# CVEs published 2021-06-25

47 CVEs were published on June 25, 2021: 3 critical, 22 high. Days are UTC.

- [CVE-2021-35502](https://cve.now/CVE-2021-35502.md): app/View/Elements/genericElements/IndexTable/Fields/generic\_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-temp (no CVSS)
- [CVE-2021-25654](https://cve.now/CVE-2021-25654.md): Avaya Aura Device Services Arbitrary Code Execution Vulnerability (CVSS 6.2, Avaya Aura Devices Services)
- [CVE-2021-1073](https://cve.now/CVE-2021-1073.md): NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a bro (CVSS 8.3, NVIDIA GeForce Experience Software)
- [CVE-2021-33542](https://cve.now/CVE-2021-33542.md): Phoenix Contact: Automation Worx Software Suite affected by Remote Code Execution (RCE) vulnerability (CVSS 7.8, Phoenix Contact Automation Worx Software Suite)
- [CVE-2021-33541](https://cve.now/CVE-2021-33541.md): Phoenix Contact: ILC1x Industrial controllers affected by Denial-of-Service vulnerability (CVSS 7.5, Phoenix Contact ILC1x)
- [CVE-2021-33540](https://cve.now/CVE-2021-33540.md): Phoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devices (CVSS 7.3, Phoenix Contact AXL F BK · Phoenix Contact IL)
- [CVE-2021-33539](https://cve.now/CVE-2021-33539.md): WEIDMUELLER: WLAN devices affected by authentication bypass vulnerability (CVSS 7.2, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33538](https://cve.now/CVE-2021-33538.md): WEIDMUELLER: WLAN devices affected by improper access control vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33537](https://cve.now/CVE-2021-33537.md): WEIDMUELLER: WLAN devices affected by Remote Code Execution (RCE) vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33536](https://cve.now/CVE-2021-33536.md): WEIDMUELLER: WLAN devices affected by Denial-of-Service vulnerability (CVSS 7.5, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33535](https://cve.now/CVE-2021-33535.md): WEIDMUELLER: WLAN devices affected by exploitable format string vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33534](https://cve.now/CVE-2021-33534.md): WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability (CVSS 7.2, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33533](https://cve.now/CVE-2021-33533.md): WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33532](https://cve.now/CVE-2021-33532.md): WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33531](https://cve.now/CVE-2021-33531.md): WEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33530](https://cve.now/CVE-2021-33530.md): WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33529](https://cve.now/CVE-2021-33529.md): WEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerability (CVSS 7.5, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-33528](https://cve.now/CVE-2021-33528.md): WEIDMUELLER: WLAN devices affected by privilege escalation vulnerability (CVSS 8.8, Weidmüller IE-WL(T)-BL-AP-CL-XX · Weidmüller IE-WL(T)-VL-AP…)
- [CVE-2021-21005](https://cve.now/CVE-2021-21005.md): Race Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series products (CVSS 7.5, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2021-21004](https://cve.now/CVE-2021-21004.md): Cross-site Scripting Vulnerability in Phoenix Contact FL SWITCH SMCS series products (CVSS 7.4, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2021-21003](https://cve.now/CVE-2021-21003.md): Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products (CVSS 5.3, Phoenix Contact FL SWITCH · Phoenix Contact FL NAT)
- [CVE-2021-21002](https://cve.now/CVE-2021-21002.md): Denial of Service in Phoenix Contact FL COMSERVER UNI products (CVSS 7.5, Phoenix Contact FL COMSERVER)
- [CVE-2021-29677](https://cve.now/CVE-2021-29677.md): IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Verify Privilege Vault)
- [CVE-2021-29676](https://cve.now/CVE-2021-29676.md): IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. (CVSS 4.6, IBM Security Verify Privilege Vault)
- [CVE-2021-20583](https://cve.now/CVE-2021-20583.md): IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP GET request by a priv (CVSS 6.2, IBM Security Verify Privilege Vault)
- [CVE-2020-4610](https://cve.now/CVE-2020-4610.md): IBM Security Secret Server (IBM Security Verify Privilege Manager 10.8.2 ) could allow a local user to execute code due to improper integrit (CVSS 7.4, IBM Security Verify Privilege Manager)
- [CVE-2020-4609](https://cve.now/CVE-2020-4609.md): IBM Security Sevret Server (IBM Security Verify Privilege Manager 10.8.2) is vulnerable to a buffer overflow, caused by improper bounds chec (CVSS 7.4, IBM Security Verify Privilege Manager)
- [CVE-2021-32702](https://cve.now/CVE-2021-32702.md): Reflected XSS from the callback handler's error query parameter (CVSS 8.0, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2021-3314](https://cve.now/CVE-2021-3314.md): Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. (no CVSS)
- [CVE-2021-35501](https://cve.now/CVE-2021-35501.md): PandoraFMS \<=7.54 allows Stored XSS by placing a payload in the name field of a visual console. (no CVSS)
- [CVE-2021-34074](https://cve.now/CVE-2021-34074.md): PandoraFMS \<=7.54 allows arbitrary file upload, it leading to remote command execution via the File Manager. (no CVSS)
- [CVE-2021-34184](https://cve.now/CVE-2021-34184.md): Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma\_default\_vfs\_close\_\_stdio in miniaudio.h. (no CVSS)
- [CVE-2021-34185](https://cve.now/CVE-2021-34185.md): Miniaudio 0.10.35 has an integer-based buffer overflow caused by an out-of-bounds left shift in drwav\_bytes\_to\_u32 in miniaudio.h (no CVSS)
- [CVE-2021-27043](https://cve.now/CVE-2021-27043.md): An Arbitrary Address Write issue in the Autodesk DWG application can allow a malicious user to leverage the application to write in unexpect (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2021-27042](https://cve.now/CVE-2021-27042.md): A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2021-27041](https://cve.now/CVE-2021-27041.md): A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2021-27040](https://cve.now/CVE-2021-27040.md): A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. (no CVSS, Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, Aut…)
- [CVE-2020-26801](https://cve.now/CVE-2020-26801.md): A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device\_vars\_1 on TrippLite SU2200RTXL2Ua with firmware version 12 (no CVSS)
- [CVE-2021-31615](https://cve.now/CVE-2021-31615.md): Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent device to inject a c (no CVSS)
- [CVE-2021-28958](https://cve.now/CVE-2021-28958.md): Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. (no CVSS)
- [CVE-2021-35049](https://cve.now/CVE-2021-35049.md): Command Injection Vulnerability in Fidelis Network and Deception (CVSS 9.9, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2021-35050](https://cve.now/CVE-2021-35050.md): User Credentials Stored in a Recoverable Format within Fidelis Network and Deception (CVSS 6.5, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2021-35047](https://cve.now/CVE-2021-35047.md): Privileged Command Injection Vulnerability in Fidelis Network and Deception (CVSS 9.9, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2021-35048](https://cve.now/CVE-2021-35048.md): Unauthenticated SQL Injection Vulnerability in Fidelis Network and Deception (CVSS 9.8, Fidelis Cybersecurity Fidelis Network · Fidelis Cybersecuri…)
- [CVE-2021-35475](https://cve.now/CVE-2021-35475.md): SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. (no CVSS)
- [CVE-2021-33895](https://cve.now/CVE-2021-33895.md): ETINET BACKBOX E4.09 and H4.09 mismanages password access control. (no CVSS)
- [CVE-2021-34427](https://cve.now/CVE-2021-34427.md): In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (curre (no CVSS, The Eclipse Foundation Eclipse BIRT)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.