CVEs published June 23, 2021
33 CVEs were published on June 23, 2021: 1 critical, 6 high.
- Published
- 33
- Critical
- 1
- High
- 6
- Medium
- 1
- Low
- 1
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Synology DiskStation Manager
- 5
- :linux_kernel:
- 1
- contao/core-bundle · contao/contao
- 1
- dmendel bindata · bindata
- 1
- Moodle · moodle/moodle
- 1
- Oracle OpenGrok
- 1
- reportportal · com.epam.reportportal:service-api
- 1
- SonicWall SonicOS
- 1
- VMware Carbon Black App Control
- 1
- VMware Tools for Windows, VMware Remote Console for Windows…
- 1
Critical 1
High 6
- CVE-2021-2322Vulnerability in OpenGrok (component: Web App).Oracle OpenGrok
- CVE-2021-21809A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.Moodle · moodle/moodle
- CVE-2021-29620XXE vulnerability on Launch import with externally-defined DTD filereportportal · com.epam.reportportal:service-api
- CVE-2021-29084Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report Synology DiskStation Manager
- CVE-2021-29085Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management Synology DiskStation Manager
- CVE-2021-29087Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation ManSynology DiskStation Manager
Medium, low and unrated 26
- CVE-2021-35041The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash.
- CVE-2021-32823Potential Denial-of-Service in bindatadmendel bindata · bindata
- CVE-2021-34071Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f
- CVE-2021-34070Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
- CVE-2021-34069Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file.
- CVE-2021-34068Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f
- CVE-2021-34067Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f
- CVE-2021-20019A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead SonicWall SonicOS
- CVE-2020-18660GetSimpleCMS <=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter.
- CVE-2020-18659Cross Site Scripting vulnerability in GetSimpleCMS <=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php
- CVE-2020-18658Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php.
- CVE-2020-18657Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url parameter and the headers_se
- CVE-2020-23962A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2021-33624In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently:linux_kernel:
- CVE-2020-20392SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.
- CVE-2020-20391Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets.
- CVE-2020-20389Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.
- CVE-2021-35438phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
- CVE-2021-28977Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to
- CVE-2021-28976Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.
- CVE-2021-31586Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search.
- CVE-2021-31585Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow loc
- CVE-2021-21999VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior VMware Tools for Windows, VMware Remote Console for Windows…
- CVE-2021-21998VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass.VMware Carbon Black App Control
- CVE-2021-29086Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6.Synology DiskStation Manager
- CVE-2021-35210Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.contao/core-bundle · contao/contao