# CVEs published 2021-06-24

103 CVEs were published on June 24, 2021: 2 critical, 11 high. Days are UTC.

- [CVE-2021-32717](https://cve.now/CVE-2021-32717.md): Private files publicly accessible with Cloud Storage providers (CVSS 7.5, shopware platform · shopware/platform +1)
- [CVE-2021-32716](https://cve.now/CVE-2021-32716.md): Internal hidden fields are visible on to many associations in admin api (CVSS 4.4, shopware platform · shopware/platform +1)
- [CVE-2021-32712](https://cve.now/CVE-2021-32712.md): Information leakage in Error Handler (CVSS 5.3, shopware · shopware/shopware)
- [CVE-2021-32713](https://cve.now/CVE-2021-32713.md): Authenticated Stored XSS (CVSS 4.8, shopware · shopware/shopware)
- [CVE-2021-32711](https://cve.now/CVE-2021-32711.md): Leak of information via Store-API (CVSS 9.1, shopware platform · shopware/platform)
- [CVE-2021-32710](https://cve.now/CVE-2021-32710.md): Potential Session Hijacking in Shopware (CVSS 5.9, shopware platform · shopware/platform)
- [CVE-2021-35448](https://cve.now/CVE-2021-35448.md): Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer (no CVSS)
- [CVE-2020-17752](https://cve.now/CVE-2020-17752.md): Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart co (no CVSS)
- [CVE-2020-17753](https://cve.now/CVE-2020-17753.md): An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer a (no CVSS)
- [CVE-2020-17759](https://cve.now/CVE-2020-17759.md): An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. (no CVSS)
- [CVE-2021-32709](https://cve.now/CVE-2021-32709.md): Creation of order credits was not validated by acl in admin orders (CVSS 4.9, shopware platform · shopware/platform +1)
- [CVE-2021-29777](https://cve.now/CVE-2021-29777.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circumstance of a table be (CVSS 5.3, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-29703](https://cve.now/CVE-2021-29703.md): Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to a denial of service as the server terminates abnormally when (CVSS 7.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-20579](https://cve.now/CVE-2021-20579.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view o (CVSS 5.9, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2020-4945](https://cve.now/CVE-2020-4945.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user to overwrite arbirary files due to (CVSS 6.5, IBM DB2 for Linux and UNIX)
- [CVE-2020-4885](https://cve.now/CVE-2020-4885.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the configuration of Db (CVSS 6.2, IBM DB2 for Linux and UNIX)
- [CVE-2021-32493](https://cve.now/CVE-2021-32493.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-32492](https://cve.now/CVE-2021-32492.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-32490](https://cve.now/CVE-2021-32490.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2020-18671](https://cve.now/CVE-2020-18671.md): Cross Site Scripting (XSS) vulnerability in Roundcube Mail \<=1.4.4 via smtp config in /installer/test.php. (no CVSS)
- [CVE-2021-32491](https://cve.now/CVE-2021-32491.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2020-18670](https://cve.now/CVE-2020-18670.md): Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php. (no CVSS)
- [CVE-2021-3500](https://cve.now/CVE-2021-3500.md): A flaw was found in djvulibre-3.5.28 and earlier. (no CVSS, djvulibre)
- [CVE-2021-33002](https://cve.now/CVE-2021-33002.md): Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. (no CVSS, WebAccess HMI Designer)
- [CVE-2020-18668](https://cve.now/CVE-2020-18668.md): Cross Site Scripting (XSS) vulnerabililty in WebPort \<=1.19.1 via the description parameter to script/listcalls. (no CVSS)
- [CVE-2021-33004](https://cve.now/CVE-2021-33004.md): The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow a (no CVSS, WebAccess HMI Designer)
- [CVE-2021-33000](https://cve.now/CVE-2021-33000.md): Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code exe (no CVSS, WebAccess HMI Designer)
- [CVE-2021-21574](https://cve.now/CVE-2021-21574.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21573](https://cve.now/CVE-2021-21573.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21572](https://cve.now/CVE-2021-21572.md): Dell BIOSConnect feature contains a buffer overflow vulnerability. (CVSS 7.2, Dell BIOSConnect)
- [CVE-2021-21571](https://cve.now/CVE-2021-21571.md): Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation (CVSS 5.9, Dell UEFI BIOS https stack)
- [CVE-2021-32708](https://cve.now/CVE-2021-32708.md): Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem (CVSS 9.8, thephpleague flysystem · league/flysystem)
- [CVE-2021-32704](https://cve.now/CVE-2021-32704.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core (CVSS 8.5, dhis2-core)
- [CVE-2020-18667](https://cve.now/CVE-2020-18667.md): SQL Injection vulnerability in WebPort \<=1.19.1 via the new connection, parameter name in type-conn. (no CVSS)
- [CVE-2020-18665](https://cve.now/CVE-2020-18665.md): Directory Traversal vulnerability in WebPort \<=1.19.1 in tags of system settings. (no CVSS)
- [CVE-2020-18664](https://cve.now/CVE-2020-18664.md): Cross Site Scripting (XSS) vulnerability in WebPort \<=1.19.1via the connection name parameter in type-conn. (no CVSS)
- [CVE-2020-21784](https://cve.now/CVE-2020-21784.md): phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php. (no CVSS)
- [CVE-2020-21785](https://cve.now/CVE-2020-21785.md): In IBOS 4.5.4 Open, the database backup has Command Injection Vulnerability. (no CVSS)
- [CVE-2020-21786](https://cve.now/CVE-2020-21786.md): In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.php. (no CVSS)
- [CVE-2020-21783](https://cve.now/CVE-2020-21783.md): In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody\[content\] parameter. (no CVSS)
- [CVE-2021-31649](https://cve.now/CVE-2021-31649.md): In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code ex (no CVSS, com.jfinal:jfinal)
- [CVE-2020-18663](https://cve.now/CVE-2020-18663.md): Cross Site Scripting (XSS) vulnerability in gnuboard5 \<=v5.3.2.8 via the act parameter in bbs/move\_update.php. (no CVSS)
- [CVE-2021-33346](https://cve.now/CVE-2021-33346.md): There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. (no CVSS)
- [CVE-2020-18662](https://cve.now/CVE-2020-18662.md): SQL Injection vulnerability in gnuboard5 \<=v5.3.2.8 via the table\_prefix parameter in install\_db.php. (no CVSS)
- [CVE-2021-23398](https://cve.now/CVE-2021-23398.md): Cross-site Scripting (XSS) (CVSS 6.1, react-bootstrap-table)
- [CVE-2020-18661](https://cve.now/CVE-2020-18661.md): Cross Site Scripting (XSS) vulnerability in gnuboard5 \<=v5.3.2.8 via the url parameter to bbs/login.php. (no CVSS)
- [CVE-2020-21787](https://cve.now/CVE-2020-21787.md): CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php. (no CVSS)
- [CVE-2020-21788](https://cve.now/CVE-2020-21788.md): In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). (no CVSS)
- [CVE-2021-33348](https://cve.now/CVE-2021-33348.md): An issue was discovered in JFinal framework v4.9.10 and below. (no CVSS, com.jfinal:jfinal)
- [CVE-2021-27659](https://cve.now/CVE-2021-27659.md): exacqVision Web Service CSS (CVSS 5.3, Johnson Controls exacqVision Web Service)
- [CVE-2021-27658](https://cve.now/CVE-2021-27658.md): exacqVision Enterprise Manager CSS (CVSS 4.3, Johnson Controls exacqVision Enterprise Manager)
- [CVE-2021-23991](https://cve.now/CVE-2021-23991.md): If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's update (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23992](https://cve.now/CVE-2021-23992.md): Thunderbird did not check if the user ID associated with an OpenPGP key has a valid self signature. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23993](https://cve.now/CVE-2021-23993.md): An attacker may perform a DoS attack to prevent a user from sending encrypted email to a correspondent. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-23994](https://cve.now/CVE-2021-23994.md): A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23995](https://cve.now/CVE-2021-23995.md): When Responsive Design Mode was enabled, it used references to objects that were previously freed. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23996](https://cve.now/CVE-2021-23996.md): By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing (no CVSS, Mozilla Firefox)
- [CVE-2021-23997](https://cve.now/CVE-2021-23997.md): Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. (no CVSS, Mozilla Firefox)
- [CVE-2021-23998](https://cve.now/CVE-2021-23998.md): Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-23999](https://cve.now/CVE-2021-23999.md): If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional pri (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-24000](https://cve.now/CVE-2021-24000.md): A race condition with requestPointerLock() and setTimeout() could have resulted in a user interacting with one tab when they believed they w (no CVSS, Mozilla Firefox)
- [CVE-2021-24001](https://cve.now/CVE-2021-24001.md): A compromised content process could have performed session history manipulations it should not have been able to due to testing infrastructu (no CVSS, Mozilla Firefox)
- [CVE-2021-24002](https://cve.now/CVE-2021-24002.md): When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29944](https://cve.now/CVE-2021-29944.md): Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. (no CVSS, Mozilla Firefox)
- [CVE-2021-29945](https://cve.now/CVE-2021-29945.md): The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29946](https://cve.now/CVE-2021-29946.md): Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-29947](https://cve.now/CVE-2021-29947.md): Mozilla developers and community members reported memory safety bugs present in Firefox 87. (no CVSS, Mozilla Firefox)
- [CVE-2021-29948](https://cve.now/CVE-2021-29948.md): Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local proces (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29949](https://cve.now/CVE-2021-29949.md): When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filenam (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29950](https://cve.now/CVE-2021-29950.md): Thunderbird unprotects a secret OpenPGP key prior to using it for a decryption, signing or key import task. (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29951](https://cve.now/CVE-2021-29951.md): The Mozilla Maintenance Service granted SERVICE\_START access to BUILTIN|Users which, in a domain network, grants normal remote users access (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29952](https://cve.now/CVE-2021-29952.md): When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort ma (no CVSS, Mozilla Firefox)
- [CVE-2021-29953](https://cve.now/CVE-2021-29953.md): A malicious webpage could have forced a Firefox for Android user into executing attacker-controlled JavaScript in the context of another dom (no CVSS, Mozilla Firefox)
- [CVE-2021-29954](https://cve.now/CVE-2021-29954.md): Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata service. (no CVSS, Mozilla Hubs Cloud)
- [CVE-2021-29955](https://cve.now/CVE-2021-29955.md): A transient execution vulnerability, named Floating Point Value Injection (FPVI) allowed an attacker to leak arbitrary memory addresses and (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2021-29956](https://cve.now/CVE-2021-29956.md): OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on the user's local di (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29957](https://cve.now/CVE-2021-29957.md): If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unprotected part, Thund (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29958](https://cve.now/CVE-2021-29958.md): When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to private mode cookies (no CVSS, Mozilla Firefox for iOS)
- [CVE-2021-29959](https://cve.now/CVE-2021-29959.md): When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from (no CVSS, Mozilla Firefox)
- [CVE-2021-29960](https://cve.now/CVE-2021-29960.md): Firefox used to cache the last filename used for printing a file. (no CVSS, Mozilla Firefox)
- [CVE-2021-29961](https://cve.now/CVE-2021-29961.md): When styling and rendering an oversized \`\<select\>\` element, Firefox did not apply correct clipping which allowed an attacker to paint over t (no CVSS, Mozilla Firefox)
- [CVE-2021-29962](https://cve.now/CVE-2021-29962.md): Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. (no CVSS, Mozilla Firefox)
- [CVE-2021-29963](https://cve.now/CVE-2021-29963.md): Address bar search suggestions in private browsing mode were re-using session data from normal mode. (no CVSS, Mozilla Firefox)
- [CVE-2021-29964](https://cve.now/CVE-2021-29964.md): A locally-installed hostile program could send \`WM\_COPYDATA\` messages that Firefox would process incorrectly, leading to an out-of-bounds re (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29965](https://cve.now/CVE-2021-29965.md): A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords f (no CVSS, Mozilla Firefox)
- [CVE-2021-29966](https://cve.now/CVE-2021-29966.md): Mozilla developers reported memory safety bugs present in Firefox 88. (no CVSS, Mozilla Firefox)
- [CVE-2021-29967](https://cve.now/CVE-2021-29967.md): Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78.11. (no CVSS, Mozilla Thunderbird · Mozilla Firefox)
- [CVE-2021-29968](https://cve.now/CVE-2021-29968.md): When drawing text onto a canvas with WebRender disabled, an out of bounds read could occur. (no CVSS, Mozilla Firefox)
- [CVE-2020-28097](https://cve.now/CVE-2020-28097.md): The vgacon subsystem in the Linux kernel before 5.8.10 mishandles software scrollback. (no CVSS)
- [CVE-2021-31412](https://cve.now/CVE-2021-31412.md): Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19 (CVSS 5.3, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-33604](https://cve.now/CVE-2021-33604.md): Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19 (CVSS 2.5, Vaadin · com.vaadin:vaadin-bom)
- [CVE-2021-26585](https://cve.now/CVE-2021-26585.md): A potential vulnerability has been identified in HPE OneView Global Dashboard release 2.31 which could lead to a local disclosure of privile (no CVSS, HPE OneView Global Dashboard)
- [CVE-2021-25923](https://cve.now/CVE-2021-25923.md): In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. (no CVSS, openemr)
- [CVE-2021-21737](https://cve.now/CVE-2021-21737.md): A smart STB product of ZTE is impacted by a permission and access control vulnerability. (no CVSS, ZXV10 B860H)
- [CVE-2020-7862](https://cve.now/CVE-2020-7862.md): HelpU Overflow Vulnerability (CVSS 7.0, HelpuViewer.exe · HelpuServer.exe +2)
- [CVE-2021-25656](https://cve.now/CVE-2021-25656.md): Avaya Aura Experience Portal XSS vulnerabilities (CVSS 5.3, Avaya Product)
- [CVE-2021-25655](https://cve.now/CVE-2021-25655.md): URL redirection to untrusted site possible in Avaya Aura Experience Portal (CVSS 4.4, Avaya Experience Portal)
- [CVE-2021-25653](https://cve.now/CVE-2021-25653.md): Avaya Aura Appliance Virtualization Platform Utilities Privilege Escalation Vulnerability (CVSS 8.0, Avaya Aura Appliance Virtualization Platform Utilities)
- [CVE-2021-25652](https://cve.now/CVE-2021-25652.md): Avaya Aura Appliance Virtualization Platform Utilities Sensitive Information Disclosure Vulnerability (CVSS 4.9, Avaya Aura Appliance Virtualization Platform Utilities)
- [CVE-2021-25651](https://cve.now/CVE-2021-25651.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 8.0, Avaya Aura Utility Services)
- [CVE-2021-25650](https://cve.now/CVE-2021-25650.md): Avaya Aura Utility Services Privilege Escalation Vulnerability (CVSS 7.7, Avaya Aura Utility Services)
- [CVE-2021-25649](https://cve.now/CVE-2021-25649.md): Avaya Utility Services Sensitive Information Disclosure Vulnerability (CVSS 4.9, Avaya Aura Utility Services)
- [CVE-2021-28800](https://cve.now/CVE-2021-28800.md): Command Injection Vulnerability in QTS (CVSS 8.1, QNAP Systems QTS · QNAP Systems QuTS hero +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.