CVEs published June 29, 2021
61 CVEs were published on June 29, 2021: 3 critical, 18 high.
- Published
- 61
- Critical
- 3
- High
- 18
- Medium
- 9
- Low
- 1
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- OpenText Brava! Desktop
- 9
- AppNitro Machform
- 5
- FATEK Automation WinProladder
- 3
- Apache Software Foundation Apache Traffic Server
- 2
- IBM Planning Analytics
- 2
- ratpack · io.ratpack:ratpack-core
- 2
- ratpack · io.ratpack:ratpack-session
- 2
- TIBCO Software TIBCO Enterprise Runtime for R - Server E… +2
- 2
- Vector 35 Binary Ninja
- 2
- AndrewBurian powermux · github.com/AndrewBurian/powermux
- 1
Critical 3
- CVE-2021-29485Remote Code Execution Vulnerability in Session Storageratpack · io.ratpack:ratpack-core
- CVE-2020-7869An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary fmastersoft ZOOK
- CVE-2020-7868Helpu remote code execution vulnerabilityhelpu.ocx
High 18
- CVE-2021-28830TIBCO Spotfire Windows Platform Artifact Search vulnerabilityTIBCO Software TIBCO Enterprise Runtime for R - Server E… +2
- CVE-2021-23275TIBCO Spotfire Windows Platform Installation vulnerabilityTIBCO Software TIBCO Enterprise Runtime for R - Server E… +2
- CVE-2021-21871A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9.PowerISO
- CVE-2021-29479Cached redirect poisoning via X-Forwarded-Host headerratpack · io.ratpack:ratpack-core
- CVE-2021-31516This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID Vector 35 Binary Ninja
- CVE-2021-31515This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID Vector 35 Binary Ninja
- CVE-2021-31514This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55.OpenText Brava! Desktop
- CVE-2021-31513This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55.OpenText Brava! Desktop
- CVE-2021-31512This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55.OpenText Brava! Desktop
- CVE-2021-31511This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55.OpenText Brava! Desktop
- CVE-2021-31510This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55.OpenText Brava! Desktop
- CVE-2021-31509This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84.OpenText Brava! Desktop
- CVE-2021-31507This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84.OpenText Brava! Desktop
- CVE-2021-31508This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84.OpenText Brava! Desktop
- CVE-2020-7871A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command.Cnesty Helpcom
- CVE-2021-22545Use-after-free in BinDiffGoogle Bindiff
- CVE-2021-31838Command injection through environment variable in MVISION EDRMcAfee MVISION EDR
- CVE-2021-1134Cisco DNA Center Certificate Validation VulnerabilityCisco Digital Network Architecture Center
Medium, low and unrated 40
- CVE-2021-35941Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system f
- CVE-2021-22341There is a memory leak vulnerability in Huawei products.IPS Module;NGFW Module;NIP6300;NIP6600;Secospace USG6300;Se…
- CVE-2021-22329There has a license management vulnerability in some Huawei products.S12700;S1700;S2700;S5700;S6700;S7700;S9700
- CVE-2021-22338There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10.eCNS280
- CVE-2021-22340There is a multiple threads race condition vulnerability in Huawei product.ManageOne;SMC2.0
- CVE-2021-32721URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermuxAndrewBurian powermux · github.com/AndrewBurian/powermux
- CVE-2021-22439There is a deserialization vulnerability in Huawei AnyOffice V200R006C10.AnyOffice
- CVE-2021-29481Client side sessions should not allow unencrypted storageratpack · io.ratpack:ratpack-session
- CVE-2021-20079Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user Nessus
- CVE-2021-29480Default client side session signing key is highly predictableratpack · io.ratpack:ratpack-session
- CVE-2020-18066Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
- CVE-2020-21394SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDataback
- CVE-2021-22119Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a DeSpring Security · org.springframework.security:spring-se… +1
- CVE-2021-20580IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and uIBM Planning Analytics
- CVE-2021-20490IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settinIBM Spectrum Protect Plus
- CVE-2021-20477IBM Planning Analytics 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics
- CVE-2021-20105Machform prior to version 16 is vulnerable to an open redirect in Safari_init.php due to an improperly sanitized 'ref' parameter.AppNitro Machform
- CVE-2021-20104Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments uplAppNitro Machform
- CVE-2021-20103Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded withAppNitro Machform
- CVE-2021-20102Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place.AppNitro Machform
- CVE-2021-20101Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers.AppNitro Machform
- CVE-2021-32988FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitFATEK Automation WinProladder
- CVE-2021-32992FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may alFATEK Automation WinProladder
- CVE-2021-32990FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrFATEK Automation WinProladder
- CVE-2021-31506This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6OpenText Brava! Desktop
- CVE-2021-31505This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3_278.Arlo Q Plus
- CVE-2021-34824Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and De
- CVE-2020-7870A memory corruption vulnerability exists when ezPDF improperly handles the parameter.UNIDOCS ezPDF Reader · UNIDOCS ezPDF Editor
- CVE-2021-31531Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2021-31530Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.
- CVE-2021-31160Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.
- CVE-2021-32565HTTP Request Smuggling, content length with invalid chartersApache Software Foundation Apache Traffic Server
- CVE-2021-27577Incorrect handling of url fragment leads to cache poisoningApache Software Foundation Apache Traffic Server
- CVE-2021-23400HTTP Header Injectionnodemailer
- CVE-2021-28691Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interfacLinux
- CVE-2021-28690x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability.xen
- CVE-2021-34550An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006.
- CVE-2021-34549An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005.
- CVE-2021-34548An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003.
- CVE-2021-33503An issue was discovered in urllib3 before 1.26.5.urllib3