CVEs published June 28, 2021
72 CVEs were published on June 28, 2021: 0 critical, 16 high.
- Published
- 72
- Critical
- 0
- High
- 16
- Medium
- 21
- Low
- 3
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Adobe Animate
- 4
- Adobe Magento Commerce · magento/community-edition +1
- 4
- IBM Security Identity Manager Adapters
- 4
- Adobe After Effects
- 3
- Adobe Experience Manager
- 2
- Adobe Illustrator
- 2
- Adobe InDesign
- 2
- EC-CUBE CO. EC-CUBE · ec-cube/ec-cube
- 2
- Nessus Agent
- 2
- rabbitmq-server
- 2
High 16
- CVE-2021-32723Regular Expression Denial of Service (ReDoS) in PrismPrismJS prism · prismjs
- CVE-2021-20574IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection.IBM Security Identity Manager Adapters
- CVE-2021-28588Adobe RoboHelp Server folderId Directory Traversal Remote Code Execution VulnerabilityAdobe RoboHelp Server
- CVE-2021-21084Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code executionAdobe Experience Manager
- CVE-2021-28586Adobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerabilityAdobe After Effects
- CVE-2021-28570Adobe After Effects uncontrolled search path element vulnerability could lead to remote code executionAdobe After Effects
- CVE-2021-28583Magento Commerce insecure storage of sensitive documentationAdobe Magento Commerce · magento/community-edition +1
- CVE-2021-28562Adobe Acrobat Reader use-after-free could lead to arbitrary code executionAdobe Acrobat Reader
- CVE-2021-21102Adobe Illustrator DOCX file parsing directory traversal vulnerability could lead to remote code executionAdobe Illustrator
- CVE-2021-21090Adobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code executionAdobe InCopy
- CVE-2021-21099Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionAdobe InDesign
- CVE-2021-21098Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code executionAdobe InDesign
- CVE-2021-21101Adobe Illustrator TTF font parsing out-of-bounds write vulnerability could lead to remote code executionAdobe Illustrator
- CVE-2021-21083Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-serviceAdobe Experience Manager
- CVE-2021-29157Dovecot before 2.3.15 allows ../ Path Traversal.
- CVE-2021-23399Arbitrary Command Injectionwincred
Medium, low and unrated 56
- CVE-2021-32722Uncontrolled Resource Consumption in GlobalNewFilesmiraheze GlobalNewFiles
- CVE-2020-21142Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
- CVE-2021-35298Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models t
- CVE-2021-35299Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration pro
- CVE-2021-35300Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the a
- CVE-2021-35301Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail v
- CVE-2021-35302Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information.
- CVE-2021-35303Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar a
- CVE-2021-32720List of order ids, number, items total and token value exposed for unauthorized uses via new APISylius · sylius/sylius
- CVE-2020-22609Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.
- CVE-2020-22608Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php.
- CVE-2020-22607Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/adm
- CVE-2021-35525PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated em
- CVE-2020-20640Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity en
- CVE-2020-23715Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download.
- CVE-2021-35523Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHO
- CVE-2021-20573IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking.IBM Security Identity Manager Adapters
- CVE-2021-20572IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM Security Identity Manager Adapters
- CVE-2021-20494IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap based buffer overflow, caused by improper bounds.IBM Security Identity Manager Adapters
- CVE-2020-23711SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php.
- CVE-2021-29775IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scriIBM Business Automation Workflow · IBM Cloud Pak for Automa…
- CVE-2021-29751IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtaIBM Business Process Manager · IBM Business Automation W… +1
- CVE-2021-29693IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user that is in the with elevated group privileges to cause a denial of service due to a IBM VIOS · IBM AIX
- CVE-2021-20413IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error mesIBM Guardium Data Encryption
- CVE-2021-34187main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter.
- CVE-2021-34254Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx.
- CVE-2021-32719Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management pluginrabbitmq-server
- CVE-2020-23710Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.
- CVE-2021-32718Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UIrabbitmq-server
- CVE-2021-35456Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload
- CVE-2021-28623Adobe Premiere Elements Privilege Escalation VulnerabilityAdobe Premiere
- CVE-2021-28597Adobe Photoshop Elements Privilege Escalation Vulnerability - symbolic linkAdobe Photoshop Elements
- CVE-2021-28579Adobe Connect improper access control could lead to privilege escalationAdobe Connect
- CVE-2021-28574Adobe Animate out-of-bounds read vulnerability could lead to information exposureAdobe Animate
- CVE-2021-28584Magento Commerce path traversal vulnerability in child theme store creationAdobe Magento Commerce · magento/community-edition +1
- CVE-2021-28576Adobe Animate out-of-bounds read vulnerability could lead to information exposureAdobe Animate
- CVE-2021-28587Adobe After Effects TIF file parsing out-of-bounds read information disclosure vulnerabilityAdobe After Effects
- CVE-2021-28585Magento Commerce improper input validation in customer customer webapiAdobe Magento Commerce · magento/community-edition +1
- CVE-2021-28575Adobe Animate out-of-bounds read vulnerability could lead to information exposureAdobe Animate
- CVE-2021-28573Adobe Animate out-of-bounds read vulnerability could lead to information exposureAdobe Animate
- CVE-2021-28563Magento Commerce improper Authorization via the 'Create Customer' endpointAdobe Magento Commerce · magento/community-edition
- CVE-2021-28556Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript executionAdobe Magento Commerce · magento/community-edition +1
- CVE-2020-15303Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.
- CVE-2021-31337The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow SINAMICS Medium Voltage Products
- CVE-2020-28200The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular ex
- CVE-2021-33515The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp.
- CVE-2021-35514Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.narou
- CVE-2021-32496SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH iSICK Visionary-S CX
- CVE-2021-20100Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an auNessus Agent
- CVE-2021-20099Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an auNessus Agent
- CVE-2021-20751Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary sEC-CUBE CO. EC-CUBE · ec-cube/ec-cube
- CVE-2021-20750Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series)EC-CUBE CO. EC-CUBE · ec-cube/ec-cube
- CVE-2021-20749Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and Fnendeb 'Fudousan plugin' series
- CVE-2021-20746Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrarHector Cabrera WordPress Popular Posts
- CVE-2021-20745Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code sTakuya Matsuyama Inkdrop
- CVE-2021-20740Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versHitachi and NEC Hitachi Virtual File Platform and NEC Stora…