# CVEs published 2021-06-17

33 CVEs were published on June 17, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-34553](https://cve.now/CVE-2021-34553.md): Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content (no CVSS)
- [CVE-2021-32693](https://cve.now/CVE-2021-32693.md): Authentication granted with multiple firewalls (CVSS 6.8, symfony · symfony/security-http +1)
- [CVE-2021-32426](https://cve.now/CVE-2021-32426.md): In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command. (no CVSS)
- [CVE-2021-32424](https://cve.now/CVE-2021-32424.md): In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected rou (no CVSS)
- [CVE-2021-32694](https://cve.now/CVE-2021-32694.md): Malicious Android application can crash the Nextcloud Android Client (CVSS 4.1, nextcloud security-advisories)
- [CVE-2021-32695](https://cve.now/CVE-2021-32695.md): Malicious Android app could access Shared Preferences of the Nextcloud Android client (CVSS 3.9, nextcloud security-advisories)
- [CVE-2021-32575](https://cve.now/CVE-2021-32575.md): HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same nod (no CVSS, github.com/hashicorp/nomad)
- [CVE-2021-33557](https://cve.now/CVE-2021-33557.md): An XSS issue was discovered in manage\_custom\_field\_edit\_page.php in MantisBT before 2.25.2. (no CVSS, mantisbt/mantisbt)
- [CVE-2021-32681](https://cve.now/CVE-2021-32681.md): Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocks (CVSS 5.4, wagtail)
- [CVE-2021-23396](https://cve.now/CVE-2021-23396.md): Prototype Pollution (CVSS 5.6, lutils)
- [CVE-2020-35373](https://cve.now/CVE-2020-35373.md): In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack. (no CVSS)
- [CVE-2021-29706](https://cve.now/CVE-2021-29706.md): IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive information or caus (CVSS 6.8, IBM AIX)
- [CVE-2020-19202](https://cve.now/CVE-2020-19202.md): An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Page" text box or "TIT (no CVSS)
- [CVE-2013-20002](https://cve.now/CVE-2013-20002.md): Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/th (no CVSS)
- [CVE-2020-25414](https://cve.now/CVE-2020-25414.md): A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attackers to execute arbitr (no CVSS)
- [CVE-2021-32078](https://cve.now/CVE-2021-32078.md): An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 because of the lack of a (no CVSS)
- [CVE-2021-34825](https://cve.now/CVE-2021-34825.md): Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the (no CVSS)
- [CVE-2021-31818](https://cve.now/CVE-2021-31818.md): Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied d (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2021-32944](https://cve.now/CVE-2021-32944.md): A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the lack o (no CVSS, Drawings SDK)
- [CVE-2021-32950](https://cve.now/CVE-2021-32950.md): An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) resulting from the lac (no CVSS, Drawings SDK)
- [CVE-2021-3603](https://cve.now/CVE-2021-3603.md): Inclusion of Functionality from Untrusted Control Sphere in PHPMailer/PHPMailer (CVSS 8.1, PHPMailer · phpmailer/phpmailer)
- [CVE-2021-32952](https://cve.now/CVE-2021-32952.md): An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) resulting from the lack (no CVSS, Drawings SDK)
- [CVE-2021-32946](https://cve.now/CVE-2021-32946.md): An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Version 2022.4 and prio (no CVSS, Drawings SDK)
- [CVE-2021-31521](https://cve.now/CVE-2021-31521.md): Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in t (no CVSS, Trend Micro InterScan Web Security Virtual Appliance)
- [CVE-2021-32582](https://cve.now/CVE-2021-32582.md): An issue was discovered in ConnectWise Automate before 2021.5. (no CVSS)
- [CVE-2021-0143](https://cve.now/CVE-2021-0143.md): Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an authenticated user to (no CVSS, Intel(R) Brand Verification Tool)
- [CVE-2021-21777](https://cve.now/CVE-2021-21777.md): An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.3 and development co (CVSS 8.6, EIP Stack Group)
- [CVE-2020-36388](https://cve.now/CVE-2020-36388.md): In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive. (no CVSS)
- [CVE-2020-36389](https://cve.now/CVE-2020-36389.md): In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. (no CVSS)
- [CVE-2021-32936](https://cve.now/CVE-2021-32936.md): An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022.4) resulting from t (no CVSS, Drawings SDK)
- [CVE-2021-32938](https://cve.now/CVE-2021-32938.md): Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resulting from the lack of p (no CVSS, Drawings SDK)
- [CVE-2021-32940](https://cve.now/CVE-2021-32940.md): An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.5) resulting from th (no CVSS, Drawings SDK)
- [CVE-2021-32948](https://cve.now/CVE-2021-32948.md): An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resulting from the (no CVSS, Drawings SDK)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.