CVEs published June 21, 2021
82 CVEs were published on June 21, 2021: 0 critical, 2 high.
- Published
- 82
- Critical
- 0
- High
- 2
- Medium
- 7
- Low
- 1
- Unrated
- 72
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Android
- 26
- Joomla
- 4
- Autoptimize
- 3
- NVIDIA Jetson TX1
- 2
- Pods Framework Team Pods – Custom Content Types and Fields
- 2
- WP Hardening – Fix Your WordPress Security
- 2
- Admin Columns
- 1
- Apache Software Foundation Apache NuttX
- 1
- Automattic Jetpack – WP Security, Backup, Speed, & Growth ·…
- 1
- AyeCode Location Manager
- 1
High 2
Medium, low and unrated 80
- CVE-2010-1435Joomla! Core is prone to a security bypass vulnerability.Joomla
- CVE-2010-1434Joomla! Core is prone to a session fixation vulnerability.Joomla
- CVE-2010-1433Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-suJoomla
- CVE-2010-1432Joomla! Core is prone to an information disclosure vulnerability.Joomla
- CVE-2021-34389Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs.NVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavie…
- CVE-2021-34388Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to control all the RAM afterNVIDIA Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, X…
- CVE-2021-34387The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRANVIDIA Jetson TX1
- CVE-2021-34386Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation can cause the multipliNVIDIA Jetson TX1
- CVE-2021-32698Blind Server-Side Request Forgery (SSRF) in eLabFTWelabftw
- CVE-2021-29061A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when thcom.github.fracpete:vfsjfilechooser2
- CVE-2020-27511An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Den
- CVE-2021-24383WP Google Maps < 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS)WP Google Maps
- CVE-2021-24379Comments Like Dislike < 1.1.4 - Add Like/Dislike BypassComments Like Dislike
- CVE-2021-24378Autoptimize < 2.7.8 - Authenticated Stored XSS via File UploadAutoptimize
- CVE-2021-24377Autoptimize < 2.7.8 - Race Condition leading to RCEAutoptimize
- CVE-2021-24376Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"Autoptimize
- CVE-2021-24374Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment LeakAutomattic Jetpack – WP Security, Backup, Speed, & Growth ·…
- CVE-2021-24373WP Hardening < 1.2.2 - Reflected XSS via historyvalueWP Hardening – Fix Your WordPress Security
- CVE-2021-24372WP Hardening < 1.2.2 - Reflected XSS via URIWP Hardening – Fix Your WordPress Security
- CVE-2021-24369GetPaid < 2.3.4 - Authenticated Stored XSSAyeCode WordPress Payments Plugin | GetPaid
- CVE-2021-24367WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)WP Config File Editor
- CVE-2021-24366Admin Columns Free < 4.3 & Pro < 5.5.1 - Admin+ Stored XSS in LabelAdmin Columns
- CVE-2021-24364Jannah < 5.4.4 - Reflected Cross-Site Scripting (XSS)TieLabs Jannah
- CVE-2021-24361GeoDirectory Location Manager < 2.1.0.10 - Multiple Unauthenticated SQL InjectionsAyeCode Location Manager
- CVE-2021-24339Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)Pods Framework Team Pods – Custom Content Types and Fields
- CVE-2021-24338Pods < 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS)Pods Framework Team Pods – Custom Content Types and Fields
- CVE-2021-35066An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
- CVE-2021-32697Form validation can be skippedneos form · neos/form
- CVE-2020-19511Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
- CVE-2020-19510Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
- CVE-2021-26461malloc, realloc and memalign implementations are vulnerable to integer wrap-aroundsApache Software Foundation Apache NuttX
- CVE-2021-0532In memory management driver, there is a possible memory corruption due to a race condition.Android
- CVE-2021-0530In memory management driver, there is a possible out of bounds write due to uninitialized data.Android
- CVE-2021-0531In memory management driver, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0529In memory management driver, there is a possible memory corruption due to improper locking.Android
- CVE-2021-0528In memory management driver, there is a possible memory corruption due to a double free.Android
- CVE-2021-0526In memory management driver, there is a possible out of bounds write due to uninitialized data.Android
- CVE-2021-0533In memory management driver, there is a possible memory corruption due to a race condition.Android
- CVE-2021-0525In memory management driver, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-0527In memory management driver, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0506In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack.Android
- CVE-2021-0507In handle_rc_metamsg_cmd of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0516In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out of bounds read and write due to a use after free.Android
- CVE-2021-0505In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check.Android
- CVE-2021-0504In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0517In updateCapabilities of ConnectivityService.java, there is a possible incorrect network state determination due to a logic error in the codAndroid
- CVE-2021-0511In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation.Android
- CVE-2021-0510In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0508In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition.Android
- CVE-2021-0509In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition.Android
- CVE-2021-0520In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition.Android
- CVE-2021-0521In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check.Android
- CVE-2021-0522In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out of bounds read due to a use after free.Android
- CVE-2021-0523In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay Android
- CVE-2021-0512In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0478In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception.Android
- CVE-2021-0513In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improperAndroid
- CVE-2021-29059A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if theis-svg
- CVE-2021-29060A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the apcolor-string
- CVE-2020-21130Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html.
- CVE-2020-21517Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.
- CVE-2019-25047Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad.
- CVE-2018-25016Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection.
- CVE-2020-22390Akaunting <= 2.0.9 is vulnerable to CSV injection in the Item name field, export function.
- CVE-2021-28833Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796.qiita-markdown
- CVE-2021-28684The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of l
- CVE-2021-29337MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a craf
- CVE-2021-33572Denial-of-Service (DoS) VulnerabilityF-Secure Products
- CVE-2021-31769MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in t
- CVE-2020-20474White Shark System (WSS) 1.3.2 has a SQL injection vulnerability.
- CVE-2020-20473White Shark System (WSS) 1.3.2 has a SQL injection vulnerability.
- CVE-2020-20472White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability.
- CVE-2020-20471White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default_user_edit.php, remote attackers can exploit this vulnerab
- CVE-2020-20470White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability.
- CVE-2020-20469White Shark System (WSS) 1.3.2 has a SQL injection vulnerability.
- CVE-2020-20468White Shark System (WSS) 1.3.2 is vulnerable to CSRF.
- CVE-2020-20467White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the
- CVE-2020-20466White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of
- CVE-2021-24370Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCEFancy Product Designer
- CVE-2021-29063A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is cmpmath