# CVEs published 2021-07-23

20 CVEs were published on July 23, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-32783](https://cve.now/CVE-2021-32783.md): Authorization bypass in Contour (CVSS 8.5, projectcontour contour · github.com/projectcontour/contour)
- [CVE-2021-25809](https://cve.now/CVE-2021-25809.md): UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. (no CVSS)
- [CVE-2021-25808](https://cve.now/CVE-2021-25808.md): A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. (no CVSS)
- [CVE-2020-20741](https://cve.now/CVE-2020-20741.md): Incorrect Access Control in Beckhoff Automation GmbH & Co. (no CVSS)
- [CVE-2021-25791](https://cve.now/CVE-2021-25791.md): Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows… (no CVSS)
- [CVE-2021-25790](https://cve.now/CVE-2021-25790.md): Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows… (no CVSS)
- [CVE-2021-23412](https://cve.now/CVE-2021-23412.md): Command Injection (CVSS 8.1, gitlogplus)
- [CVE-2021-3159](https://cve.now/CVE-2021-3159.md): A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325… (no CVSS)
- [CVE-2021-25201](https://cve.now/CVE-2021-25201.md): SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id… (no CVSS)
- [CVE-2021-25204](https://cve.now/CVE-2021-25204.md): Cross-site scripting (XSS) vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2021-25203](https://cve.now/CVE-2021-25203.md): Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to… (no CVSS)
- [CVE-2021-25206](https://cve.now/CVE-2021-25206.md): Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the… (no CVSS)
- [CVE-2021-25208](https://cve.now/CVE-2021-25208.md): Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the… (no CVSS)
- [CVE-2021-25207](https://cve.now/CVE-2021-25207.md): Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file… (no CVSS)
- [CVE-2021-20333](https://cve.now/CVE-2021-20333.md): Server log entry spoofing via newline injection (CVSS 5.3, MongoDB Server)
- [CVE-2021-26799](https://cve.now/CVE-2021-26799.md): Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic \<=2.7 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2020-14032](https://cve.now/CVE-2020-14032.md): ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM. (no CVSS)
- [CVE-2021-24036](https://cve.now/CVE-2021-24036.md): Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap… (no CVSS, Facebook folly · Facebook HHVM)
- [CVE-2021-3169](https://cve.now/CVE-2021-3169.md): An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does… (no CVSS)
- [CVE-2021-32686](https://cve.now/CVE-2021-32686.md): Denial of Service in PJSIP (CVSS 5.9, pjsip pjproject)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.