LiveActive security incident?Get immediate response
CVE archive

May 2021

Browse CVE records published in May 2021, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEsKnown exploited

Showing 50 of 1909 matching CVEs · Page 27 of 39.

Unknown · CVSS Not scored

CVE-2021-30469: A flaw was found in PoDoFo 0.9.7.

A flaw was found in PoDoFo 0.9.7. An use-after-free in PoDoFo::PdfVecObjects::Clear() function can cause a denial of service via a crafted PDF file.

Published May 26, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30472: A flaw was found in PoDoFo 0.9.7.

A flaw was found in PoDoFo 0.9.7. A stack-based buffer overflow in PdfEncryptMD5Base::ComputeOwnerKey function in PdfEncrypt.cpp is possible because of a improper check of the keyLength value.

Published May 26, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30471: A flaw was found in PoDoFo 0.9.7.

A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call in PdfNamesTree::AddToDictionary function in src/podofo/doc/PdfNamesTree.cpp can lead to a stack overflow.

Published May 26, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30470: A flaw was found in PoDoFo 0.9.7.

A flaw was found in PoDoFo 0.9.7. An uncontrolled recursive call among PdfTokenizer::ReadArray(), PdfTokenizer::GetNextVariant() and PdfTokenizer::ReadDataType() functions can lead to a stack overflow.

Published May 26, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30181: Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.

Published May 29, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30179: Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.

Published May 31, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30083: An issue was discovered in Mediat 1.4.1.

An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php.

Published May 24, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30082: An issue was discovered in Gris CMS v0.1.

An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard.

Published May 24, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-30081: An issue was discovered in emlog 6.0.0stable.

An issue was discovered in emlog 6.0.0stable. There is a SQL Injection vulnerability that can execute any SQL statement and query server sensitive data via admin/navbar.php?action=add_page.

Published May 24, 2021 · Updated Aug 3, 2024

Unknown · CVSS Not scored

CVE-2021-29659: ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure.

ownCloud 10.7 has an incorrect access control vulnerability, leading to remote information disclosure. Due to a bug in the related API endpoint, the attacker can enumerate all users in a single request by entering three whitespaces. Secondary, the retrieval of all users on a large instance could cause higher than average load on the instance.

Published May 20, 2021 · Updated Aug 3, 2024

Low · CVSS 3.6

CVE-2021-29612: Heap buffer overflow in `BandedTriangularSolve`

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a heap buffer overflow in Eigen implementation of `tf.raw_ops.BandedTriangularSolve`. The implementation(https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L269-L278) calls `ValidateInputTensors` for input validation but fails to validate that the two tensors are not empty. Furthermore, since `OP_REQUIRES` macro only stops execution of current function after setting `ctx->status()` to a non-OK value, callers of helper functions that use `OP_REQUIRES` must check value of `ctx->status()` before continuing. This doesn't happen in this op's implementation(https://github.com/tensorflow/tensorflow/blob/eccb7ec454e6617738554a255d77f08e60ee0808/tensorflow/core/kernels/linalg/banded_triangular_solve_op.cc#L219), hence the validation that is present is also not effective. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Published May 14, 2021 · Updated Aug 3, 2024