CVEs published June 30, 2021
66 CVEs were published on June 30, 2021: 2 critical, 10 high.
- Published
- 66
- Critical
- 2
- High
- 10
- Medium
- 6
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- EMUI;Magic UI
- 18
- NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- 8
- NVIDIA Jetson TX1
- 4
- Apache Software Foundation Apache Traffic Server
- 3
- Jenkins project Jenkins requests-plugin Plugin · org.jenkin…
- 3
- craftcms/cms
- 2
- Huawei HarmonyOS
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- xen
- 2
- Advanced Secure Gateway (ASG) and ProxySG
- 1
Critical 2
- CVE-2021-35973NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthent
- CVE-2019-18906cryptctl: client side password hashing is equivalent to clear text password storageSUSE Linux Enterprise Server for SAP 12-SP5 · SUSE Manager…
High 10
- CVE-2021-32736Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helperthinkjs think-helper · think-helper
- CVE-2021-34380Bootloader contains a vulnerability in NVIDIA MB2 where potential heap overflow might cause corruption of the heap metadata, which might leaNVIDIA Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, X…
- CVE-2021-34379Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 10 is missing.NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34378Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 11 is missing.NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34377Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 9 is missing.NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34376Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 5 is missing.NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34375Trusty contains a vulnerability in all trusted applications (TAs) where the stack cookie was not randomized, which might result in stack-basNVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34374Trusty contains a vulnerability in command handlers where the length of input buffers is not verified.NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34373Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflowNVIDIA Jetson TX1
- CVE-2021-25321arpwatch: Local privilege escalation from runtime user to rootSUSE Linux Enterprise Server 11-SP4-LTSS · SUSE Manager… +3
Medium, low and unrated 54
- CVE-2021-22345There is an Input Verification Vulnerability in Huawei Smartphone.EMUI, Magic UI
- CVE-2021-22346There is an Improper Permission Management Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22348There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22349There is an Input Verification Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22352There is a Configuration Defect Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22351There is a Credentials Management Errors Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22350There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-34075In Artica Pandora FMS <=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can acc
- CVE-2021-22367There is a Key Management Errors Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22368There is a Permission Control Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22354There is an Information Disclosure Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22353There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-21676Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/ReJenkins project Jenkins requests-plugin Plugin · org.jenkin…
- CVE-2021-21675A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests aJenkins project Jenkins requests-plugin Plugin · org.jenkin…
- CVE-2021-21674A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the lisJenkins project Jenkins requests-plugin Plugin · org.jenkin…
- CVE-2021-21673Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attJenkins project Jenkins CAS Plugin · org.jenkins-ci.plugins…
- CVE-2021-21672Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Selenium HTML report Plugin · org.j…
- CVE-2021-21671Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21670Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/CancJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-22371There is an Improper Permission Management Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22323There is an Integer Overflow Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22369There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22374There is an Improper Validation of Array Index Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-35971Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft
- CVE-2021-35970Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permi
- CVE-2021-22373There is a Defects Introduced in the Design Process Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22376A component of the HarmonyOS has a Improper Privilege Management vulnerability.Huawei HarmonyOS
- CVE-2021-22372There is a Security Features Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22370There is a Credentials Management Errors Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22375There is a Key Management Errors Vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22326A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability.Huawei HarmonyOS
- CVE-2021-22380There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone.EMUI
- CVE-2021-3630An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may leadjvulibre
- CVE-2021-20461IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting.IBM Cognos Analytics
- CVE-2021-20107There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers includSLOAN
- CVE-2021-28993Plixer Scrutinizer 19.0.2 is affected by: SQL Injection.
- CVE-2021-27903An issue was discovered in Craft CMS before 3.6.7.craftcms/cms
- CVE-2021-27902An issue was discovered in Craft CMS before 3.6.0.craftcms/cms
- CVE-2021-35956Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers
- CVE-2021-25951XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.XML2Dict
- CVE-2021-31721Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.
- CVE-2021-30648The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability.Advanced Secure Gateway (ASG) and ProxySG
- CVE-2021-28693xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g.xen
- CVE-2021-28692inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issxen
- CVE-2021-34385Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap oNVIDIA Jetson TX1
- CVE-2021-34384Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow could cause memory corruption, which might lead to denial NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34383Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privilegeNVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…
- CVE-2021-34382Trusty TLK contains a vulnerability in the NVIDIA TLK kernel’s tz_map_shared_mem function where an integer overflow on the size parameter caNVIDIA Jetson TX1
- CVE-2021-34381Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow NVIDIA Jetson TX1
- CVE-2021-35474Dynamic stack buffer overflow in cachekey pluginApache Software Foundation Apache Traffic Server
- CVE-2021-32567Reading HTTP/2 frames too many timesApache Software Foundation Apache Traffic Server
- CVE-2021-32566Specific sequence of HTTP/2 frames can cause ATS to crashApache Software Foundation Apache Traffic Server
- CVE-2021-35959In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tplone
- CVE-2021-35958TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extra