# CVEs published 2021-06-23 33 CVEs were published on June 23, 2021: 1 critical, 6 high. Days are UTC. - [CVE-2021-35041](https://cve.now/CVE-2021-35041.md): The blockchain node in FISCO-BCOS V2.7.2 may have a bug when dealing with unformatted packet and lead to a crash. (no CVSS) - [CVE-2021-32823](https://cve.now/CVE-2021-32823.md): Potential Denial-of-Service in bindata (CVSS 3.7, dmendel bindata · bindata) - [CVE-2021-2322](https://cve.now/CVE-2021-2322.md): Vulnerability in OpenGrok (component: Web App). (CVSS 8.8, Oracle OpenGrok) - [CVE-2021-34071](https://cve.now/CVE-2021-34071.md): Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f (no CVSS) - [CVE-2021-34070](https://cve.now/CVE-2021-34070.md): Out-of-bounds Read in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. (no CVSS) - [CVE-2021-34069](https://cve.now/CVE-2021-34069.md): Divide-by-zero bug in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted file. (no CVSS) - [CVE-2021-34068](https://cve.now/CVE-2021-34068.md): Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f (no CVSS) - [CVE-2021-34067](https://cve.now/CVE-2021-34067.md): Heap based buffer overflow in tsMuxer 2.6.16 allows attackers to cause a Denial of Service (DoS) by running the application with a crafted f (no CVSS) - [CVE-2021-20019](https://cve.now/CVE-2021-20019.md): A vulnerability in SonicOS where the HTTP server response leaks partial memory by sending a crafted HTTP request, this can potentially lead (no CVSS, SonicWall SonicOS) - [CVE-2021-21809](https://cve.now/CVE-2021-21809.md): A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. (CVSS 8.2, Moodle · moodle/moodle) - [CVE-2020-18660](https://cve.now/CVE-2020-18660.md): GetSimpleCMS \<=3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter. (no CVSS) - [CVE-2020-18659](https://cve.now/CVE-2020-18659.md): Cross Site Scripting vulnerability in GetSimpleCMS \<=3.3.15 via the (1) sitename, (2) username, and (3) email parameters to /admin/setup.php (no CVSS) - [CVE-2020-18658](https://cve.now/CVE-2020-18658.md): Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS \<=3.3.15 via the timezone parameter to settings.php. (no CVSS) - [CVE-2020-18657](https://cve.now/CVE-2020-18657.md): Cross Site Scripting (XSS) vulnerability in GetSimpleCMS \<= 3.3.15 in admin/changedata.php via the redirect\_url parameter and the headers\_se (no CVSS) - [CVE-2020-23962](https://cve.now/CVE-2020-23962.md): A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted pay (no CVSS) - [CVE-2021-29620](https://cve.now/CVE-2021-29620.md): XXE vulnerability on Launch import with externally-defined DTD file (CVSS 7.5, reportportal · com.epam.reportportal:service-api) - [CVE-2021-33624](https://cve.now/CVE-2021-33624.md): In kernel/bpf/verifier.c in the Linux kernel before 5.12.13, a branch can be mispredicted (e.g., because of type confusion) and consequently (no CVSS, :linux\_kernel:) - [CVE-2020-20392](https://cve.now/CVE-2020-20392.md): SQL Injection vulnerability in imcat v5.2 via the fm\[auser\] parameters in coms/add\_coms.php. (no CVSS) - [CVE-2020-20391](https://cve.now/CVE-2020-20391.md): Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via (1) Add Snippet and (2) Save snippets. (no CVSS) - [CVE-2020-20389](https://cve.now/CVE-2020-20389.md): Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php. (no CVSS) - [CVE-2021-35438](https://cve.now/CVE-2021-35438.md): phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator. (no CVSS) - [CVE-2021-28977](https://cve.now/CVE-2021-28977.md): Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to (no CVSS) - [CVE-2021-28976](https://cve.now/CVE-2021-28976.md): Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess. (no CVSS) - [CVE-2021-31586](https://cve.now/CVE-2021-31586.md): Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. (no CVSS) - [CVE-2021-31585](https://cve.now/CVE-2021-31585.md): Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH passwords that allow loc (no CVSS) - [CVE-2021-21999](https://cve.now/CVE-2021-21999.md): VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior (no CVSS, VMware Tools for Windows, VMware Remote Console for Windows…) - [CVE-2021-21998](https://cve.now/CVE-2021-21998.md): VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. (no CVSS, VMware Carbon Black App Control) - [CVE-2021-29084](https://cve.now/CVE-2021-29084.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in Security Advisor report (CVSS 7.5, Synology DiskStation Manager) - [CVE-2021-29085](https://cve.now/CVE-2021-29085.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in file sharing management (CVSS 8.6, Synology DiskStation Manager) - [CVE-2021-29087](https://cve.now/CVE-2021-29087.md): Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology DiskStation Man (CVSS 7.5, Synology DiskStation Manager) - [CVE-2021-27649](https://cve.now/CVE-2021-27649.md): Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote at (CVSS 9.8, Synology DiskStation Manager) - [CVE-2021-29086](https://cve.now/CVE-2021-29086.md): Exposure of sensitive information to an unauthorized actor vulnerability in webapi component in Synology DiskStation Manager (DSM) before 6. (CVSS 5.3, Synology DiskStation Manager) - [CVE-2021-35210](https://cve.now/CVE-2021-35210.md): Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. (no CVSS, contao/core-bundle · contao/contao) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-06-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.