# CVEs published 2021-06-21

82 CVEs were published on June 21, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2010-1435](https://cve.now/CVE-2010-1435.md): Joomla! Core is prone to a security bypass vulnerability. (no CVSS, Joomla)
- [CVE-2010-1434](https://cve.now/CVE-2010-1434.md): Joomla! Core is prone to a session fixation vulnerability. (no CVSS, Joomla)
- [CVE-2021-35196](https://cve.now/CVE-2021-35196.md): Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because th (CVSS 7.8)
- [CVE-2010-1433](https://cve.now/CVE-2010-1433.md): Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-su (no CVSS, Joomla)
- [CVE-2010-1432](https://cve.now/CVE-2010-1432.md): Joomla! Core is prone to an information disclosure vulnerability. (no CVSS, Joomla)
- [CVE-2021-34389](https://cve.now/CVE-2021-34389.md): Trusty contains a vulnerability in NVIDIA OTE protocol message parsing code, which is present in all the TAs. (CVSS 5.0, NVIDIA Jetson, TX2 series, TX2 NX, AGX Xavier series, Xavie…)
- [CVE-2021-34388](https://cve.now/CVE-2021-34388.md): Bootloader contains a vulnerability in NVIDIA TegraBoot where a potential heap overflow might allow an attacker to control all the RAM after (CVSS 6.3, NVIDIA Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, X…)
- [CVE-2021-34387](https://cve.now/CVE-2021-34387.md): The ARM TrustZone Technology on which Trusty is based on contains a vulnerability in access permission settings where the portion of the DRA (CVSS 6.3, NVIDIA Jetson TX1)
- [CVE-2021-34386](https://cve.now/CVE-2021-34386.md): Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calloc size calculation can cause the multipli (CVSS 6.3, NVIDIA Jetson TX1)
- [CVE-2021-32698](https://cve.now/CVE-2021-32698.md): Blind Server-Side Request Forgery (SSRF) in eLabFTW (CVSS 6.8, elabftw)
- [CVE-2021-29061](https://cve.now/CVE-2021-29061.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 version 0.2.9 and below which occurs when th (no CVSS, com.github.fracpete:vfsjfilechooser2)
- [CVE-2020-27511](https://cve.now/CVE-2020-27511.md): An issue was discovered in the stripTags and unescapeHTML components in Prototype 1.7.3 where an attacker can cause a Regular Expression Den (no CVSS)
- [CVE-2021-24383](https://cve.now/CVE-2021-24383.md): WP Google Maps \< 8.1.12 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, WP Google Maps)
- [CVE-2021-24379](https://cve.now/CVE-2021-24379.md): Comments Like Dislike \< 1.1.4 - Add Like/Dislike Bypass (no CVSS, Comments Like Dislike)
- [CVE-2021-24378](https://cve.now/CVE-2021-24378.md): Autoptimize \< 2.7.8 - Authenticated Stored XSS via File Upload (no CVSS, Autoptimize)
- [CVE-2021-24377](https://cve.now/CVE-2021-24377.md): Autoptimize \< 2.7.8 - Race Condition leading to RCE (no CVSS, Autoptimize)
- [CVE-2021-24376](https://cve.now/CVE-2021-24376.md): Autoptimize \< 2.7.8 - Arbitrary File Upload via "Import Settings" (no CVSS, Autoptimize)
- [CVE-2021-24374](https://cve.now/CVE-2021-24374.md): Jetpack \< 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak (no CVSS, Automattic Jetpack – WP Security, Backup, Speed, & Growth ·…)
- [CVE-2021-24373](https://cve.now/CVE-2021-24373.md): WP Hardening \< 1.2.2 - Reflected XSS via historyvalue (no CVSS, WP Hardening – Fix Your WordPress Security)
- [CVE-2021-24372](https://cve.now/CVE-2021-24372.md): WP Hardening \< 1.2.2 - Reflected XSS via URI (no CVSS, WP Hardening – Fix Your WordPress Security)
- [CVE-2021-24369](https://cve.now/CVE-2021-24369.md): GetPaid \< 2.3.4 - Authenticated Stored XSS (no CVSS, AyeCode WordPress Payments Plugin | GetPaid)
- [CVE-2021-24367](https://cve.now/CVE-2021-24367.md): WP Config File Editor \<= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, WP Config File Editor)
- [CVE-2021-24366](https://cve.now/CVE-2021-24366.md): Admin Columns Free \< 4.3 & Pro \< 5.5.1 - Admin+ Stored XSS in Label (CVSS 5.4, Admin Columns)
- [CVE-2021-24364](https://cve.now/CVE-2021-24364.md): Jannah \< 5.4.4 - Reflected Cross-Site Scripting (XSS) (no CVSS, TieLabs Jannah)
- [CVE-2021-24361](https://cve.now/CVE-2021-24361.md): GeoDirectory Location Manager \< 2.1.0.10 - Multiple Unauthenticated SQL Injections (no CVSS, AyeCode Location Manager)
- [CVE-2021-24339](https://cve.now/CVE-2021-24339.md): Pods \< 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Pods Framework Team Pods – Custom Content Types and Fields)
- [CVE-2021-24338](https://cve.now/CVE-2021-24338.md): Pods \< 2.7.27 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Pods Framework Team Pods – Custom Content Types and Fields)
- [CVE-2021-35066](https://cve.now/CVE-2021-35066.md): An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. (no CVSS)
- [CVE-2021-21422](https://cve.now/CVE-2021-21422.md): XSS Vulnerability in mongo-express (CVSS 8.1, mongo-express)
- [CVE-2021-32697](https://cve.now/CVE-2021-32697.md): Form validation can be skipped (CVSS 6.5, neos form · neos/form)
- [CVE-2020-19511](https://cve.now/CVE-2020-19511.md): Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes, (no CVSS)
- [CVE-2020-19510](https://cve.now/CVE-2020-19510.md): Textpattern 4.7.3 contains an aribtrary file load via the file\_insert function in include/txp\_file.php. (no CVSS)
- [CVE-2021-26461](https://cve.now/CVE-2021-26461.md): malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds (no CVSS, Apache Software Foundation Apache NuttX)
- [CVE-2021-0532](https://cve.now/CVE-2021-0532.md): In memory management driver, there is a possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0530](https://cve.now/CVE-2021-0530.md): In memory management driver, there is a possible out of bounds write due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0531](https://cve.now/CVE-2021-0531.md): In memory management driver, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0529](https://cve.now/CVE-2021-0529.md): In memory management driver, there is a possible memory corruption due to improper locking. (no CVSS, Android)
- [CVE-2021-0528](https://cve.now/CVE-2021-0528.md): In memory management driver, there is a possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2021-0526](https://cve.now/CVE-2021-0526.md): In memory management driver, there is a possible out of bounds write due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0533](https://cve.now/CVE-2021-0533.md): In memory management driver, there is a possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0525](https://cve.now/CVE-2021-0525.md): In memory management driver, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0527](https://cve.now/CVE-2021-0527.md): In memory management driver, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-0506](https://cve.now/CVE-2021-0506.md): In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-0507](https://cve.now/CVE-2021-0507.md): In handle\_rc\_metamsg\_cmd of btif\_rc.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0516](https://cve.now/CVE-2021-0516.md): In p2p\_process\_prov\_disc\_req of p2p\_pd.c, there is a possible out of bounds read and write due to a use after free. (no CVSS, Android)
- [CVE-2021-0505](https://cve.now/CVE-2021-0505.md): In the Settings app, there is a possible way to disable an always-on VPN due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0504](https://cve.now/CVE-2021-0504.md): In avrc\_pars\_browse\_rsp of avrc\_pars\_ct.cc, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0517](https://cve.now/CVE-2021-0517.md): In updateCapabilities of ConnectivityService.java, there is a possible incorrect network state determination due to a logic error in the cod (no CVSS, Android)
- [CVE-2021-0511](https://cve.now/CVE-2021-0511.md): In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. (no CVSS, Android)
- [CVE-2021-0510](https://cve.now/CVE-2021-0510.md): In decrypt\_1\_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0508](https://cve.now/CVE-2021-0508.md): In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-0509](https://cve.now/CVE-2021-0509.md): In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-0520](https://cve.now/CVE-2021-0520.md): In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-0521](https://cve.now/CVE-2021-0521.md): In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0522](https://cve.now/CVE-2021-0522.md): In ConnectionHandler::SdpCb of connection\_handler.cc, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2021-0523](https://cve.now/CVE-2021-0523.md): In onCreate of WifiScanModeActivity.java, there is a possible way to enable Wi-Fi scanning without user consent due to a tapjacking/overlay (no CVSS, Android)
- [CVE-2021-0512](https://cve.now/CVE-2021-0512.md): In \_\_hidinput\_change\_resolution\_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0478](https://cve.now/CVE-2021-0478.md): In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception. (no CVSS, Android)
- [CVE-2021-0513](https://cve.now/CVE-2021-0513.md): In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission bypass due to improper (no CVSS, Android)
- [CVE-2021-29059](https://cve.now/CVE-2021-29059.md): A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the (no CVSS, is-svg)
- [CVE-2021-29060](https://cve.now/CVE-2021-29060.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the ap (no CVSS, color-string)
- [CVE-2020-21130](https://cve.now/CVE-2020-21130.md): Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html. (no CVSS)
- [CVE-2020-21517](https://cve.now/CVE-2020-21517.md): Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php. (no CVSS)
- [CVE-2019-25047](https://cve.now/CVE-2019-25047.md): Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad. (no CVSS)
- [CVE-2018-25016](https://cve.now/CVE-2018-25016.md): Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection. (no CVSS)
- [CVE-2020-22390](https://cve.now/CVE-2020-22390.md): Akaunting \<= 2.0.9 is vulnerable to CSV injection in the Item name field, export function. (no CVSS)
- [CVE-2021-28833](https://cve.now/CVE-2021-28833.md): Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link, a different vulnerability than CVE-2021-28796. (no CVSS, qiita-markdown)
- [CVE-2021-28684](https://cve.now/CVE-2021-28684.md): The XML parser used in ConeXware PowerArchiver before 20.10.02 allows processing of external entities, which might lead to exfiltration of l (no CVSS)
- [CVE-2021-29337](https://cve.now/CVE-2021-29337.md): MODAPI.sys in MSI Dragon Center 2.0.104.0 allows low-privileged users to access kernel memory and potentially escalate privileges via a craf (no CVSS)
- [CVE-2021-33572](https://cve.now/CVE-2021-33572.md): Denial-of-Service (DoS) Vulnerability (CVSS 3.5, F-Secure Products)
- [CVE-2021-31769](https://cve.now/CVE-2021-31769.md): MyQ Server in MyQ X Smart before 8.2 allows remote code execution by unprivileged users because administrative session data can be read in t (no CVSS)
- [CVE-2020-20474](https://cve.now/CVE-2020-20474.md): White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. (no CVSS)
- [CVE-2020-20473](https://cve.now/CVE-2020-20473.md): White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. (no CVSS)
- [CVE-2020-20472](https://cve.now/CVE-2020-20472.md): White Shark System (WSS) 1.3.2 has a sensitive information disclosure vulnerability. (no CVSS)
- [CVE-2020-20471](https://cve.now/CVE-2020-20471.md): White Shark System (WSS) 1.3.2 has an unauthorized access vulnerability in default\_user\_edit.php, remote attackers can exploit this vulnerab (no CVSS)
- [CVE-2020-20470](https://cve.now/CVE-2020-20470.md): White Shark System (WSS) 1.3.2 has web site physical path leakage vulnerability. (no CVSS)
- [CVE-2020-20469](https://cve.now/CVE-2020-20469.md): White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. (no CVSS)
- [CVE-2020-20468](https://cve.now/CVE-2020-20468.md): White Shark System (WSS) 1.3.2 is vulnerable to CSRF. (no CVSS)
- [CVE-2020-20467](https://cve.now/CVE-2020-20467.md): White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default\_task\_add.php, remote attackers can exploit the (no CVSS)
- [CVE-2020-20466](https://cve.now/CVE-2020-20466.md): White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user\_edit\_password.php, remote attackers can modify the password of (no CVSS)
- [CVE-2021-24370](https://cve.now/CVE-2021-24370.md): Fancy Product Designer \< 4.6.9 - Unauthenticated Arbitrary File Upload and RCE (no CVSS, Fancy Product Designer)
- [CVE-2021-29063](https://cve.now/CVE-2021-29063.md): A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is c (no CVSS, mpmath)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.