Published
- 33
- Critical
- 0
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Drawings SDK
- 8
- nextcloud security-advisories
- 2
- EIP Stack Group
- 1
- github.com/hashicorp/nomad
- 1
- IBM AIX
- 1
- Intel(R) Brand Verification Tool
- 1
- lutils
- 1
- mantisbt/mantisbt
- 1
- Octopus Deploy Octopus Server
- 1
- PHPMailer · phpmailer/phpmailer
- 1
High 2
Medium, low and unrated 31
- CVE-2021-34553Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content
- CVE-2021-32693Authentication granted with multiple firewallssymfony · symfony/security-http +1
- CVE-2021-32426In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
- CVE-2021-32424In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected rou
- CVE-2021-32694Malicious Android application can crash the Nextcloud Android Clientnextcloud security-advisories
- CVE-2021-32695Malicious Android app could access Shared Preferences of the Nextcloud Android clientnextcloud security-advisories
- CVE-2021-32575HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same nodgithub.com/hashicorp/nomad
- CVE-2021-33557An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2.mantisbt/mantisbt
- CVE-2021-32681Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blockswagtail
- CVE-2021-23396Prototype Pollutionlutils
- CVE-2020-35373In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.
- CVE-2021-29706IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or causIBM AIX
- CVE-2020-19202An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TIT
- CVE-2013-20002Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/th
- CVE-2020-25414A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitr
- CVE-2021-32078An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a
- CVE-2021-34825Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the
- CVE-2021-31818Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied dOctopus Deploy Octopus Server
- CVE-2021-32944A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack oDrawings SDK
- CVE-2021-32950An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lacDrawings SDK
- CVE-2021-32952An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lackDrawings SDK
- CVE-2021-32946An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prioDrawings SDK
- CVE-2021-31521Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in tTrend Micro InterScan Web Security Virtual Appliance
- CVE-2021-32582An issue was discovered in ConnectWise Automate before 2021.5.
- CVE-2021-0143Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user toIntel(R) Brand Verification Tool
- CVE-2020-36388In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.
- CVE-2020-36389In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
- CVE-2021-32936An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from tDrawings SDK
- CVE-2021-32938Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of pDrawings SDK
- CVE-2021-32940An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from thDrawings SDK
- CVE-2021-32948An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the Drawings SDK