# CVEs published 2021-07-14

172 CVEs were published on July 14, 2021: 3 critical, 70 high. 7 are now in CISA KEV. Days are UTC.

- [CVE-2020-36420](https://cve.now/CVE-2020-36420.md): Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. (no CVSS)
- [CVE-2020-24133](https://cve.now/CVE-2020-24133.md): A heap buffer overflow vulnerability in the r\_asm\_swf\_disass function of Radare2-extras before commit e74a93c allows attackers to execute… (no CVSS)
- [CVE-2021-35211](https://cve.now/CVE-2021-35211.md): Serv-U Remote Memory Escape Vulnerability (CVSS 9.0, KEV, SolarWinds Serv-U Managed File Transfer Server and Serv-U S…)
- [CVE-2021-22867](https://cve.now/CVE-2021-22867.md): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2020-29157](https://cve.now/CVE-2020-29157.md): An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. (no CVSS)
- [CVE-2020-18155](https://cve.now/CVE-2020-18155.md): SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. (no CVSS, intelliants/subrion)
- [CVE-2021-34174](https://cve.now/CVE-2021-34174.md): A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. (no CVSS)
- [CVE-2021-34173](https://cve.now/CVE-2021-34173.md): An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. (no CVSS)
- [CVE-2020-18151](https://cve.now/CVE-2020-18151.md): Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. (no CVSS, thinkcmf/thinkcmf)
- [CVE-2021-34529](https://cve.now/CVE-2021-34529.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34528](https://cve.now/CVE-2021-34528.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34525](https://cve.now/CVE-2021-34525.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2021-34523](https://cve.now/CVE-2021-34523.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 9.0, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34522](https://cve.now/CVE-2021-34522.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2021-34521](https://cve.now/CVE-2021-34521.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34520](https://cve.now/CVE-2021-34520.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-34519](https://cve.now/CVE-2021-34519.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server 2013 Service Pack… +1)
- [CVE-2021-34518](https://cve.now/CVE-2021-34518.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel 2013 Service Pack · Microsoft Excel +1)
- [CVE-2021-34517](https://cve.now/CVE-2021-34517.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server 2013 Service Pack… +2)
- [CVE-2021-34516](https://cve.now/CVE-2021-34516.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34514](https://cve.now/CVE-2021-34514.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34513](https://cve.now/CVE-2021-34513.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34512](https://cve.now/CVE-2021-34512.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34511](https://cve.now/CVE-2021-34511.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34510](https://cve.now/CVE-2021-34510.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34509](https://cve.now/CVE-2021-34509.md): Storage Spaces Controller Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34508](https://cve.now/CVE-2021-34508.md): Windows Kernel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-34507](https://cve.now/CVE-2021-34507.md): Windows Remote Assistance Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-34504](https://cve.now/CVE-2021-34504.md): Windows Address Book Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34503](https://cve.now/CVE-2021-34503.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34501](https://cve.now/CVE-2021-34501.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2021-34500](https://cve.now/CVE-2021-34500.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2021-34499](https://cve.now/CVE-2021-34499.md): Windows DNS Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-34498](https://cve.now/CVE-2021-34498.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34497](https://cve.now/CVE-2021-34497.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-34496](https://cve.now/CVE-2021-34496.md): Windows GDI Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34494](https://cve.now/CVE-2021-34494.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-34493](https://cve.now/CVE-2021-34493.md): Windows Partition Management Driver Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2021-34492](https://cve.now/CVE-2021-34492.md): Windows Certificate Spoofing Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-34491](https://cve.now/CVE-2021-34491.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34490](https://cve.now/CVE-2021-34490.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-34489](https://cve.now/CVE-2021-34489.md): DirectWrite Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34488](https://cve.now/CVE-2021-34488.md): Windows Console Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34479](https://cve.now/CVE-2021-34479.md): Microsoft Visual Studio Spoofing Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34477](https://cve.now/CVE-2021-34477.md): Visual Studio Code .NET Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET Education Bundle SDK Install Tool · Microsof…)
- [CVE-2021-34476](https://cve.now/CVE-2021-34476.md): Bowser.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-34474](https://cve.now/CVE-2021-34474.md): Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Dynamics 365 Business Central 2020 Release Wav… +1)
- [CVE-2021-34473](https://cve.now/CVE-2021-34473.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.1, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34470](https://cve.now/CVE-2021-34470.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34469](https://cve.now/CVE-2021-34469.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +1)
- [CVE-2021-34468](https://cve.now/CVE-2021-34468.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-33788](https://cve.now/CVE-2021-33788.md): Windows LSA Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33786](https://cve.now/CVE-2021-33786.md): Windows LSA Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33785](https://cve.now/CVE-2021-33785.md): Windows AF\_UNIX Socket Provider Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33784](https://cve.now/CVE-2021-33784.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33783](https://cve.now/CVE-2021-33783.md): Windows SMB Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-33782](https://cve.now/CVE-2021-33782.md): Windows Authenticode Spoofing Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33781](https://cve.now/CVE-2021-33781.md): Azure AD Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-33780](https://cve.now/CVE-2021-33780.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33779](https://cve.now/CVE-2021-33779.md): Windows AD FS Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2021-33778](https://cve.now/CVE-2021-33778.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33777](https://cve.now/CVE-2021-33777.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33776](https://cve.now/CVE-2021-33776.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33775](https://cve.now/CVE-2021-33775.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33774](https://cve.now/CVE-2021-33774.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-33773](https://cve.now/CVE-2021-33773.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33772](https://cve.now/CVE-2021-33772.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33771](https://cve.now/CVE-2021-33771.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-33768](https://cve.now/CVE-2021-33768.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2021-33767](https://cve.now/CVE-2021-33767.md): Open Enclave SDK Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Open Enclave SDK)
- [CVE-2021-33766](https://cve.now/CVE-2021-33766.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 7.3, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-33765](https://cve.now/CVE-2021-33765.md): Windows Installer Spoofing Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2021-33764](https://cve.now/CVE-2021-33764.md): Windows Key Distribution Center Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33763](https://cve.now/CVE-2021-33763.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33761](https://cve.now/CVE-2021-33761.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33760](https://cve.now/CVE-2021-33760.md): Media Foundation Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33759](https://cve.now/CVE-2021-33759.md): Windows Desktop Bridge Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33758](https://cve.now/CVE-2021-33758.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2021-33757](https://cve.now/CVE-2021-33757.md): Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2021-33756](https://cve.now/CVE-2021-33756.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33755](https://cve.now/CVE-2021-33755.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2021-33754](https://cve.now/CVE-2021-33754.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33753](https://cve.now/CVE-2021-33753.md): Microsoft Bing Search Spoofing Vulnerability (CVSS 4.7, Microsoft Bing Search for Android)
- [CVE-2021-33752](https://cve.now/CVE-2021-33752.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33751](https://cve.now/CVE-2021-33751.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-33750](https://cve.now/CVE-2021-33750.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33749](https://cve.now/CVE-2021-33749.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33746](https://cve.now/CVE-2021-33746.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33745](https://cve.now/CVE-2021-33745.md): Windows DNS Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33744](https://cve.now/CVE-2021-33744.md): Windows Secure Kernel Mode Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2021-33743](https://cve.now/CVE-2021-33743.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33740](https://cve.now/CVE-2021-33740.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31984](https://cve.now/CVE-2021-31984.md): Power BI Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Power BI Desktop)
- [CVE-2021-31979](https://cve.now/CVE-2021-31979.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-31961](https://cve.now/CVE-2021-31961.md): Windows InstallService Elevation of Privilege Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2021-31947](https://cve.now/CVE-2021-31947.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-31206](https://cve.now/CVE-2021-31206.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-31196](https://cve.now/CVE-2021-31196.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.2, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-31183](https://cve.now/CVE-2021-31183.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2020-18145](https://cve.now/CVE-2020-18145.md): Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. (no CVSS)
- [CVE-2020-18144](https://cve.now/CVE-2020-18144.md): SQL Injection Vulnerability in ECTouch v2 via the integral\_min parameter in index.php. (no CVSS)
- [CVE-2021-23407](https://cve.now/CVE-2021-23407.md): Directory Traversal (CVSS 7.5, elFinder.Net.Core)
- [CVE-2021-31859](https://cve.now/CVE-2021-31859.md): Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the… (no CVSS)
- [CVE-2020-29147](https://cve.now/CVE-2020-29147.md): A SQL injection vulnerability in wy\_controlls/wy\_side\_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database… (no CVSS)
- [CVE-2020-29146](https://cve.now/CVE-2020-29146.md): A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a… (no CVSS)
- [CVE-2021-36740](https://cve.now/CVE-2021-36740.md): Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST… (no CVSS)
- [CVE-2021-36716](https://cve.now/CVE-2021-36716.md): A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. (no CVSS, is-email)
- [CVE-2020-25445](https://cve.now/CVE-2020-25445.md): The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. (no CVSS)
- [CVE-2020-27379](https://cve.now/CVE-2020-27379.md): Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . (no CVSS)
- [CVE-2020-25444](https://cve.now/CVE-2020-25444.md): Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section… (no CVSS)
- [CVE-2021-22782](https://cve.now/CVE-2021-22782.md): Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all… (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22781](https://cve.now/CVE-2021-22781.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all… (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22780](https://cve.now/CVE-2021-22780.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all… (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22779](https://cve.now/CVE-2021-22779.md): Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all… (CVSS 6.5, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22778](https://cve.now/CVE-2021-22778.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all… (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-0654](https://cve.now/CVE-2021-0654.md): In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. (no CVSS, Android)
- [CVE-2020-20231](https://cve.now/CVE-2020-20231.md): Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. (no CVSS)
- [CVE-2021-0592](https://cve.now/CVE-2021-0592.md): In various functions in WideVine, there are possible out of bounds writes due to improper input validation. (no CVSS, Android)
- [CVE-2021-33211](https://cve.now/CVE-2021-33211.md): A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write… (no CVSS)
- [CVE-2021-0577](https://cve.now/CVE-2021-0577.md): In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0587](https://cve.now/CVE-2021-0587.md): In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0585](https://cve.now/CVE-2021-0585.md): In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2021-0603](https://cve.now/CVE-2021-0603.md): In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a… (no CVSS, Android)
- [CVE-2021-0586](https://cve.now/CVE-2021-0586.md): In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a… (no CVSS, Android)
- [CVE-2021-0596](https://cve.now/CVE-2021-0596.md): In phNciNfc\_RecvMfResp of phNxpExtns\_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0589](https://cve.now/CVE-2021-0589.md): In BTM\_TryAllocateSCN of btm\_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0601](https://cve.now/CVE-2021-0601.md): In encodeFrames of avc\_enc\_fuzzer.cpp, there is a possible out of bounds write due to a double free. (no CVSS, Android)
- [CVE-2021-0604](https://cve.now/CVE-2021-0604.md): In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused… (no CVSS, Android)
- [CVE-2021-0600](https://cve.now/CVE-2021-0600.md): In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input… (no CVSS, Android)
- [CVE-2021-0602](https://cve.now/CVE-2021-0602.md): In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for… (no CVSS, Android)
- [CVE-2021-0588](https://cve.now/CVE-2021-0588.md): In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0518](https://cve.now/CVE-2021-0518.md): In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0597](https://cve.now/CVE-2021-0597.md): In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing… (no CVSS, Android)
- [CVE-2021-0594](https://cve.now/CVE-2021-0594.md): In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. (no CVSS, Android)
- [CVE-2021-0599](https://cve.now/CVE-2021-0599.md): In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due… (no CVSS, Android)
- [CVE-2021-33212](https://cve.now/CVE-2021-33212.md): A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote… (no CVSS)
- [CVE-2021-0590](https://cve.now/CVE-2021-0590.md): In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID… (no CVSS, Android)
- [CVE-2021-0441](https://cve.now/CVE-2021-0441.md): In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. (no CVSS, Android)
- [CVE-2021-0486](https://cve.now/CVE-2021-0486.md): In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-0515](https://cve.now/CVE-2021-0515.md): In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0514](https://cve.now/CVE-2021-0514.md): In several functions of the V8 library, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2020-0417](https://cve.now/CVE-2020-0417.md): In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. (no CVSS, Android)
- [CVE-2021-33213](https://cve.now/CVE-2021-33213.md): An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve… (no CVSS)
- [CVE-2019-11098](https://cve.now/CVE-2019-11098.md): Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege… (no CVSS, Tianocore)
- [CVE-2021-0144](https://cve.now/CVE-2021-0144.md): Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of… (no CVSS, Intel BSSA DFTrs)
- [CVE-2021-35527](https://cve.now/CVE-2021-35527.md): Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application (CVSS 7.5, Hitachi ABB Power Grids eSOMS)
- [CVE-2021-24117](https://cve.now/CVE-2021-24117.md): In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator)… (no CVSS)
- [CVE-2021-24116](https://cve.now/CVE-2021-24116.md): In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain… (no CVSS)
- [CVE-2021-35469](https://cve.now/CVE-2021-35469.md): The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry… (no CVSS)
- [CVE-2021-33682](https://cve.now/CVE-2021-33682.md): SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. (CVSS 5.4, SAP SE SAP Lumira Server)
- [CVE-2021-33687](https://cve.now/CVE-2021-33687.md): SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their… (CVSS 4.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-33683](https://cve.now/CVE-2021-33683.md): SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT… (CVSS 5.4, SAP SE SAP Web Dispatcher and Internet Communication Manager)
- [CVE-2021-33689](https://cve.now/CVE-2021-33689.md): When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications)… (CVSS 3.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-33684](https://cve.now/CVE-2021-33684.md): SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT… (CVSS 5.3, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-33678](https://cve.now/CVE-2021-33678.md): A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752… (CVSS 6.5, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2021-33670](https://cve.now/CVE-2021-33670.md): SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to… (CVSS 7.5, SAP SE SAP NetWeaver AS for Java)
- [CVE-2021-33681](https://cve.now/CVE-2021-33681.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-33677](https://cve.now/CVE-2021-33677.md): SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can… (CVSS 6.5, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-33676](https://cve.now/CVE-2021-33676.md): A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to… (CVSS 6.8, SAP SE SAP CRM)
- [CVE-2021-33680](https://cve.now/CVE-2021-33680.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes… (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-33671](https://cve.now/CVE-2021-33671.md): SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary… (CVSS 7.6, SAP SE SAP NetWeaver Guided Procedures)
- [CVE-2021-33667](https://cve.now/CVE-2021-33667.md): Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp… (CVSS 4.3, SAP SE SAP Business Objects Web Intelligence)
- [CVE-2021-22318](https://cve.now/CVE-2021-22318.md): A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. (no CVSS, HarmonyOS)
- [CVE-2021-25953](https://cve.now/CVE-2021-25953.md): Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead… (no CVSS, putil-merge)
- [CVE-2021-36374](https://cve.now/CVE-2021-36374.md): Apache Ant ZIP, and ZIP based, archive denial of service vulerability (no CVSS, Apache Software Foundation Apache Ant · org.apache.ant:ant)
- [CVE-2021-36373](https://cve.now/CVE-2021-36373.md): Apache Ant TAR archive denial of service vulnerability (no CVSS, Apache Software Foundation Apache Ant · org.apache.ant:ant)
- [CVE-2021-20784](https://cve.now/CVE-2021-20784.md): HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject… (CVSS 6.1, voidtools Everything)
- [CVE-2021-20782](https://cve.now/CVE-2021-20782.md): Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the… (no CVSS, Tips and Tricks HQ Software License Manager)
- [CVE-2021-20781](https://cve.now/CVE-2021-20781.md): Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions… (no CVSS, realmag777 WordPress Meta Data Filter & Taxonomies Filter)
- [CVE-2021-20748](https://cve.now/CVE-2021-20748.md): Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external… (no CVSS, Retty App)
- [CVE-2021-20747](https://cve.now/CVE-2021-20747.md): Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for… (no CVSS, Retty App)
- [CVE-2021-24119](https://cve.now/CVE-2021-24119.md): In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator)… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.