CVEs published in May 2021
2,381 vulnerabilities, 217 critical, 19 exploited.
KernelLinuxdmaengine: idxd: fix wq size store permission stateNo scoreKernelLinuxdmaengine: idxd: Fix clobbering of SWERR overflow bit on writebackNo scoreKernelLinuxKVM: VMX: Don't use vcpu->run->internal.ndata as an array indexNo scoreKernelLinuxbpf: Use correct permission flag for mixed signed bounds arithmeticNo scoreKernelLinuxARM: footbridge: fix PCI interrupt mappingNo scoreKernelLinuxARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabledNo scoreKernelLinuxch_ktls: Fix kernel panicNo scoreKernelLinuxnet: Make tcp_allowed_congestion_control readonly in non-init netnsNo scoreKernelLinuxlibbpf: Fix potential NULL pointer dereferenceNo scoreKernelLinuxnetfilter: nftables: clone set element expression templateNo scoreKernelLinuxixgbe: fix unbalanced device enable/disable in suspend/resumeNo scoreKernelLinuxkasan: remove redundant config optionNo scoreKernelLinuxKVM: VMX: Don't use vcpu->run->internal.ndata as an array indexNo scoreKernelLinuxbpf: Use correct permission flag for mixed signed bounds arithmeticNo score- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in...10.0 Critical
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code...7.1 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack...8.2 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack...7.1 High
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a...4.6 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a...4.6 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information...4.3 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability...5.4 Medium
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain sensitive information,...5.3 Medium
- ibm security verify accessIBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by...9.0 Critical
- ibm security verify accessIBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that...5.3 Medium
- ibm security verify access, application gateway +1 moreIBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP...7.5 High
- ibm security verify access, application gateway +1 moreIBM Security Verify Access 20.07 allows web pages to be stored locally which can be read by...4.0 Medium
- forms project formsRegular Expression Denial of Service (ReDoS)5.3 Medium
- sangoma restappsThe restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through...9.8 Critical
- apache dubboApache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)9.8 Critical
- apache dubboApache Dubbo Pre-auth RCE via Java deserialization in the Generic filter9.8 Critical
- apache dubboOpen Redirect or SSRF vulnerability usage of parseURL6.1 Medium
- techreborn reborncoreThe RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reborncore.common.network.ExtendedPacketBuffer. An at…9.8 Critical
libredwgOSS-FuzzUNKNOWN WRITE in dwg_free_BLOCK_privateNo scorepopplerOSS-FuzzUse-of-uninitialized-value in StandardSecurityHandler::StandardSecurityHandlerNo score- apple ipados, macos, safari +4 more +6 moreA logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14...5.5 Medium
- dragonfly project dragonflyDragonfly contains remote code execution vulnerability9.8 Critical
- frontiersoftware ichrisFrontier ichris through 5.18 allows users to upload malicious executable files that might later...9.8 Critical
- frontiersoftware ichrisFrontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host...7.5 High
- voipmonitorA remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the...9.8 Critical
- apache dubboApache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)9.8 Critical
- apache dubboDubbo Zookeeper does not check serialization id9.8 Critical
kryoOSS-FuzzUncaught exception in com.esotericsoftware.kryo.serializers.FieldSerializer.readNo scorewolfsslOSS-FuzzSegv on unknown address in GetASNHeader_exNo scoreespeak-ngOSS-FuzzGlobal-buffer-overflow in SubstitutePhonemesNo score- nationalsecurityagency emissaryPost-authentication Remote Code Execution (RCE) in emissary:emissary8.0 High
- envoyproxy envoyBypass of path matching rules using escaped slash characters8.1 High
- genivi diagnostic log and trace, dlt-daemon +1 moredlt-daemon could crash if there is special character in dlt.conf5.7 Medium
- denoStatic imports inside dynamically imported modules do not adhere to permission checks9.8 Critical
- Show moreLoading…