Skip to content
OpenAdvisories

Archive

29 June 2021

Vulnerabilities first published on this day (UTC), newest first.

← May 2021 2021 / June /29 July 2021 →
  1. 179
  2. 278
  3. 353
  4. 460
  5. 5 
  6. 67
  7. 763
  8. 8108
  9. 9184
  10. 1075
  11. 11158
  12. 1214
  13. 131
  14. 1432
  15. 1557
  16. 1688
  17. 1733
  18. 1840
  19. 19 
  20. 201
  21. 2182
  22. 22104
  23. 2337
  24. 24103
  25. 2547
  26. 26 
  27. 271
  28. 2875
  29. 2962
  30. 3069
All Critical High Medium Low Exploited only Public exploit

62 results · Feed

  • Low 3.3
    CVE-2021-31506

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenText Brav…

    OpenText Brava! Desktop
  • Medium 6.8
    CVE-2021-31505

    This vulnerability allows attackers with physical access to escalate privileges on affected installations of Arlo Q Plu…

    Arlo Q Plus
  • Critical 9.0
    CVE-2020-7869

    An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker …

    mastersoft ZOOK
  • Critical 9.6
    CVE-2020-7868

    Helpu remote code execution vulnerability

    A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login.

    HelpU helpu.ocx
  • Unscored —
    CVE-2021-34824 Public exploit

    Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remotely exploitable vulnerability where credentials specified …

  • Medium 6.4
    CVE-2020-7870

    A memory corruption vulnerability exists when ezPDF improperly handles the parameter. This vulnerability exists due to …

    Unidocs ezPDF Reader ezPDF Editor
  • Unscored —
    CVE-2021-31531

    Zoho ManageEngine ServiceDesk Plus MSP before 10521 is vulnerable to Server-Side Request Forgery (SSRF).

  • Unscored —
    CVE-2021-31530

    Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.

  • Unscored —
    CVE-2021-31160

    Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.

  • High 7.5
    CVE-2020-7871

    A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exi…

    Cnesty Helpcom
  • High 7.5
    CVE-2021-22545

    Use-after-free in BinDiff

    An attacker can craft a specific IdaPro *.i64 file that will cause the BinDiff plugin to load an invalid memory offset. This can allow the attacker to control the instruction pointer and execute arbitrary code. It is recommended to upgrade BinDiff 7

    Google Bindiff
  • Unscored —
    CVE-2021-32565

    HTTP Request Smuggling, content length with invalid charters

    Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu
  • Unscored —
    CVE-2021-27577

    Incorrect handling of url fragment leads to cache poisoning

    Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

    Apache Software Foundation Apache Traffic Server trafficserver trafficserver Debian Ubuntu
  • Medium 6.3
    CVE-2021-23400

    HTTP Header Injection

    The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.

    node-nodemailer nodemailer node-nodemailer Debian Ubuntu npm
  • Unscored —
    CVE-2021-28691

    Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2021-28690

    x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security v…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-34550

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-o…

    tor tor tor Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-34549

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circu…

    tor tor tor Debian Ubuntu Alpine
  • Unscored —
    CVE-2021-34548

    An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to…

    tor tor tor Debian Ubuntu Alpine
  • High 7.5
    CVE-2021-33503

    Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

    An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…

    python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Azure Linux PyPI
  • High 8.4
    CVE-2021-31838

    Command injection through environment variable in MVISION EDR

    A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'.

    McAfee MVISION EDR
  • High 7.4
    CVE-2021-1134

    Cisco DNA Center Certificate Validation Vulnerability

    A vulnerability in the Cisco Identity Services Engine (ISE) integration feature of the Cisco DNA Center Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to an incomplete validatio…

    Cisco Cisco Digital Network Architecture Center (DNA Center) Network devices