CVEs published June 22, 2021
104 CVEs were published on June 22, 2021: 2 critical, 2 high.
- Published
- 104
- Critical
- 2
- High
- 2
- Medium
- 8
- Low
- 4
- Unrated
- 88
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Android
- 42
- NVIDIA Jetson TX1
- 4
- NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier…
- 4
- eCNS280_TD
- 2
- eSE620X vESS
- 2
- vanilla forums
- 2
- WESEEK GROWI
- 2
- ampache
- 1
- ballerina-platform ballerina-lang
- 1
- Bitdefender Total Security · Bitdefender Internet Securi… +1
- 1
Critical 2
High 2
- CVE-2021-34372Trusty (the trusted OS produced by NVIDIA for Jetson devices) driver contains a vulnerability in the NVIDIA OTE protocol message parsing codNVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier…
- CVE-2021-32701Possible bypass of token claim validation when OAuth2 Introspection caching is enabledory oathkeeper · github.com/ory/oathkeeper
Medium, low and unrated 100
- CVE-2021-34397Bootloader contains a vulnerability in NVIDIA MB2, which may cause free-the-wrong-heap, which may lead to limited denial of service.NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier…
- CVE-2021-34396Bootloader contains a vulnerability in access permission settings where unauthorized software may be able to overwrite NVIDIA MB2 code, whicNVIDIA Jetson TX2 series, TX2 NX
- CVE-2021-34395Trusty TLK contains a vulnerability in its access permission settings where it does not properly restrict access to a resource from a user wNVIDIA Jetson TX1
- CVE-2021-34394Trusty contains a vulnerability in the NVIDIA OTE protocol that is present in all TAs.NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier…
- CVE-2021-34393Trusty contains a vulnerability in TSEC TA which deserializes the incoming messages even though the TSEC TA does not expose any command.NVIDIA Jetson TX2 series, TX2 NX, AGX Xavier series, Xavier…
- CVE-2021-34392Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the tz_map_shared_mem function can bypass boundaryNVIDIA Jetson TX1
- CVE-2021-34391Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow throNVIDIA Jetson TX1
- CVE-2021-34390Trusty contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow throNVIDIA Jetson TX1
- CVE-2020-36394pam_setquota.c in the pam_setquota module before 2020-05-29 for Linux-PAM allows local attackers to set their quota on an arbitrary filesyst
- CVE-2021-32699Asymmetric Resource Consumption (Amplification) in Docker containers created by Wingspterodactyl wings · github.com/pterodactyl/wings
- CVE-2021-22383There is an out-of-bounds read vulnerability in eCNS280_TD V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPCeCNS280_TD;eSE620X vESS
- CVE-2021-22382Huawei LTE USB Dongle products have an improper permission assignment vulnerability.E3372
- CVE-2021-22363There is a resource management error vulnerability in eCNS280_TD V100R005C10SPC650.eCNS280_TD
- CVE-2021-22342There is an information leak vulnerability in Huawei products.IPS Module;NGFW Module;SeMG9811;USG9500
- CVE-2021-22378There is a race condition vulnerability in eCNS280_TD V100R005C00 and V100R005C10.eCNS280_TD
- CVE-2021-22377There is a command injection vulnerability in S12700 V200R019C00SPC500, S2700 V200R019C00SPC500, S5700 V200R019C00SPC500, S6700 V200R019C00SS12700;S2700;S5700;S6700;S7700
- CVE-2021-22366There is an out-of-bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300.eSE620X vESS
- CVE-2021-22365There is an out of bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300.eSE620X vESS
- CVE-2021-32644Cross-site Scripting in Random.phpampache
- CVE-2021-22361There is an improper authorization vulnerability in eCNS280 V100R005C00, V100R005C10 and eSE620X vESS V100R001C10SPC200, V100R001C20SPC200.eCNS280;eSE620X vESS
- CVE-2020-18654Cross Site Scripting (XSS) in Wuzhi CMS v4.1.0 allows remote attackers to execute arbitrary code via the "Title" parameter in the component
- CVE-2020-15732Improper Certificate Validation vulnerability in the Online Threat Prevention module as used in Bitdefender Total Security allows an attackeBitdefender Total Security · Bitdefender Internet Securi… +1
- CVE-2021-34428For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, thThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2020-18648Cross Site Request Forgery (CSRF) in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMS_v1.0/admin
- CVE-2020-18647Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/nonecms/vendor".
- CVE-2020-18646Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php".
- CVE-2020-22176PHPGurukul Hospital Management System in PHP v4.0 has a sensitive information disclosure vulnerability in multiple areas.
- CVE-2020-22170PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php.
- CVE-2020-22164PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\check_availability.php.
- CVE-2020-22165PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php.
- CVE-2020-22166PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\forgot-password.php.
- CVE-2020-22167PHPGurukul Hospital Management System in PHP v4.0 has a Persistent Cross-Site Scripting vulnerability in \hms\admin\appointment-history.php.
- CVE-2020-22168PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\change-emaild.php.
- CVE-2020-22169PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\appointment-history.php.
- CVE-2020-22171PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\registration.php.
- CVE-2020-22172PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\get_doctor.php.
- CVE-2020-22173PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\edit-profile.php.
- CVE-2020-22174PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\book-appointment.php.
- CVE-2020-22175PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\admin\betweendates-detailsreports.php.
- CVE-2010-4816It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of serviFreeBSD and OpenBSD ftpd service
- CVE-2021-35206Gitpod before 0.6.0 allows unvalidated redirects.
- CVE-2010-4266It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.vanilla forums
- CVE-2010-4264It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute ovanilla forums
- CVE-2021-35046A session fixation vulnerability was discovered in Ice Hrm 29.0.0 OS which allows an attacker to hijack a valid user session via a crafted s
- CVE-2021-35045Cross site scripting (XSS) vulnerability in Ice Hrm 29.0.0.OS, allows attackers to execute arbitrary code via the parameters to the /app/ en
- CVE-2021-34244A cross site request forgery (CSRF) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to create new admin accounts or
- CVE-2021-34243A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web script
- CVE-2010-3300It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.OWASP ESAPI · org.owasp.esapi:esapi
- CVE-2010-2525A flaw was discovered in gfs2 file system’s handling of acls (access control lists).kernel
- CVE-2021-0608In handleAppLaunch of AppLaunchActivity.java, there is a possible arbitrary activity launch due to a confused deputy.Android
- CVE-2021-0607In iaxxx_calc_i2s_div of iaxxx-codec.c, there is a possible hardware port write with user controlled data due to a missing bounds check.Android
- CVE-2021-0606In drm_syncobj_handle_to_fd of drm_syncobj.c, there is a possible use after free due to incorrect refcounting.Android
- CVE-2021-0605In pfkey_dump of af_key.c, there is a possible out-of-bounds read due to a missing bounds check.Android
- CVE-2021-0551In bind of MediaControlPanel.java, there is a possible way to lock up the system UI using a malicious media file due to improper input validAndroid
- CVE-2021-0552In getEndItemSliceAction of MediaOutputSlice.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0549In sspRequestCallback of BondStateMachine.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure.Android
- CVE-2021-0542In updateNotification of BeamTransferManager.java, there is a missing permission check.Android
- CVE-2021-0541In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0553In onBindViewHolder of AppSwitchPreference.java, there is a possible bypass of device admin setttings due to unclear UI.Android
- CVE-2021-0550In onLoadFailed of AnnotateActivity.java, there is a possible way to gain WRITE_EXTERNAL_STORAGE permissions without user consent due to a cAndroid
- CVE-2021-0548In rw_i93_send_to_lower of rw_i93.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0547In onReceive of NetInitiatedActivity.java, there is a possible way to supply an attacker-controlled value to a GPS HAL handler due to a missAndroid
- CVE-2021-0546In phNxpNciHal_print_res_status of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0545In phNxpNciHal_print_res_status of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0544In phNxpNciHal_print_res_status of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0543In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0540In halWrapperDataCallback of hal_wrapper.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0539In archiveStoredConversation of MmsService.java, there is a possible way to archive message conversation without user consent due to a missiAndroid
- CVE-2021-0538In onCreate of EmergencyCallbackModeExitDialog.java, there is a possible exit of emergency callback mode due to a tapjacking/overlay attack.Android
- CVE-2021-0537In onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0 configuration due to a tapjacking/overlay attaAndroid
- CVE-2021-0536In dropFile of WiFiInstaller, there is a way to delete files accessible to CertInstaller due to a confused deputy.Android
- CVE-2021-0535In wpas_ctrl_msg_queue_timeout of ctrl_iface_unix.c, there is a possible memory corruption due to a use after free.Android
- CVE-2021-0566In accessAudioHalPidscpp of TimeCheck.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0563In ih264e_fmt_conv_422i_to_420sp of ih264e_fmt_conv.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0562In RasterIntraUpdate of motion_est.cpp, there is a possible out of bounds read due to an incorrect bounds check.Android
- CVE-2021-0561In append_to_verify_fifo_interleaved_ of stream_encoder.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0559In Lag_max of p_ol_wgh.cpp, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0558In fillMainDataBuf of pvmp3_framedecoder.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0556In getBlockSum of fastcodemb.cpp, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2021-0564In decrypt of CryptoPlugin.cpp, there is a possible use-after-free due to a race condition.Android
- CVE-2021-0557In setRange of ABuffer.cpp, there is a possible out of bounds write due to an integer overflow.Android
- CVE-2021-0565In wrapUserThread of AudioStream.cpp, there is a possible use after free due to a race condition.Android
- CVE-2021-0572In doNotification of AccountManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0569In onStart of ContactsDumpActivity.java, there is possible access to contacts due to a tapjacking/overlay attack.Android
- CVE-2021-0554In isBackupServiceActive of BackupManagerService.java, there is a missing permission check.Android
- CVE-2021-0570In sendBugreportNotification of BugreportProgressService.java, there is a possible permission bypass due to an unsafe PendingIntent.Android
- CVE-2021-0568In onReceive of DevicePolicyManagerService.java, there is a possible enabling of disabled profiles due to a missing permission check.Android
- CVE-2021-0567In isRestricted of RemoteViews.java, there is a possible way to inject font files due to a permissions bypass.Android
- CVE-2021-0534In permission declarations of DeviceAdminReceiver.java, there is a possible lack of broadcast protection due to an insecure default value.Android
- CVE-2021-0571In ActivityTaskManagerService.startActivity() and AppTaskImpl.startActivity() of ActivityTaskManagerService.java and AppTaskImpl.java, thereAndroid
- CVE-2021-0555In RenderStruct of protostream_objectsource.cc, there is a possible crash due to a missing null check.Android
- CVE-2021-20744Cross-site scripting vulnerability in EC-CUBE Category contents plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a remEC-CUBE CO. EC-CUBE Category contents plugin
- CVE-2021-20743Cross-site scripting vulnerability in EC-CUBE Email newsletters management plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.4 aEC-CUBE CO. EC-CUBE Email newsletters management plugin
- CVE-2021-20742Cross-site scripting vulnerability in EC-CUBE Business form output plugin (for EC-CUBE 3.0 series) versions prior to version 1.0.1 allows a EC-CUBE CO. EC-CUBE Business form output plugin
- CVE-2021-20741Cross-site scripting vulnerability in Hitachi Application Server Help (Hitachi Application Server V10 Manual (Windows) version 10-11-01 and Hitachi Application Server Help
- CVE-2021-20737Improper authentication vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to view the unauthorized pages without accWESEEK GROWI
- CVE-2021-20736NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in tWESEEK GROWI
- CVE-2021-20735Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip numbETUNA EC-CUBE plugins
- CVE-2021-20734Cross-site scripting vulnerability in Welcart e-Commerce versions prior to 2.2.4 allows remote attackers to inject arbitrary script or HTML Collne Welcart e-Commerce
- CVE-2021-20733Improper authorization in handler for custom URL scheme vulnerability in あすけんダイエット (asken diet) for Android versions from v.3.0.0 to v.4.2.xあすけんダイエット (asken diet) for Android