The Common Vulnerabilities and Exposures (CVE) project, maintained by the MITRE Corporation, is a list of all standardized names for vulnerabilities and security exposures.
| ID | Description | Priority | Modified date | Fixed Release |
|---|---|---|---|---|
| CVE-2021-34825 | Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate is not found on the local system. | -- | Jun 17, 2021 | -- (VxWorks 7) |
| CVE-2021-34815 | CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter. | -- | Jun 20, 2021 | -- (VxWorks 7) |
| CVE-2021-34813 | Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34812 | Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34811 | Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34810 | Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34809 | Improper neutralization of special elements used in a command (\'Command Injection\') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34808 | Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34803 | TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34801 | Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34693 | net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized. | -- | Jun 15, 2021 | -- (VxWorks 7) |
| CVE-2021-34683 | An issue was discovered in EXCELLENT INFOTEK CORPORATION (EIC) E-document System 3.0. A remote attacker can use kw/auth/bbs/asp/get_user_email_info_bbs.asp to obtain the contact information (name and e-mail address) of everyone in the entire organization. This information can allow remote attackers to perform social engineering or brute force attacks against the system login page. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34682 | Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature. | -- | Jun 14, 2021 | -- (VxWorks 7) |
| CVE-2021-34679 | Thycotic Password Reset Server before 5.3.0 allows credential disclosure. | -- | Jun 14, 2021 | -- (VxWorks 7) |
| CVE-2021-34557 | XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. | -- | Jun 11, 2021 | -- (VxWorks 7) |
| CVE-2021-34555 | OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a multi-value From header field. | MEDIUM | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-34553 | Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files and read the content of a blob file (via a GET request) without having been granted access. | -- | Jun 18, 2021 | -- (VxWorks 7) |
| CVE-2021-34551 | PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34547 | PRTG Network Monitor 20.1.55.1775 allows /editsettings CSRF for user account creation. | -- | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-34546 | An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the save log to file feature. To accomplish this, the attacker can navigate to cmd.exe. | -- | Jun 11, 2021 | -- (VxWorks 7) |
| CVE-2021-34540 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. | -- | Jun 11, 2021 | -- (VxWorks 7) |
| CVE-2021-34539 | An issue was discovered in CubeCoders AMP before 2.1.1.8. A lack of validation of the Java Version setting means that an unintended executable path can be set. The result is that high-privileged users can trigger code execution. | -- | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-34370 | Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. | MEDIUM | Jun 14, 2021 | -- (VxWorks 7) |
| CVE-2021-34369 | portlets/contact/ref/refContactDetail.do in Accela Civic Platform through 20.1 allows remote attackers to obtain sensitive information via a modified contactSeqNumber value. | MEDIUM | Jun 14, 2021 | -- (VxWorks 7) |
| CVE-2021-34364 | The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns. | MEDIUM | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-34363 | The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature. | MEDIUM | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-34280 | Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability, someone must open a crafted PDF file. | MEDIUM | Jun 9, 2021 | -- (VxWorks 7) |
| CVE-2021-34204 | D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34203 | D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 (dir-2640-us), when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify routing information, monitor the traffic of all devices under the router, hijack DNS and phishing attacks. In addition, this interface is likely to be questioned by customers as a backdoor, because the interface should not be exposed. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34202 | There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remote code execution. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34201 | D-Link DIR-2640-US 1.01B04 is vulnerable to Buffer Overflow. There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640). Local ordinary users can overwrite the global variables in the .bss section, causing the process crashes or changes. | -- | Jun 16, 2021 | -- (VxWorks 7) |
| CVE-2021-34170 | Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code. | -- | Jun 15, 2021 | -- (VxWorks 7) |
| CVE-2021-34129 | LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. This deletion is possible via directory traversal in the uploadImg, oldpic, or imgurl parameter. | -- | Jun 15, 2021 | -- (VxWorks 7) |
| CVE-2021-34128 | LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname. | -- | Jun 15, 2021 | -- (VxWorks 7) |
| CVE-2021-33904 | In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. | MEDIUM | Jun 11, 2021 | -- (VxWorks 7) |
| CVE-2021-33898 | In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker\'s input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it. | MEDIUM | Jun 6, 2021 | -- (VxWorks 7) |
| CVE-2021-33896 | Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. | MEDIUM | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-33894 | In Progress MOVEit Transfer before 2019.0.6 (11.0.6), 2019.1.x before 2019.1.5 (11.1.5), 2019.2.x before 2019.2.2 (11.2.2), 2020.x before 2020.0.5 (12.0.5), 2020.1.x before 2020.1.4 (12.1.4), and 2021.x before 2021.0.1 (13.0.1), a SQL injection vulnerability exists in SILUtility.vb in MOVEit.DMZ.WebApp in the MOVEit Transfer web app. This could allow an authenticated attacker to gain unauthorized access to the database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and/or execute SQL statements that alter or delete database elements. | -- | Jun 9, 2021 | -- (VxWorks 7) |
| CVE-2021-33887 | Insufficient verification of data authenticity in Peloton TTR01 up to and including PTV55G allows an attacker with physical access to boot into a modified kernel/ramdisk without unlocking the bootloader. | -- | Jun 15, 2021 | -- (VxWorks 7) |
| CVE-2021-33881 | On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a tear off attack) over RFID to bypass a Monotonic Counter protection mechanism. The impact depends on how the anti tear-off feature is used in specific applications such as public transportation, physical access control, etc. | LOW | Jun 6, 2021 | -- (VxWorks 7) |
| CVE-2021-33880 | The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. | LOW | Jun 6, 2021 | -- (VxWorks 7) |
| CVE-2021-33879 | Tencent GameLoop before 4.1.21.90 downloaded updates over an insecure HTTP connection. A malicious attacker in an MITM position could spoof the contents of an XML document describing an update package, replacing a download URL with one pointing to an arbitrary Windows executable. Because the only integrity check would be a comparison of the downloaded file\'s MD5 checksum to the one contained within the XML document, the downloaded executable would then be executed on the victim\'s machine. | MEDIUM | Jun 6, 2021 | -- (VxWorks 7) |
| CVE-2021-33842 | Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network where the device affected is located. | -- | Jun 9, 2021 | -- (VxWorks 7) |
| CVE-2021-33841 | SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker to inject code into the operating system with maximum privileges. | -- | Jun 9, 2021 | -- (VxWorks 7) |
| CVE-2021-33840 | The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature. | MEDIUM | Jun 4, 2021 | -- (VxWorks 7) |
| CVE-2021-33839 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting. | MEDIUM | Jun 4, 2021 | -- (VxWorks 7) |
| CVE-2021-33838 | Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration. | MEDIUM | Jun 4, 2021 | -- (VxWorks 7) |
| CVE-2021-33833 | ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAME, RDATA, or RDLENGTH (for A or AAAA). | -- | Jun 9, 2021 | -- (VxWorks 7) |
| CVE-2021-33829 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled. | MEDIUM | Jun 10, 2021 | -- (VxWorks 7) |
| CVE-2021-33824 | An issue was discovered on MOXA Mgate MB3180 Version 2.1 Build 18113012. Attackers can use slowhttptest tool to send incomplete HTTP request, which could make server keep waiting for the packet to finish the connection, until its resource exhausted. Then the web server is denial-of-service. | -- | Jun 18, 2021 | -- (VxWorks 7) |
