# CVEs published 2021-06-30

66 CVEs were published on June 30, 2021: 2 critical, 10 high. Days are UTC.

- [CVE-2021-22345](https://cve.now/CVE-2021-22345.md): There is an Input Verification Vulnerability in Huawei Smartphone. (no CVSS, EMUI, Magic UI)
- [CVE-2021-22346](https://cve.now/CVE-2021-22346.md): There is an Improper Permission Management Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22348](https://cve.now/CVE-2021-22348.md): There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22349](https://cve.now/CVE-2021-22349.md): There is an Input Verification Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22352](https://cve.now/CVE-2021-22352.md): There is a Configuration Defect Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22351](https://cve.now/CVE-2021-22351.md): There is a Credentials Management Errors Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22350](https://cve.now/CVE-2021-22350.md): There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-34075](https://cve.now/CVE-2021-34075.md): In Artica Pandora FMS \<=754 in the File Manager component, there is sensitive information exposed on the client side which attackers can acc (no CVSS)
- [CVE-2021-22367](https://cve.now/CVE-2021-22367.md): There is a Key Management Errors Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-32736](https://cve.now/CVE-2021-32736.md): Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helper (CVSS 7.5, thinkjs think-helper · think-helper)
- [CVE-2021-22368](https://cve.now/CVE-2021-22368.md): There is a Permission Control Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22354](https://cve.now/CVE-2021-22354.md): There is an Information Disclosure Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22353](https://cve.now/CVE-2021-22353.md): There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-21676](https://cve.now/CVE-2021-21676.md): Jenkins requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Re (no CVSS, Jenkins project Jenkins requests-plugin Plugin · org.jenkin…)
- [CVE-2021-21675](https://cve.now/CVE-2021-21675.md): A cross-site request forgery (CSRF) vulnerability in Jenkins requests-plugin Plugin 2.2.12 and earlier allows attackers to create requests a (no CVSS, Jenkins project Jenkins requests-plugin Plugin · org.jenkin…)
- [CVE-2021-21674](https://cve.now/CVE-2021-21674.md): A missing permission check in Jenkins requests-plugin Plugin 2.2.6 and earlier allows attackers with Overall/Read permission to view the lis (no CVSS, Jenkins project Jenkins requests-plugin Plugin · org.jenkin…)
- [CVE-2021-21673](https://cve.now/CVE-2021-21673.md): Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing att (no CVSS, Jenkins project Jenkins CAS Plugin · org.jenkins-ci.plugins…)
- [CVE-2021-21672](https://cve.now/CVE-2021-21672.md): Jenkins Selenium HTML report Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Selenium HTML report Plugin · org.j…)
- [CVE-2021-21671](https://cve.now/CVE-2021-21671.md): Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the previous session on login. (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-21670](https://cve.now/CVE-2021-21670.md): Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Canc (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-22371](https://cve.now/CVE-2021-22371.md): There is an Improper Permission Management Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22323](https://cve.now/CVE-2021-22323.md): There is an Integer Overflow Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22369](https://cve.now/CVE-2021-22369.md): There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22374](https://cve.now/CVE-2021-22374.md): There is an Improper Validation of Array Index Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-35973](https://cve.now/CVE-2021-35973.md): NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini\_httpd, allowing an unauthent (CVSS 9.8)
- [CVE-2021-35971](https://cve.now/CVE-2021-35971.md): Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft (no CVSS)
- [CVE-2021-35970](https://cve.now/CVE-2021-35970.md): Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permi (no CVSS)
- [CVE-2021-22373](https://cve.now/CVE-2021-22373.md): There is a Defects Introduced in the Design Process Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22376](https://cve.now/CVE-2021-22376.md): A component of the HarmonyOS has a Improper Privilege Management vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22372](https://cve.now/CVE-2021-22372.md): There is a Security Features Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22370](https://cve.now/CVE-2021-22370.md): There is a Credentials Management Errors Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22375](https://cve.now/CVE-2021-22375.md): There is a Key Management Errors Vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22326](https://cve.now/CVE-2021-22326.md): A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22380](https://cve.now/CVE-2021-22380.md): There is a Cleartext Transmission of Sensitive Information Vulnerability in Huawei Smartphone. (no CVSS, EMUI)
- [CVE-2021-3630](https://cve.now/CVE-2021-3630.md): An out-of-bounds write vulnerability was found in DjVuLibre in DJVU::DjVuTXT::decode() in DjVuText.cpp via a crafted djvu file which may lea (no CVSS, djvulibre)
- [CVE-2021-20461](https://cve.now/CVE-2021-20461.md): IBM Cognos Analytics 10.0 and 11.1 is susceptible to a weakness in the implementation of the System Appearance configuration setting. (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2021-20107](https://cve.now/CVE-2021-20107.md): There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers includ (no CVSS, SLOAN)
- [CVE-2021-28993](https://cve.now/CVE-2021-28993.md): Plixer Scrutinizer 19.0.2 is affected by: SQL Injection. (no CVSS)
- [CVE-2021-27903](https://cve.now/CVE-2021-27903.md): An issue was discovered in Craft CMS before 3.6.7. (no CVSS, craftcms/cms)
- [CVE-2021-27902](https://cve.now/CVE-2021-27902.md): An issue was discovered in Craft CMS before 3.6.0. (no CVSS, craftcms/cms)
- [CVE-2021-35956](https://cve.now/CVE-2021-35956.md): Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers (no CVSS)
- [CVE-2021-25951](https://cve.now/CVE-2021-25951.md): XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. (no CVSS, XML2Dict)
- [CVE-2021-31721](https://cve.now/CVE-2021-31721.md): Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage. (no CVSS)
- [CVE-2021-30648](https://cve.now/CVE-2021-30648.md): The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. (no CVSS, Advanced Secure Gateway (ASG) and ProxySG)
- [CVE-2021-28693](https://cve.now/CVE-2021-28693.md): xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. (no CVSS, xen)
- [CVE-2021-28692](https://cve.now/CVE-2021-28692.md): inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) iss (no CVSS, xen)
- [CVE-2021-34385](https://cve.now/CVE-2021-34385.md): Trusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap o (CVSS 6.3, NVIDIA Jetson TX1)
- [CVE-2021-34384](https://cve.now/CVE-2021-34384.md): Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow could cause memory corruption, which might lead to denial (CVSS 6.3, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34383](https://cve.now/CVE-2021-34383.md): Bootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privilege (CVSS 6.4, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34382](https://cve.now/CVE-2021-34382.md): Trusty TLK contains a vulnerability in the NVIDIA TLK kernel’s tz\_map\_shared\_mem function where an integer overflow on the size parameter ca (CVSS 6.7, NVIDIA Jetson TX1)
- [CVE-2021-34380](https://cve.now/CVE-2021-34380.md): Bootloader contains a vulnerability in NVIDIA MB2 where potential heap overflow might cause corruption of the heap metadata, which might lea (CVSS 7.0, NVIDIA Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, X…)
- [CVE-2021-34381](https://cve.now/CVE-2021-34381.md): Trusty TLK contains a vulnerability in the NVIDIA TLK kernel function where a lack of checks allows the exploitation of an integer overflow (CVSS 6.7, NVIDIA Jetson TX1)
- [CVE-2021-34379](https://cve.now/CVE-2021-34379.md): Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 10 is missing. (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34378](https://cve.now/CVE-2021-34378.md): Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 11 is missing. (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34377](https://cve.now/CVE-2021-34377.md): Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 9 is missing. (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34376](https://cve.now/CVE-2021-34376.md): Trusty contains a vulnerability in the HDCP service TA where bounds checking in command 5 is missing. (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34375](https://cve.now/CVE-2021-34375.md): Trusty contains a vulnerability in all trusted applications (TAs) where the stack cookie was not randomized, which might result in stack-bas (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34374](https://cve.now/CVE-2021-34374.md): Trusty contains a vulnerability in command handlers where the length of input buffers is not verified. (CVSS 7.7, NVIDIA Jetson AGX Xavier series, Jetson Xavier NX, Jetson T…)
- [CVE-2021-34373](https://cve.now/CVE-2021-34373.md): Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflow (CVSS 7.9, NVIDIA Jetson TX1)
- [CVE-2019-18906](https://cve.now/CVE-2019-18906.md): cryptctl: client side password hashing is equivalent to clear text password storage (CVSS 9.8, SUSE Linux Enterprise Server for SAP 12-SP5 · SUSE Manager…)
- [CVE-2021-25321](https://cve.now/CVE-2021-25321.md): arpwatch: Local privilege escalation from runtime user to root (CVSS 7.8, SUSE Linux Enterprise Server 11-SP4-LTSS · SUSE Manager… +3)
- [CVE-2021-35474](https://cve.now/CVE-2021-35474.md): Dynamic stack buffer overflow in cachekey plugin (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-32567](https://cve.now/CVE-2021-32567.md): Reading HTTP/2 frames too many times (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-32566](https://cve.now/CVE-2021-32566.md): Specific sequence of HTTP/2 frames can cause ATS to crash (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-35959](https://cve.now/CVE-2021-35959.md): In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT t (no CVSS, plone)
- [CVE-2021-35958](https://cve.now/CVE-2021-35958.md): TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get\_file is used with extra (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.