CVEs published June 18, 2021
40 CVEs were published on June 18, 2021: 3 critical, 8 high.
- Published
- 40
- Critical
- 3
- High
- 8
- Medium
- 4
- Low
- 1
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- contiki-ng
- 6
- Synology Download Station
- 3
- Advantech WebAccess/SCADA
- 2
- Bosch B426 Firmware
- 1
- Bosch B426 Firmware · Bosch B426-CN/B429- CN Firmware +1
- 1
- ericnorris striptags · striptags
- 1
- Jenkins project Jenkins Generic Webhook Trigger Plugin · or…
- 1
- MCU Technologies MCUsystem
- 1
- Primion Digitek Secure
- 1
- Synology Calendar
- 1
Critical 3
- CVE-2021-3604Primion-Digitek Secure 8 SQL injection vulnerabilityPrimion Digitek Secure
- CVE-2021-34809Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology DSynology Download Station
- CVE-2021-34810Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated useSynology Download Station
High 8
- CVE-2021-21410Out-of-bounds read in the 6LoWPAN implementationcontiki-ng
- CVE-2021-21257Out-of-bounds write in RPL-Classic and RPL-Litecontiki-ng
- CVE-2021-21279Infinite loop in IPv6 neighbor solicitation processingcontiki-ng
- CVE-2021-21280Out-of-bounds write when processing 6LoWPAN extension headerscontiki-ng
- CVE-2021-21281Buffer overflow due to unvalidated TCP data offsetcontiki-ng
- CVE-2021-21282Buffer overflow in RPL source routing header processingcontiki-ng
- CVE-2021-23846B426 Credential DisclosureBosch B426 Firmware
- CVE-2021-23845B426 Web Configuration Authentication BypassBosch B426 Firmware · Bosch B426-CN/B429- CN Firmware +1
Medium, low and unrated 29
- CVE-2021-31660RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sens
- CVE-2021-31272SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to
- CVE-2021-31661RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensi
- CVE-2021-31662RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sens
- CVE-2021-31663RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sens
- CVE-2021-31664RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sens
- CVE-2021-33185SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
- CVE-2021-33186SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
- CVE-2021-32696Passing in a non-string 'html' argument can lead to unsanitized outputericnorris striptags · striptags
- CVE-2021-33824An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012.
- CVE-2021-33823An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012.
- CVE-2021-33822An issue was discovered on 4GEE ROUTER HH70VB Version HH70_E1_02.00_22.
- CVE-2021-33818An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.
- CVE-2021-33820An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make w
- CVE-2020-18442Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip_file_read" in the function
- CVE-2021-32954Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbiAdvantech WebAccess/SCADA
- CVE-2021-32956Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted UAdvantech WebAccess/SCADA
- CVE-2021-21997VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver.VMware Tools for Windows
- CVE-2021-26835No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution
- CVE-2021-26834A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2.
- CVE-2021-34815CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.
- CVE-2021-33577An issue was discovered in Cleo LexiCom 5.5.0.0.
- CVE-2021-33576An issue was discovered in Cleo LexiCom 5.5.0.0.
- CVE-2021-33347An issue was discovered in JPress v3.3.0 and below.
- CVE-2021-32536MCU Technologies MCUsystem - Reflected XSSMCU Technologies MCUsystem
- CVE-2021-21669Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Generic Webhook Trigger Plugin · or…
- CVE-2021-34808Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to acceSynology Media Server
- CVE-2021-34811Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote Synology Download Station
- CVE-2021-34812Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitSynology Calendar