CVEs published July 22, 2021
90 CVEs were published on July 22, 2021: 3 critical, 12 high. 2 are now in CISA KEV.
- Published
- 90
- Critical
- 3
- High
- 12
- Medium
- 17
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 2
- Fix available
- 8
Most affected products
- NVIDIA GPU Display Driver
- 8
- Cisco Intersight Virtual Appliance
- 4
- Sage X3
- 4
- Akkadian Provisioning Manager Engine
- 3
- Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- 3
- Ivanti MobileIron Core
- 2
- Verastream Host Integrator.
- 2
- zmartzone mod_auth_openidc
- 2
- Apache Software Foundation Apache Impala
- 1
- Cisco Firepower Threat Defense Software
- 1
Critical 3
- CVE-2020-7388Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by SpoofingSage X3
- CVE-2021-35464ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
- CVE-2021-35942The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) wh
High 12
- CVE-2021-31581Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interfaceAkkadian Provisioning Manager Engine
- CVE-2021-31580Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' commandAkkadian Provisioning Manager Engine
- CVE-2021-31579Akkadian Provisioning Manager Engine (PME) Hard-Coded CredentialsAkkadian Provisioning Manager Engine
- CVE-2020-5370Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability.Dell OpenManage Enterprise
- CVE-2020-5316Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0…Dell SupportAssist Client
- CVE-2021-1600Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-1601Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-36934Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1092NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a…NVIDIA GPU Display Driver
- CVE-2021-1091NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the…NVIDIA GPU Display Driver
- CVE-2021-1089NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary…NVIDIA GPU Display Driver
- CVE-2021-1090NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for control calls…NVIDIA GPU Display Driver
Medium, low and unrated 75
- CVE-2021-34268An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS)…
- CVE-2021-34267An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS)…
- CVE-2021-34262A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows…
- CVE-2021-34261An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system…
- CVE-2021-34260A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below…
- CVE-2021-34259A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows…
- CVE-2020-22284A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2…
- CVE-2021-25205SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via…
- CVE-2021-25211Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file…
- CVE-2021-25213SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements…
- CVE-2021-25209SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2021-25212SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements…
- CVE-2021-25210Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the…
- CVE-2021-27332Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject…
- CVE-2021-26224Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script…
- CVE-2021-26223SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2021-3540Ivanti MobileIron Core clish Restricted Shell Escape via Argument InjectionIvanti MobileIron Core
- CVE-2021-3198Ivanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionIvanti MobileIron Core
- CVE-2020-7390Sage X3 Syracuse Persistent XSS in Edit User pageSage X3
- CVE-2020-7389Sage X3 Syracuse Missing Authentication for Critical Function in Developer EnvironmentSage X3
- CVE-2020-7387Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized ActorSage X3
- CVE-2021-33032A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5…
- CVE-2020-36033SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php.
- CVE-2021-36222ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a
- CVE-2021-25197Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web…
Show all 75 entriesShow fewer entries
- CVE-2015-2098Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to…
- CVE-2015-2099Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1)…
- CVE-2021-25202SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2015-2100Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via…
- CVE-2021-26226SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2021-35063Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion."
- CVE-2021-33478The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to…
- CVE-2021-26227Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject…
- CVE-2021-26232SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via…
- CVE-2021-29657arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on…
- CVE-2021-26230Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject…
- CVE-2021-26231SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via…
- CVE-2021-26228SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2021-26699OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the…
- CVE-2021-37403OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link…
- CVE-2021-37402OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy…
- CVE-2021-26229SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL…
- CVE-2021-26698OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link…
- CVE-2021-26764SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the…
- CVE-2021-26762SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the…
- CVE-2021-26765SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the…
- CVE-2021-1599Cisco Unified Customer Voice Portal Cross-Site Scripting VulnerabilityCisco Unified Customer Voice Portal
- CVE-2021-1518Cisco Firepower Device Manager On-Box Software Remote Code Execution VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1614Cisco SD-WAN Software Information Disclosure VulnerabilityCisco SD-WAN Solution
- CVE-2021-1617Cisco Intersight Virtual Appliance VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-1618Cisco Intersight Virtual Appliance VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-34700Cisco SD-WAN vManage Software Information Disclosure VulnerabilityCisco SD-WAN vManage
- CVE-2021-34431In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to…The Eclipse Foundation Eclipse Mosquitto
- CVE-2021-29149A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400…Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-29148A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400…Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-29143A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba…Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-22001In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request…Cloud Foundry UAA server
- CVE-2019-20467An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices.
- CVE-2021-30110dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via…
- CVE-2021-30486SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp…
- CVE-2021-30049SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
- CVE-2021-35522A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before…
- CVE-2021-35521A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated…
- CVE-2021-35520A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate…
- CVE-2021-22523XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions.Verastream Host Integrator.
- CVE-2021-22522Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier…Verastream Host Integrator.
- CVE-2021-20596NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and…MELSEC-F Series FX3U-ENET; FX3U-ENET-L; FX3U-ENET-P502
- CVE-2021-28131Impala logs contain secretsApache Software Foundation Apache Impala
- CVE-2021-1096NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for…NVIDIA GPU Display Driver
- CVE-2020-22283A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git…
- CVE-2021-1093NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar…NVIDIA GPU Display Driver
- CVE-2021-1094NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape…NVIDIA GPU Display Driver
- CVE-2021-1095NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlers for all control…NVIDIA GPU Display Driver
- CVE-2021-32785Format string bug in the Redis cache implementationzmartzone mod_auth_openidc
- CVE-2021-32786Open Redirect in oidc_validate_redirect_url()zmartzone mod_auth_openidc