CVEs published June 24, 2021
103 CVEs were published on June 24, 2021: 2 critical, 11 high.
- Published
- 103
- Critical
- 2
- High
- 11
- Medium
- 18
- Low
- 1
- Unrated
- 71
- Now in CISA KEV
- 0
- Fix available
- 50
Most affected products
- Mozilla Firefox
- 16
- Mozilla Thunderbird
- 8
- Mozilla Firefox ESR · Mozilla Thunderbird +1
- 7
- djvulibre
- 5
- Avaya Aura Utility Services
- 3
- Dell BIOSConnect
- 3
- IBM DB2 for Linux, UNIX and Windows
- 3
- Mozilla Thunderbird · Mozilla Firefox
- 3
- shopware platform · shopware/platform +1
- 3
- WebAccess HMI Designer
- 3
Critical 2
High 11
- CVE-2021-32717Private files publicly accessible with Cloud Storage providersshopware platform · shopware/platform +1
- CVE-2021-29703Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when IBM DB2 for Linux, UNIX and Windows
- CVE-2021-21574Dell BIOSConnect feature contains a buffer overflow vulnerability.Dell BIOSConnect
- CVE-2021-21573Dell BIOSConnect feature contains a buffer overflow vulnerability.Dell BIOSConnect
- CVE-2021-21572Dell BIOSConnect feature contains a buffer overflow vulnerability.Dell BIOSConnect
- CVE-2021-32704Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-coredhis2-core
- CVE-2020-7862HelpU Overflow VulnerabilityHelpuViewer.exe · HelpuServer.exe +2
- CVE-2021-25653Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation VulnerabilityAvaya Aura Appliance Virtualization Platform Utilities
- CVE-2021-25651Avaya Aura Utility Services Privilege Escalation VulnerabilityAvaya Aura Utility Services
- CVE-2021-25650Avaya Aura Utility Services Privilege Escalation VulnerabilityAvaya Aura Utility Services
- CVE-2021-28800Command Injection Vulnerability in QTSQNAP Systems QTS · QNAP Systems QuTS hero +1
Medium, low and unrated 90
- CVE-2021-32716Internal hidden fields are visible on to many associations in admin apishopware platform · shopware/platform +1
- CVE-2021-32712Information leakage in Error Handlershopware · shopware/shopware
- CVE-2021-32713Authenticated Stored XSSshopware · shopware/shopware
- CVE-2021-32710Potential Session Hijacking in Shopwareshopware platform · shopware/platform
- CVE-2021-35448Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer
- CVE-2020-17752Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart co
- CVE-2020-17753An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer a
- CVE-2020-17759An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler.
- CVE-2021-32709Creation of order credits was not validated by acl in admin ordersshopware platform · shopware/platform +1
- CVE-2021-29777IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table beIBM DB2 for Linux, UNIX and Windows
- CVE-2021-20579IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view oIBM DB2 for Linux, UNIX and Windows
- CVE-2020-4945IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to IBM DB2 for Linux and UNIX
- CVE-2020-4885IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of DbIBM DB2 for Linux and UNIX
- CVE-2021-32493A flaw was found in djvulibre-3.5.28 and earlier.djvulibre
- CVE-2021-32492A flaw was found in djvulibre-3.5.28 and earlier.djvulibre
- CVE-2021-32490A flaw was found in djvulibre-3.5.28 and earlier.djvulibre
- CVE-2020-18671Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
- CVE-2021-32491A flaw was found in djvulibre-3.5.28 and earlier.djvulibre
- CVE-2020-18670Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.
- CVE-2021-3500A flaw was found in djvulibre-3.5.28 and earlier.djvulibre
- CVE-2021-33002Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code.WebAccess HMI Designer
- CVE-2020-18668Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.
- CVE-2021-33004The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow aWebAccess HMI Designer
- CVE-2021-33000Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code exeWebAccess HMI Designer
- CVE-2021-21571Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validationDell UEFI BIOS https stack
- CVE-2020-18667SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.
- CVE-2020-18665Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
- CVE-2020-18664Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.
- CVE-2020-21784phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.
- CVE-2020-21785In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability.
- CVE-2020-21786In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php.
- CVE-2020-21783In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.
- CVE-2021-31649In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code excom.jfinal:jfinal
- CVE-2020-18663Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.
- CVE-2021-33346There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product.
- CVE-2020-18662SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.
- CVE-2021-23398Cross-site Scripting (XSS)react-bootstrap-table
- CVE-2020-18661Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
- CVE-2020-21787CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
- CVE-2020-21788In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery).
- CVE-2021-33348An issue was discovered in JFinal framework v4.9.10 and below.com.jfinal:jfinal
- CVE-2021-27659exacqVision Web Service CSSJohnson Controls exacqVision Web Service
- CVE-2021-27658exacqVision Enterprise Manager CSSJohnson Controls exacqVision Enterprise Manager
- CVE-2021-23991If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updateMozilla Thunderbird
- CVE-2021-23992Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature.Mozilla Thunderbird
- CVE-2021-23993An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent.Mozilla Thunderbird
- CVE-2021-23994A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-23995When Responsive Design Mode was enabled, it used references to objects that were previously freed.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-23996By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofingMozilla Firefox
- CVE-2021-23997Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache.Mozilla Firefox
- CVE-2021-23998Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-23999If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional priMozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-24000A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they wMozilla Firefox
- CVE-2021-24001A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructuMozilla Firefox
- CVE-2021-24002When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-29944Lack of escaping allowed HTML injection when a webpage was viewed in Reader View.Mozilla Firefox
- CVE-2021-29945The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-29946Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when usedMozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-29947Mozilla developers and community members reported memory safety bugs present in Firefox 87.Mozilla Firefox
- CVE-2021-29948Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local procesMozilla Thunderbird
- CVE-2021-29949When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filenamMozilla Thunderbird
- CVE-2021-29950Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task.Mozilla Thunderbird
- CVE-2021-29951The Mozilla Maintenance Service granted SERVICE_START access to BUILTIN|Users which, in a domain network, grants normal remote users access Mozilla Thunderbird · Mozilla Firefox
- CVE-2021-29952When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort maMozilla Firefox
- CVE-2021-29953A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another domMozilla Firefox
- CVE-2021-29954Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service.Mozilla Hubs Cloud
- CVE-2021-29955A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and Mozilla Firefox ESR · Mozilla Firefox
- CVE-2021-29956OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local diMozilla Thunderbird
- CVE-2021-29957If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, ThundMozilla Thunderbird
- CVE-2021-29958When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookiesMozilla Firefox for iOS
- CVE-2021-29959When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website fromMozilla Firefox
- CVE-2021-29960Firefox used to cache the last filename used for printing a file.Mozilla Firefox
- CVE-2021-29961When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over tMozilla Firefox
- CVE-2021-29962Firefox for Android would become unstable and hard-to-recover when a website opened too many popups.Mozilla Firefox
- CVE-2021-29963Address bar search suggestions in private browsing mode were re-using session data from normal mode.Mozilla Firefox
- CVE-2021-29964A locally-installed hostile program could send `WM_COPYDATA` messages that Firefox would process incorrectly, leading to an out-of-bounds reMozilla Thunderbird · Mozilla Firefox
- CVE-2021-29965A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords fMozilla Firefox
- CVE-2021-29966Mozilla developers reported memory safety bugs present in Firefox 88.Mozilla Firefox
- CVE-2021-29967Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11.Mozilla Thunderbird · Mozilla Firefox
- CVE-2021-29968When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur.Mozilla Firefox
- CVE-2020-28097The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback.
- CVE-2021-31412Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19Vaadin · com.vaadin:vaadin-bom
- CVE-2021-33604Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19Vaadin · com.vaadin:vaadin-bom
- CVE-2021-26585A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privileHPE OneView Global Dashboard
- CVE-2021-25923In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit.openemr
- CVE-2021-21737A smart STB product of ZTE is impacted by a permission and access control vulnerability.ZXV10 B860H
- CVE-2021-25656Avaya Aura Experience Portal XSS vulnerabilitiesAvaya Product
- CVE-2021-25655URL redirection to untrusted site possible in Avaya Aura Experience PortalAvaya Experience Portal
- CVE-2021-25652Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure VulnerabilityAvaya Aura Appliance Virtualization Platform Utilities
- CVE-2021-25649Avaya Utility Services Sensitive Information Disclosure VulnerabilityAvaya Aura Utility Services