# CVEs published 2021-06-29

61 CVEs were published on June 29, 2021: 3 critical, 18 high. Days are UTC.

- [CVE-2021-35941](https://cve.now/CVE-2021-35941.md): Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system f (no CVSS)
- [CVE-2021-22341](https://cve.now/CVE-2021-22341.md): There is a memory leak vulnerability in Huawei products. (no CVSS, IPS Module;NGFW Module;NIP6300;NIP6600;Secospace USG6300;Se…)
- [CVE-2021-22329](https://cve.now/CVE-2021-22329.md): There has a license management vulnerability in some Huawei products. (no CVSS, S12700;S1700;S2700;S5700;S6700;S7700;S9700)
- [CVE-2021-22338](https://cve.now/CVE-2021-22338.md): There is an XXE injection vulnerability in eCNS280 V100R005C00 and V100R005C10. (no CVSS, eCNS280)
- [CVE-2021-22340](https://cve.now/CVE-2021-22340.md): There is a multiple threads race condition vulnerability in Huawei product. (no CVSS, ManageOne;SMC2.0)
- [CVE-2021-32721](https://cve.now/CVE-2021-32721.md): URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux (CVSS 4.7, AndrewBurian powermux · github.com/AndrewBurian/powermux)
- [CVE-2021-22439](https://cve.now/CVE-2021-22439.md): There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. (no CVSS, AnyOffice)
- [CVE-2021-29485](https://cve.now/CVE-2021-29485.md): Remote Code Execution Vulnerability in Session Storage (CVSS 9.9, ratpack · io.ratpack:ratpack-core)
- [CVE-2021-29481](https://cve.now/CVE-2021-29481.md): Client side sessions should not allow unencrypted storage (CVSS 6.5, ratpack · io.ratpack:ratpack-session)
- [CVE-2021-20079](https://cve.now/CVE-2021-20079.md): Nessus versions 8.13.2 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator user (no CVSS, Nessus)
- [CVE-2021-29480](https://cve.now/CVE-2021-29480.md): Default client side session signing key is highly predictable (CVSS 4.4, ratpack · io.ratpack:ratpack-session)
- [CVE-2020-18066](https://cve.now/CVE-2020-18066.md): Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment. (no CVSS)
- [CVE-2021-28830](https://cve.now/CVE-2021-28830.md): TIBCO Spotfire Windows Platform Artifact Search vulnerability (CVSS 8.8, TIBCO Software TIBCO Enterprise Runtime for R - Server E… +2)
- [CVE-2021-23275](https://cve.now/CVE-2021-23275.md): TIBCO Spotfire Windows Platform Installation vulnerability (CVSS 8.8, TIBCO Software TIBCO Enterprise Runtime for R - Server E… +2)
- [CVE-2020-21394](https://cve.now/CVE-2020-21394.md): SQL Injection vulnerability in Zhong Bang Technology Co., Ltd CRMEB mall system V2.60 and V3.1 via the tablename parameter in SystemDataback (no CVSS)
- [CVE-2021-22119](https://cve.now/CVE-2021-22119.md): Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a De (no CVSS, Spring Security · org.springframework.security:spring-se… +1)
- [CVE-2021-20580](https://cve.now/CVE-2021-20580.md): IBM Planning Analytics 2.0 could be vulnerable to cross-site request forgery (CSRF) which could allow an attacker to execute malicious and u (CVSS 4.3, IBM Planning Analytics)
- [CVE-2021-20490](https://cve.now/CVE-2021-20490.md): IBM Spectrum Protect Plus 10.1.0 through 10.1.8 could allow a local user to cause a denial of service due to insecure file permission settin (CVSS 4.0, IBM Spectrum Protect Plus)
- [CVE-2021-20477](https://cve.now/CVE-2021-20477.md): IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Planning Analytics)
- [CVE-2021-20105](https://cve.now/CVE-2021-20105.md): Machform prior to version 16 is vulnerable to an open redirect in Safari\_init.php due to an improperly sanitized 'ref' parameter. (no CVSS, AppNitro Machform)
- [CVE-2021-20104](https://cve.now/CVE-2021-20104.md): Machform prior to version 16 is vulnerable to unauthenticated remote code execution due to insufficient sanitization of file attachments upl (no CVSS, AppNitro Machform)
- [CVE-2021-20103](https://cve.now/CVE-2021-20103.md): Machform prior to version 16 is vulnerable to stored cross-site scripting due to insufficient sanitization of file attachments uploaded with (no CVSS, AppNitro Machform)
- [CVE-2021-20102](https://cve.now/CVE-2021-20102.md): Machform prior to version 16 is vulnerable to cross-site request forgery due to a lack of CSRF tokens in place. (no CVSS, AppNitro Machform)
- [CVE-2021-20101](https://cve.now/CVE-2021-20101.md): Machform prior to version 16 is vulnerable to HTTP host header injection due to improperly validated host headers. (no CVSS, AppNitro Machform)
- [CVE-2021-21871](https://cve.now/CVE-2021-21871.md): A memory corruption vulnerability exists in the DMG File Format Handler functionality of PowerISO 7.9. (CVSS 8.8, PowerISO)
- [CVE-2021-32988](https://cve.now/CVE-2021-32988.md): FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbit (no CVSS, FATEK Automation WinProladder)
- [CVE-2021-32992](https://cve.now/CVE-2021-32992.md): FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may al (no CVSS, FATEK Automation WinProladder)
- [CVE-2021-32990](https://cve.now/CVE-2021-32990.md): FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitr (no CVSS, FATEK Automation WinProladder)
- [CVE-2021-29479](https://cve.now/CVE-2021-29479.md): Cached redirect poisoning via X-Forwarded-Host header (CVSS 7.0, ratpack · io.ratpack:ratpack-core)
- [CVE-2021-31516](https://cve.now/CVE-2021-31516.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID (CVSS 7.8, Vector 35 Binary Ninja)
- [CVE-2021-31515](https://cve.now/CVE-2021-31515.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID (CVSS 7.8, Vector 35 Binary Ninja)
- [CVE-2021-31514](https://cve.now/CVE-2021-31514.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31513](https://cve.now/CVE-2021-31513.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31512](https://cve.now/CVE-2021-31512.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31511](https://cve.now/CVE-2021-31511.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31510](https://cve.now/CVE-2021-31510.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.4.55. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31509](https://cve.now/CVE-2021-31509.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31507](https://cve.now/CVE-2021-31507.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31508](https://cve.now/CVE-2021-31508.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31506](https://cve.now/CVE-2021-31506.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brava! Desktop Build 16.6 (CVSS 3.3, OpenText Brava! Desktop)
- [CVE-2021-31505](https://cve.now/CVE-2021-31505.md): This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plus 1.9.0.3\_278. (CVSS 6.8, Arlo Q Plus)
- [CVE-2020-7869](https://cve.now/CVE-2020-7869.md): An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary f (CVSS 9.0, mastersoft ZOOK)
- [CVE-2020-7868](https://cve.now/CVE-2020-7868.md): Helpu remote code execution vulnerability (CVSS 9.6, helpu.ocx)
- [CVE-2021-34824](https://cve.now/CVE-2021-34824.md): Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified in the Gateway and De (no CVSS)
- [CVE-2020-7870](https://cve.now/CVE-2020-7870.md): A memory corruption vulnerability exists when ezPDF improperly handles the parameter. (CVSS 6.4, UNIDOCS ezPDF Reader · UNIDOCS ezPDF Editor)
- [CVE-2021-31531](https://cve.now/CVE-2021-31531.md): Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF). (no CVSS)
- [CVE-2021-31530](https://cve.now/CVE-2021-31530.md): Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure. (no CVSS)
- [CVE-2021-31160](https://cve.now/CVE-2021-31160.md): Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data. (no CVSS)
- [CVE-2020-7871](https://cve.now/CVE-2020-7871.md): A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. (CVSS 7.5, Cnesty Helpcom)
- [CVE-2021-22545](https://cve.now/CVE-2021-22545.md): Use-after-free in BinDiff (CVSS 7.5, Google Bindiff)
- [CVE-2021-32565](https://cve.now/CVE-2021-32565.md): HTTP Request Smuggling, content length with invalid charters (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-27577](https://cve.now/CVE-2021-27577.md): Incorrect handling of url fragment leads to cache poisoning (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-23400](https://cve.now/CVE-2021-23400.md): HTTP Header Injection (CVSS 6.3, nodemailer)
- [CVE-2021-28691](https://cve.now/CVE-2021-28691.md): Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interfac (no CVSS, Linux)
- [CVE-2021-28690](https://cve.now/CVE-2021-28690.md): x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. (no CVSS, xen)
- [CVE-2021-34550](https://cve.now/CVE-2021-34550.md): An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. (no CVSS)
- [CVE-2021-34549](https://cve.now/CVE-2021-34549.md): An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. (no CVSS)
- [CVE-2021-34548](https://cve.now/CVE-2021-34548.md): An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. (no CVSS)
- [CVE-2021-33503](https://cve.now/CVE-2021-33503.md): An issue was discovered in urllib3 before 1.26.5. (no CVSS, urllib3)
- [CVE-2021-31838](https://cve.now/CVE-2021-31838.md): Command injection through environment variable in MVISION EDR (CVSS 8.4, McAfee MVISION EDR)
- [CVE-2021-1134](https://cve.now/CVE-2021-1134.md): Cisco DNA Center Certificate Validation Vulnerability (CVSS 7.4, Cisco Digital Network Architecture Center)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.