CVEs published July 1, 2021
57 CVEs were published on July 1, 2021: 1 critical, 2 high.
- Published
- 57
- Critical
- 1
- High
- 2
- Medium
- 5
- Low
- 1
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- EMUI;Magic UI
- 3
- QNAP Systems QTS · QNAP Systems QuTS hero
- 3
- IBM Datacap Navigator
- 2
- avif
- 1
- EC-CUBE CO. EC-CUBE
- 1
- EMUI, Magic UI
- 1
- IKaIKa Software Co. IkaIka RSS Reader
- 1
- Johnson Controls C-CURE
- 1
- Johnson Controls Facility Explorer SNC Series Supervisory C…
- 1
- JTEKT Corporation TOYOPUC PLC
- 1
Critical 1
High 2
Medium, low and unrated 54
- CVE-2020-23219Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit
- CVE-2020-23217A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2020-23214A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2020-23209A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2020-23208A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2020-23207A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2020-23205A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2021-32731The reset password form reveal users email addressxwiki-platform · org.xwiki.platform:xwiki-platform-web
- CVE-2021-32730No CSRF protection on the password change formxwiki-platform · org.xwiki.platform:xwiki-platform-administ…
- CVE-2021-32729A user without PR can reset user authentication failures informationxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2020-27362An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web c
- CVE-2020-27361An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirecto
- CVE-2020-4935IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting.IBM Datacap Navigator
- CVE-2020-4902IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection.IBM Datacap Navigator
- CVE-2021-28424A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbit
- CVE-2021-28423Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitra
- CVE-2021-28127An issue was discovered in Stormshield SNS through 4.2.1.
- CVE-2021-35337Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR).
- CVE-2021-35336Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control.
- CVE-2021-27477When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, PJTEKT Corporation TOYOPUC PLC
- CVE-2021-31813Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user
- CVE-2020-9158There is a Missing Cryptographic Step vulnerability in Huawei Smartphone.EMUI, Magic UI
- CVE-2021-22343There is a Configuration Defect vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22344There is an Improper Access Control vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-22347There is an Improper Access Control vulnerability in Huawei Smartphone.EMUI;Magic UI
- CVE-2021-20778Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sEC-CUBE CO. EC-CUBE
- CVE-2021-20752Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified IKaIKa Software Co. IkaIka RSS Reader
- CVE-2017-20006UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrent
- CVE-2018-25018UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext.
- CVE-2018-25017RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable.
- CVE-2019-25049LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1_item_print_ctx (called from asn1_template_print_ctx).
- CVE-2019-25048LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do_print_ex (called from asn1_item_print_ctx and ASN1_item_print).
- CVE-2020-36407libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.avif
- CVE-2020-36406uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll).
- CVE-2020-36405Keystone Engine 0.9.2 has a use-after-free in llvm_ks::X86Operand::getToken.
- CVE-2020-36404Keystone Engine 0.9.2 has an invalid free in llvm_ks::SmallVectorImpl<llvm_ks::MCFixup>::~SmallVectorImpl.
- CVE-2020-36403HTSlib through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read).
- CVE-2020-36402Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver.
- CVE-2020-36401mruby 2.1.2 has a double free in mrb_default_allocf (called from mrb_free and obj_free).
- CVE-2020-36400ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235.
- CVE-2021-36089Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply_palette_clr (called from grk::FileFormatDecomp
- CVE-2021-36087The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow).
- CVE-2021-36086The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classp
- CVE-2021-36085The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map).
- CVE-2021-36084The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_veri
- CVE-2021-36083KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE.
- CVE-2021-36082ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello.
- CVE-2021-36081Tesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call.
- CVE-2021-36080GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit_chain_free (called from dwg_encode_MTEXT and dwg_encode_add_object).
- CVE-2021-28804Command Injection Vulnerabilities in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2021-28803Stored XSS Vulnerability in Q'centerQNAP Systems Q'center
- CVE-2021-28802Command Injection Vulnerabilities in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2020-36196Stored XSS Vulnerability in QuLog CenterQNAP Systems QuLog Center
- CVE-2020-36194XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero