# CVEs published 2021-06-18

40 CVEs were published on June 18, 2021: 3 critical, 8 high. Days are UTC.

- [CVE-2021-31660](https://cve.now/CVE-2021-31660.md): RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sens (no CVSS)
- [CVE-2021-31272](https://cve.now/CVE-2021-31272.md): SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to (no CVSS)
- [CVE-2021-31661](https://cve.now/CVE-2021-31661.md): RIOT-OS 2021.01 before commit 609c9ada34da5546cffb632a98b7ba157c112658 contains a buffer overflow that could allow attackers to obtain sensi (no CVSS)
- [CVE-2021-31662](https://cve.now/CVE-2021-31662.md): RIOT-OS 2021.01 before commit 07f1254d8537497552e7dce80364aaead9266bbe contains a buffer overflow which could allow attackers to obtain sens (no CVSS)
- [CVE-2021-31663](https://cve.now/CVE-2021-31663.md): RIOT-OS 2021.01 before commit bc59d60be60dfc0a05def57d74985371e4f22d79 contains a buffer overflow which could allow attackers to obtain sens (no CVSS)
- [CVE-2021-31664](https://cve.now/CVE-2021-31664.md): RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sens (no CVSS)
- [CVE-2021-33185](https://cve.now/CVE-2021-33185.md): SerenityOS contains a buffer overflow in the set\_range test in TestBitmap which could allow attackers to obtain sensitive information. (no CVSS)
- [CVE-2021-33186](https://cve.now/CVE-2021-33186.md): SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information. (no CVSS)
- [CVE-2021-21410](https://cve.now/CVE-2021-21410.md): Out-of-bounds read in the 6LoWPAN implementation (CVSS 8.2, contiki-ng)
- [CVE-2021-21257](https://cve.now/CVE-2021-21257.md): Out-of-bounds write in RPL-Classic and RPL-Lite (CVSS 8.2, contiki-ng)
- [CVE-2021-21279](https://cve.now/CVE-2021-21279.md): Infinite loop in IPv6 neighbor solicitation processing (CVSS 7.5, contiki-ng)
- [CVE-2021-21280](https://cve.now/CVE-2021-21280.md): Out-of-bounds write when processing 6LoWPAN extension headers (CVSS 8.6, contiki-ng)
- [CVE-2021-21281](https://cve.now/CVE-2021-21281.md): Buffer overflow due to unvalidated TCP data offset (CVSS 7.0, contiki-ng)
- [CVE-2021-21282](https://cve.now/CVE-2021-21282.md): Buffer overflow in RPL source routing header processing (CVSS 8.6, contiki-ng)
- [CVE-2021-32696](https://cve.now/CVE-2021-32696.md): Passing in a non-string 'html' argument can lead to unsanitized output (CVSS 3.7, ericnorris striptags · striptags)
- [CVE-2021-33824](https://cve.now/CVE-2021-33824.md): An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. (no CVSS)
- [CVE-2021-33823](https://cve.now/CVE-2021-33823.md): An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. (no CVSS)
- [CVE-2021-33822](https://cve.now/CVE-2021-33822.md): An issue was discovered on 4GEE ROUTER HH70VB Version HH70\_E1\_02.00\_22. (no CVSS)
- [CVE-2021-33818](https://cve.now/CVE-2021-33818.md): An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67. (no CVSS)
- [CVE-2021-33820](https://cve.now/CVE-2021-33820.md): An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make w (no CVSS)
- [CVE-2020-18442](https://cve.now/CVE-2020-18442.md): Infinite Loop in zziplib v0.13.69 allows remote attackers to cause a denial of service via the return value "zzip\_file\_read" in the function (no CVSS)
- [CVE-2021-3604](https://cve.now/CVE-2021-3604.md): Primion-Digitek Secure 8 SQL injection vulnerability (CVSS 9.8, Primion Digitek Secure)
- [CVE-2021-32954](https://cve.now/CVE-2021-32954.md): Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbi (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2021-32956](https://cve.now/CVE-2021-32956.md): Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted U (no CVSS, Advantech WebAccess/SCADA)
- [CVE-2021-23846](https://cve.now/CVE-2021-23846.md): B426 Credential Disclosure (CVSS 8.8, Bosch B426 Firmware)
- [CVE-2021-23845](https://cve.now/CVE-2021-23845.md): B426 Web Configuration Authentication Bypass (CVSS 8.0, Bosch B426 Firmware · Bosch B426-CN/B429- CN Firmware +1)
- [CVE-2021-21997](https://cve.now/CVE-2021-21997.md): VMware Tools for Windows (11.x.y prior to 11.3.0) contains a denial-of-service vulnerability in the VM3DMP driver. (no CVSS, VMware Tools for Windows)
- [CVE-2021-26835](https://cve.now/CVE-2021-26835.md): No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution (no CVSS)
- [CVE-2021-26834](https://cve.now/CVE-2021-26834.md): A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. (no CVSS)
- [CVE-2021-34815](https://cve.now/CVE-2021-34815.md): CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN\_PAGE\_DISCLAIMER parameter. (no CVSS)
- [CVE-2021-33577](https://cve.now/CVE-2021-33577.md): An issue was discovered in Cleo LexiCom 5.5.0.0. (no CVSS)
- [CVE-2021-33576](https://cve.now/CVE-2021-33576.md): An issue was discovered in Cleo LexiCom 5.5.0.0. (no CVSS)
- [CVE-2021-33347](https://cve.now/CVE-2021-33347.md): An issue was discovered in JPress v3.3.0 and below. (no CVSS)
- [CVE-2021-32536](https://cve.now/CVE-2021-32536.md): MCU Technologies MCUsystem - Reflected XSS (CVSS 6.1, MCU Technologies MCUsystem)
- [CVE-2021-21669](https://cve.now/CVE-2021-21669.md): Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Generic Webhook Trigger Plugin · or…)
- [CVE-2021-34808](https://cve.now/CVE-2021-34808.md): Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to acce (CVSS 5.8, Synology Media Server)
- [CVE-2021-34809](https://cve.now/CVE-2021-34809.md): Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology D (CVSS 9.9, Synology Download Station)
- [CVE-2021-34810](https://cve.now/CVE-2021-34810.md): Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated use (CVSS 9.9, Synology Download Station)
- [CVE-2021-34811](https://cve.now/CVE-2021-34811.md): Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote (CVSS 5.0, Synology Download Station)
- [CVE-2021-34812](https://cve.now/CVE-2021-34812.md): Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensit (CVSS 5.8, Synology Calendar)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.