# CVEs published 2021-06-28

72 CVEs were published on June 28, 2021: 0 critical, 16 high. Days are UTC.

- [CVE-2021-32722](https://cve.now/CVE-2021-32722.md): Uncontrolled Resource Consumption in GlobalNewFiles (CVSS 6.5, miraheze GlobalNewFiles)
- [CVE-2021-32723](https://cve.now/CVE-2021-32723.md): Regular Expression Denial of Service (ReDoS) in Prism (CVSS 7.4, PrismJS prism · prismjs)
- [CVE-2020-21142](https://cve.now/CVE-2020-21142.md): Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi. (no CVSS)
- [CVE-2021-35298](https://cve.now/CVE-2021-35298.md): Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models t (no CVSS)
- [CVE-2021-35299](https://cve.now/CVE-2021-35299.md): Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration pro (no CVSS)
- [CVE-2021-35300](https://cve.now/CVE-2021-35300.md): Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the a (no CVSS)
- [CVE-2021-35301](https://cve.now/CVE-2021-35301.md): Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information via the Ticket Article detail v (no CVSS)
- [CVE-2021-35302](https://cve.now/CVE-2021-35302.md): Incorrect Access Control for linked Tickets in Zammad 1.0.x up to 4.0.0 allows remote attackers to obtain sensitive information. (no CVSS)
- [CVE-2021-35303](https://cve.now/CVE-2021-35303.md): Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar a (no CVSS)
- [CVE-2021-32720](https://cve.now/CVE-2021-32720.md): List of order ids, number, items total and token value exposed for unauthorized uses via new API (CVSS 5.3, Sylius · sylius/sylius)
- [CVE-2020-22609](https://cve.now/CVE-2020-22609.md): Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php. (no CVSS)
- [CVE-2020-22608](https://cve.now/CVE-2020-22608.md): Cross Site Scripting vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter to include/ajax.search.php. (no CVSS)
- [CVE-2020-22607](https://cve.now/CVE-2020-22607.md): Cross Site Scripting vulnerabilty in LimeSurvey 4.1.11+200316 via the (1) name and (2) description parameters in application/controllers/adm (no CVSS)
- [CVE-2021-35525](https://cve.now/CVE-2021-35525.md): PostSRSd before 1.11 allows a denial of service (subprocess hang) if Postfix sends certain long data fields such as multiple concatenated em (no CVSS)
- [CVE-2020-20640](https://cve.now/CVE-2020-20640.md): Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity en (no CVSS)
- [CVE-2020-23715](https://cve.now/CVE-2020-23715.md): Directory Traversal vulnerability in Webport CMS 1.19.10.17121 via the file parameter to file/download. (no CVSS)
- [CVE-2021-35523](https://cve.now/CVE-2021-35523.md): Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHO (no CVSS)
- [CVE-2021-20574](https://cve.now/CVE-2021-20574.md): IBM Security Identity Manager Adapters 6.0 and 7.0 could allow a remote authenticated attacker to conduct an LDAP injection. (CVSS 7.5, IBM Security Identity Manager Adapters)
- [CVE-2021-20573](https://cve.now/CVE-2021-20573.md): IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. (CVSS 6.5, IBM Security Identity Manager Adapters)
- [CVE-2021-20572](https://cve.now/CVE-2021-20572.md): IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. (CVSS 6.5, IBM Security Identity Manager Adapters)
- [CVE-2021-20494](https://cve.now/CVE-2021-20494.md): IBM Security Identity Manager Adapters 6.0 and 7.0 are vulnerable to a heap based buffer overflow, caused by improper bounds. (CVSS 6.5, IBM Security Identity Manager Adapters)
- [CVE-2020-23711](https://cve.now/CVE-2020-23711.md): SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. (no CVSS)
- [CVE-2021-29775](https://cve.now/CVE-2021-29775.md): IBM Business Automation Workflow 19.0.03 and 20.0 and IBM Cloud Pak for Automation 20.0.3-IF002 and 21.0.1 are vulnerable to cross-site scri (CVSS 6.4, IBM Business Automation Workflow · IBM Cloud Pak for Automa…)
- [CVE-2021-29751](https://cve.now/CVE-2021-29751.md): IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obta (CVSS 3.1, IBM Business Process Manager · IBM Business Automation W… +1)
- [CVE-2021-29693](https://cve.now/CVE-2021-29693.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user that is in the with elevated group privileges to cause a denial of service due to a (CVSS 4.9, IBM VIOS · IBM AIX)
- [CVE-2021-20413](https://cve.now/CVE-2021-20413.md): IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error mes (CVSS 4.3, IBM Guardium Data Encryption)
- [CVE-2021-34187](https://cve.now/CVE-2021-34187.md): main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. (no CVSS)
- [CVE-2021-34254](https://cve.now/CVE-2021-34254.md): Umbraco CMS before 7.15.7 is vulnerable to Open Redirection due to insufficient url sanitization on booting.aspx. (no CVSS)
- [CVE-2021-32719](https://cve.now/CVE-2021-32719.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin (CVSS 3.1, rabbitmq-server)
- [CVE-2020-23710](https://cve.now/CVE-2020-23710.md): Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature. (no CVSS)
- [CVE-2021-32718](https://cve.now/CVE-2021-32718.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI (CVSS 3.1, rabbitmq-server)
- [CVE-2021-35456](https://cve.now/CVE-2021-35456.md): Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload (no CVSS)
- [CVE-2021-28623](https://cve.now/CVE-2021-28623.md): Adobe Premiere Elements Privilege Escalation Vulnerability (CVSS 6.2, Adobe Premiere)
- [CVE-2021-28597](https://cve.now/CVE-2021-28597.md): Adobe Photoshop Elements Privilege Escalation Vulnerability - symbolic link (CVSS 6.2, Adobe Photoshop Elements)
- [CVE-2021-28588](https://cve.now/CVE-2021-28588.md): Adobe RoboHelp Server folderId Directory Traversal Remote Code Execution Vulnerability (CVSS 8.8, Adobe RoboHelp Server)
- [CVE-2021-28579](https://cve.now/CVE-2021-28579.md): Adobe Connect improper access control could lead to privilege escalation (CVSS 4.3, Adobe Connect)
- [CVE-2021-21084](https://cve.now/CVE-2021-21084.md): Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code execution (CVSS 7.3, Adobe Experience Manager)
- [CVE-2021-28586](https://cve.now/CVE-2021-28586.md): Adobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerability (CVSS 8.8, Adobe After Effects)
- [CVE-2021-28574](https://cve.now/CVE-2021-28574.md): Adobe Animate out-of-bounds read vulnerability could lead to information exposure (CVSS 4.3, Adobe Animate)
- [CVE-2021-28584](https://cve.now/CVE-2021-28584.md): Magento Commerce path traversal vulnerability in child theme store creation (CVSS 5.4, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-28570](https://cve.now/CVE-2021-28570.md): Adobe After Effects uncontrolled search path element vulnerability could lead to remote code execution (CVSS 8.3, Adobe After Effects)
- [CVE-2021-28576](https://cve.now/CVE-2021-28576.md): Adobe Animate out-of-bounds read vulnerability could lead to information exposure (CVSS 4.3, Adobe Animate)
- [CVE-2021-28587](https://cve.now/CVE-2021-28587.md): Adobe After Effects TIF file parsing out-of-bounds read information disclosure vulnerability (CVSS 4.3, Adobe After Effects)
- [CVE-2021-28585](https://cve.now/CVE-2021-28585.md): Magento Commerce improper input validation in customer customer webapi (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-28575](https://cve.now/CVE-2021-28575.md): Adobe Animate out-of-bounds read vulnerability could lead to information exposure (CVSS 4.3, Adobe Animate)
- [CVE-2021-28583](https://cve.now/CVE-2021-28583.md): Magento Commerce insecure storage of sensitive documentation (CVSS 7.5, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-28573](https://cve.now/CVE-2021-28573.md): Adobe Animate out-of-bounds read vulnerability could lead to information exposure (CVSS 4.3, Adobe Animate)
- [CVE-2021-28562](https://cve.now/CVE-2021-28562.md): Adobe Acrobat Reader use-after-free could lead to arbitrary code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-21102](https://cve.now/CVE-2021-21102.md): Adobe Illustrator DOCX file parsing directory traversal vulnerability could lead to remote code execution (CVSS 8.8, Adobe Illustrator)
- [CVE-2021-21090](https://cve.now/CVE-2021-21090.md): Adobe InCopy DOCX file parsing directory traversal vulnerability could lead to remote code execution (CVSS 8.8, Adobe InCopy)
- [CVE-2021-28563](https://cve.now/CVE-2021-28563.md): Magento Commerce improper Authorization via the 'Create Customer' endpoint (CVSS 6.5, Adobe Magento Commerce · magento/community-edition)
- [CVE-2021-21099](https://cve.now/CVE-2021-21099.md): Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution (CVSS 8.8, Adobe InDesign)
- [CVE-2021-28556](https://cve.now/CVE-2021-28556.md): Magento Commerce DOM-based cross-site scripting (XSS) could lead to arbitrary javascript execution (CVSS 6.9, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-21098](https://cve.now/CVE-2021-21098.md): Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution (CVSS 8.8, Adobe InDesign)
- [CVE-2021-21101](https://cve.now/CVE-2021-21101.md): Adobe Illustrator TTF font parsing out-of-bounds write vulnerability could lead to remote code execution (CVSS 8.8, Adobe Illustrator)
- [CVE-2021-21083](https://cve.now/CVE-2021-21083.md): Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service (CVSS 7.5, Adobe Experience Manager)
- [CVE-2020-15303](https://cve.now/CVE-2020-15303.md): Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564. (no CVSS)
- [CVE-2021-31337](https://cve.now/CVE-2021-31337.md): The Telnet service of the SIMATIC HMI Comfort Panels system component in affected products does not require authentication, which may allow (no CVSS, SINAMICS Medium Voltage Products)
- [CVE-2020-28200](https://cve.now/CVE-2020-28200.md): The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular ex (CVSS 4.3)
- [CVE-2021-33515](https://cve.now/CVE-2021-33515.md): The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. (no CVSS)
- [CVE-2021-29157](https://cve.now/CVE-2021-29157.md): Dovecot before 2.3.15 allows ../ Path Traversal. (CVSS 7.5)
- [CVE-2021-35514](https://cve.now/CVE-2021-35514.md): Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel. (no CVSS, narou)
- [CVE-2021-32496](https://cve.now/CVE-2021-32496.md): SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH i (no CVSS, SICK Visionary-S CX)
- [CVE-2021-20100](https://cve.now/CVE-2021-20100.md): Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an au (no CVSS, Nessus Agent)
- [CVE-2021-20099](https://cve.now/CVE-2021-20099.md): Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities which could allow an au (no CVSS, Nessus Agent)
- [CVE-2021-23399](https://cve.now/CVE-2021-23399.md): Arbitrary Command Injection (CVSS 7.3, wincred)
- [CVE-2021-20751](https://cve.now/CVE-2021-20751.md): Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary s (no CVSS, EC-CUBE CO. EC-CUBE · ec-cube/ec-cube)
- [CVE-2021-20750](https://cve.now/CVE-2021-20750.md): Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) (no CVSS, EC-CUBE CO. EC-CUBE · ec-cube/ec-cube)
- [CVE-2021-20749](https://cve.now/CVE-2021-20749.md): Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.0 and earlier, and F (no CVSS, nendeb 'Fudousan plugin' series)
- [CVE-2021-20746](https://cve.now/CVE-2021-20746.md): Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker to inject an arbitrar (no CVSS, Hector Cabrera WordPress Popular Posts)
- [CVE-2021-20745](https://cve.now/CVE-2021-20745.md): Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code s (no CVSS, Takuya Matsuyama Inkdrop)
- [CVE-2021-20740](https://cve.now/CVE-2021-20740.md): Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a vers (no CVSS, Hitachi and NEC Hitachi Virtual File Platform and NEC Stora…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.