CVE-2021-40658: Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.
Published Jun 14, 2022 · Updated Aug 4, 2024
CVE archive
June 2021
Browse CVE records published in June 2021, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1730 matching CVEs · Page 12 of 35.
CVE-2021-40668: The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vu...
The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write.
Published Jun 9, 2022 · Updated Aug 4, 2024
CVE-2021-40660: An issue was discovered in Delight Nashorn Sandbox 0.2.0.
An issue was discovered in Delight Nashorn Sandbox 0.2.0. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
Published Jun 14, 2022 · Updated Aug 4, 2024
CVE-2021-40642: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Se...
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
Published Jun 29, 2022 · Updated Aug 4, 2024
CVE-2021-40643: EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration...
EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").
Published Jun 30, 2022 · Updated Aug 4, 2024
CVE-2021-40589: ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the...
ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits.
Published Jun 8, 2022 · Updated Aug 4, 2024
CVE-2021-40553: piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
piwigo 11.5.0 is affected by a remote code execution (RCE) vulnerability in the LocalFiles Editor.
Published Jun 28, 2022 · Updated Aug 4, 2024
CVE-2021-40597: The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
Published Jun 29, 2022 · Updated Aug 4, 2024
CVE-2021-40608: The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a cra...
The gf_hinter_track_finalize function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Published Jun 28, 2022 · Updated Aug 4, 2024
CVE-2021-40606: The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted fil...
The gf_bs_write_data function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Published Jun 28, 2022 · Updated Aug 4, 2024
CVE-2021-40616: thinkcmf v5.1.7 has an unauthorized vulnerability.
thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.
Published Jun 14, 2022 · Updated Aug 4, 2024
CVE-2021-40607: The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file i...
The schm_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Published Jun 28, 2022 · Updated Aug 4, 2024
CVE-2021-40592: GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop...
GPAC version before commit 71460d72ec07df766dab0a4d52687529f3efcf0a (version v1.0.1 onwards) contains loop with unreachable exit condition ('infinite loop') vulnerability in ISOBMFF reader filter, isoffin_read.c. Function isoffin_process() can result in DoS by infinite loop. To exploit, the victim must open a specially crafted mp4 file.
Published Jun 8, 2022 · Updated Aug 4, 2024
CVE-2021-40511: OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denia...
OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.
Published Jun 21, 2022 · Updated Aug 4, 2024
CVE-2021-40610: Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
Emlog Pro v 1.0.4 cross-site scripting (XSS) in Emlog Pro background management.
Published Jun 9, 2022 · Updated Aug 4, 2024
CVE-2021-40633: A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger...
A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of memory exception or denial of service via a gif format file.
Published Jun 14, 2022 · Updated Aug 4, 2024
CVE-2021-40604: A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authen...
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
Published Jun 13, 2022 · Updated Aug 4, 2024
CVE-2021-40609: The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file i...
The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command.
Published Jun 28, 2022 · Updated Aug 4, 2024
CVE-2021-40510: XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via cust...
XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.
Published Jun 21, 2022 · Updated Aug 4, 2024
CVE-2021-40212: An exploitable out-of-bounds write vulnerability in PotPlayer 1.7.21523 build 210729 may lead to code execu...
An exploitable out-of-bounds write vulnerability in PotPlayer 1.7.21523 build 210729 may lead to code execution, information disclosure, and denial of service.
Published Jun 15, 2022 · Updated Aug 4, 2024
CVE-2021-40036: The bone voice ID TA has a memory overwrite vulnerability.
The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerability may result in malicious code execution.
Published Jun 13, 2022 · Updated Aug 4, 2024
CVE-2021-39947: In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 1...
In specific circumstances, trace file buffers in GitLab Runner versions up to 14.3.4, 14.4 to 14.4.2, and 14.5 to 14.5.2 would re-use the file descriptor 0 for multiple traces and mix the output of several jobs
Published Jun 6, 2022 · Updated Aug 4, 2024
CVE-2021-39806: In closef of label_backends_android.c, there is a possible way to corrupt memory due to a double free.
In closef of label_backends_android.c, there is a possible way to corrupt memory due to a double free. This could lead to local escalation of privilege during startup of servicemanager, if an attacker can trigger an initialization failure, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-215387420
Published Jun 15, 2022 · Updated Aug 4, 2024
CVE-2021-39691: In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing use...
In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-157929241
Published Jun 15, 2022 · Updated Aug 4, 2024
CVE-2021-39409: A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administra...
A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated.
Published Jun 24, 2022 · Updated Aug 4, 2024
CVE-2021-39408: Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on...
Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file
Published Jun 24, 2022 · Updated Aug 4, 2024
CVE-2021-38221: bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
Published Jun 2, 2022 · Updated Aug 4, 2024
CVE-2021-37791: MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/us...
MyAdmin v1.0 is affected by an incorrect access control vulnerability in viewing personal center in /api/user/userData?userCode=admin.
Published Jun 30, 2022 · Updated Aug 4, 2024
CVE-2021-37778: There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to...
There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution.
Published Jun 30, 2022 · Updated Aug 4, 2024
CVE-2021-37770: Nucleus CMS v3.71 is affected by a file upload vulnerability.
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.
Published Jun 30, 2022 · Updated Aug 4, 2024
CVE-2021-37764: Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image para...
Arbitrary File Deletion vulnerability in XOS-Shop xos_shop_system 1.0.9 via current_manufacturer_image parameter to /shop/admin/manufacturers.php.
Published Jun 16, 2022 · Updated Aug 4, 2024
CVE-2021-37589: Virtua Cobranca before 12R allows SQL Injection on the login page.
Virtua Cobranca before 12R allows SQL Injection on the login page.
Published Jun 7, 2022 · Updated Aug 4, 2024
CVE-2021-37404: Heap buffer overflow in libhdfs native library
There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in a denial of service or arbitrary code execution. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
Published Jun 13, 2022 · Updated Aug 4, 2024
CVE-2021-37182: A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.)...
A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C (All versions < V6.5), SCALANCE XM408-8C (L3 int.) (All versions < V6.5), SCALANCE XM416-4C (All versions < V6.5), SCALANCE XM416-4C (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 1x230V (All versions < V6.5), SCALANCE XR524-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 24V (All versions < V6.5), SCALANCE XR524-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 2x230V (All versions < V6.5), SCALANCE XR524-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 1x230V (All versions < V6.5), SCALANCE XR526-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 24V (All versions < V6.5), SCALANCE XR526-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 2x230V (All versions < V6.5), SCALANCE XR526-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR528-6M (All versions < V6.5), SCALANCE XR528-6M (2HR2) (All versions < V6.5), SCALANCE XR528-6M (2HR2, L3 int.) (All versions < V6.5), SCALANCE XR528-6M (L3 int.) (All versions < V6.5), SCALANCE XR552-12M (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2, L3 int.) (All versions < V6.5). The OSPF protocol implementation in affected devices fails to verify the checksum and length fields in the OSPF LS Update messages. An unauthenticated remote attacker could exploit this vulnerability to cause interruptions in the network by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device.
Published Jun 14, 2022 · Updated Aug 4, 2024
CVE-2021-36761: The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.
Published Jun 21, 2022 · Updated Aug 4, 2024
CVE-2021-36710: ToaruOS 1.99.2 is affected by incorrect access control via the kernel.
ToaruOS 1.99.2 is affected by incorrect access control via the kernel. Improper MMU management and having a low GDT address allows it to be mapped in userland. A call gate can then be written to escalate to CPL 0.
Published Jun 8, 2022 · Updated Aug 4, 2024
CVE-2021-36608: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php.
Published Jun 16, 2022 · Updated Aug 4, 2024
CVE-2021-36609: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder...
Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /linkedcontent/editfolder.php.
Published Jun 16, 2022 · Updated Aug 4, 2024
CVE-2021-35970: Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive info...
Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35973: NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/...
NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by adding the ¤tsetting.htm substring to the HTTP query, a related issue to CVE-2020-27866. This directly allows the attacker to change the web UI password, and eventually to enable debug mode (telnetd) and gain a shell on the device as the admin limited-user account (however, escalation to root is simple because of weak permissions on the /etc/ directory).
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35971: Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles...
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting.
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35959: In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has...
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35958: TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras....
TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35956: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enabl...
Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.
Published Jun 30, 2021 · Updated Aug 4, 2024
CVE-2021-35941: Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrato...
Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472.
Published Jun 29, 2021 · Updated Aug 4, 2024
CVE-2021-35523: Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local...
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.
Published Jun 28, 2021 · Updated Aug 4, 2024
CVE-2021-35513: Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Published Jun 27, 2021 · Updated Aug 4, 2024
CVE-2021-35514: Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Published Jun 28, 2021 · Updated Aug 4, 2024
CVE-2021-35501: PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console.
PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an administrator visits the console, the XSS payload will be executed.
Published Jun 25, 2021 · Updated Aug 4, 2024
CVE-2021-35502: app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize cer...
app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index.
Published Jun 25, 2021 · Updated Aug 4, 2024