# CVEs published 2021-07-01

57 CVEs were published on July 1, 2021: 1 critical, 2 high. Days are UTC.

- [CVE-2020-23219](https://cve.now/CVE-2020-23219.md): Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit (no CVSS)
- [CVE-2020-23217](https://cve.now/CVE-2020-23217.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2020-23214](https://cve.now/CVE-2020-23214.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2020-23209](https://cve.now/CVE-2020-23209.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2020-23208](https://cve.now/CVE-2020-23208.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2020-23207](https://cve.now/CVE-2020-23207.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2020-23205](https://cve.now/CVE-2020-23205.md): A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via (no CVSS)
- [CVE-2021-32731](https://cve.now/CVE-2021-32731.md): The reset password form reveal users email address (CVSS 5.3, xwiki-platform · org.xwiki.platform:xwiki-platform-web)
- [CVE-2021-32730](https://cve.now/CVE-2021-32730.md): No CSRF protection on the password change form (CVSS 5.7, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2021-32729](https://cve.now/CVE-2021-32729.md): A user without PR can reset user authentication failures information (CVSS 2.0, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2020-27362](https://cve.now/CVE-2020-27362.md): An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web c (no CVSS)
- [CVE-2020-27361](https://cve.now/CVE-2020-27361.md): An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirecto (no CVSS)
- [CVE-2020-4935](https://cve.now/CVE-2020-4935.md): IBM Datacap Fastdoc Capture (IBM Datacap Navigator 9.1.7 ) is vulnerable to cross-site scripting. (CVSS 5.4, IBM Datacap Navigator)
- [CVE-2020-4902](https://cve.now/CVE-2020-4902.md): IBM Datacap Taskmaster Capture (IBM Datacap Navigator 9.1.7) is vulnerable to SQL injection. (CVSS 6.3, IBM Datacap Navigator)
- [CVE-2021-28424](https://cve.now/CVE-2021-28424.md): A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbit (no CVSS)
- [CVE-2021-28423](https://cve.now/CVE-2021-28423.md): Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 thru 2.1 allow remote authenticated users to execute arbitra (no CVSS)
- [CVE-2021-28127](https://cve.now/CVE-2021-28127.md): An issue was discovered in Stormshield SNS through 4.2.1. (no CVSS)
- [CVE-2021-27661](https://cve.now/CVE-2021-27661.md): Facility Explorer (CVSS 8.8, Johnson Controls Facility Explorer SNC Series Supervisory C…)
- [CVE-2021-27660](https://cve.now/CVE-2021-27660.md): C-CURE 9000 (CVSS 8.8, Johnson Controls C-CURE)
- [CVE-2021-35337](https://cve.now/CVE-2021-35337.md): Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). (no CVSS)
- [CVE-2021-35336](https://cve.now/CVE-2021-35336.md): Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. (no CVSS)
- [CVE-2021-27477](https://cve.now/CVE-2021-27477.md): When JTEKT Corporation TOYOPUC PLC versions PC10G-CPU, 2PORT-EFR, Plus CPU, Plus EX, Plus EX2, Plus EFR, Plus EFR2, Plus 2P-EFR, PC10P-DP, P (no CVSS, JTEKT Corporation TOYOPUC PLC)
- [CVE-2021-31813](https://cve.now/CVE-2021-31813.md): Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user (no CVSS)
- [CVE-2020-9158](https://cve.now/CVE-2020-9158.md): There is a Missing Cryptographic Step vulnerability in Huawei Smartphone. (no CVSS, EMUI, Magic UI)
- [CVE-2021-22343](https://cve.now/CVE-2021-22343.md): There is a Configuration Defect vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22344](https://cve.now/CVE-2021-22344.md): There is an Improper Access Control vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-22347](https://cve.now/CVE-2021-22347.md): There is an Improper Access Control vulnerability in Huawei Smartphone. (no CVSS, EMUI;Magic UI)
- [CVE-2021-20778](https://cve.now/CVE-2021-20778.md): Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain s (no CVSS, EC-CUBE CO. EC-CUBE)
- [CVE-2021-20752](https://cve.now/CVE-2021-20752.md): Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified (no CVSS, IKaIKa Software Co. IkaIka RSS Reader)
- [CVE-2017-20006](https://cve.now/CVE-2017-20006.md): UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrent (no CVSS)
- [CVE-2018-25018](https://cve.now/CVE-2018-25018.md): UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext. (no CVSS)
- [CVE-2018-25017](https://cve.now/CVE-2018-25017.md): RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable. (no CVSS)
- [CVE-2019-25049](https://cve.now/CVE-2019-25049.md): LibreSSL 2.9.1 through 3.2.1 has an out-of-bounds read in asn1\_item\_print\_ctx (called from asn1\_template\_print\_ctx). (no CVSS)
- [CVE-2019-25048](https://cve.now/CVE-2019-25048.md): LibreSSL 2.9.1 through 3.2.1 has a heap-based buffer over-read in do\_print\_ex (called from asn1\_item\_print\_ctx and ASN1\_item\_print). (no CVSS)
- [CVE-2020-36407](https://cve.now/CVE-2020-36407.md): libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid. (no CVSS, avif)
- [CVE-2020-36406](https://cve.now/CVE-2020-36406.md): uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). (no CVSS)
- [CVE-2020-36405](https://cve.now/CVE-2020-36405.md): Keystone Engine 0.9.2 has a use-after-free in llvm\_ks::X86Operand::getToken. (no CVSS)
- [CVE-2020-36404](https://cve.now/CVE-2020-36404.md): Keystone Engine 0.9.2 has an invalid free in llvm\_ks::SmallVectorImpl\<llvm\_ks::MCFixup\>::~SmallVectorImpl. (no CVSS)
- [CVE-2020-36403](https://cve.now/CVE-2020-36403.md): HTSlib through 1.10.2 allows out-of-bounds write access in vcf\_parse\_format (called from vcf\_parse and vcf\_read). (no CVSS)
- [CVE-2020-36402](https://cve.now/CVE-2020-36402.md): Solidity 0.7.5 has a stack-use-after-return issue in smtutil::CHCSmtLib2Interface::querySolver. (no CVSS)
- [CVE-2020-36401](https://cve.now/CVE-2020-36401.md): mruby 2.1.2 has a double free in mrb\_default\_allocf (called from mrb\_free and obj\_free). (no CVSS)
- [CVE-2020-36400](https://cve.now/CVE-2020-36400.md): ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp\_read, a different vulnerability than CVE-2021-20235. (no CVSS)
- [CVE-2021-36089](https://cve.now/CVE-2021-36089.md): Grok 7.6.6 through 9.2.0 has a heap-based buffer overflow in grk::FileFormatDecompress::apply\_palette\_clr (called from grk::FileFormatDecomp (no CVSS)
- [CVE-2021-36088](https://cve.now/CVE-2021-36088.md): Fluent Bit (aka fluent-bit) 1.7.0 through 1.7.4 has a double free in flb\_free (called from flb\_parser\_json\_do and flb\_parser\_do). (CVSS 9.8)
- [CVE-2021-36087](https://cve.now/CVE-2021-36087.md): The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap\_match\_any (called indirectly from cil\_check\_neverallow). (no CVSS)
- [CVE-2021-36086](https://cve.now/CVE-2021-36086.md): The CIL compiler in SELinux 3.2 has a use-after-free in cil\_reset\_classpermission (called from cil\_reset\_classperms\_set and cil\_reset\_classp (no CVSS)
- [CVE-2021-36085](https://cve.now/CVE-2021-36085.md): The CIL compiler in SELinux 3.2 has a use-after-free in \_\_cil\_verify\_classperms (called from \_\_verify\_map\_perm\_classperms and hashtab\_map). (no CVSS)
- [CVE-2021-36084](https://cve.now/CVE-2021-36084.md): The CIL compiler in SELinux 3.2 has a use-after-free in \_\_cil\_verify\_classperms (called from \_\_cil\_verify\_classpermission and \_\_cil\_pre\_veri (no CVSS)
- [CVE-2021-36083](https://cve.now/CVE-2021-36083.md): KDE KImageFormats 5.70.0 through 5.81.0 has a stack-based buffer overflow in XCFImageFormat::loadTileRLE. (no CVSS)
- [CVE-2021-36082](https://cve.now/CVE-2021-36082.md): ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. (no CVSS)
- [CVE-2021-36081](https://cve.now/CVE-2021-36081.md): Tesseract OCR 5.0.0-alpha-20201231 has a one\_ell\_conflict use-after-free during a strpbrk call. (no CVSS)
- [CVE-2021-36080](https://cve.now/CVE-2021-36080.md): GNU LibreDWG 0.12.3.4163 through 0.12.3.4191 has a double-free in bit\_chain\_free (called from dwg\_encode\_MTEXT and dwg\_encode\_add\_object). (no CVSS)
- [CVE-2021-28804](https://cve.now/CVE-2021-28804.md): Command Injection Vulnerabilities in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2021-28803](https://cve.now/CVE-2021-28803.md): Stored XSS Vulnerability in Q'center (no CVSS, QNAP Systems Q'center)
- [CVE-2021-28802](https://cve.now/CVE-2021-28802.md): Command Injection Vulnerabilities in QTS and QuTS hero (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2020-36196](https://cve.now/CVE-2020-36196.md): Stored XSS Vulnerability in QuLog Center (no CVSS, QNAP Systems QuLog Center)
- [CVE-2020-36194](https://cve.now/CVE-2020-36194.md): XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero (CVSS 6.1, QNAP Systems QTS · QNAP Systems QuTS hero)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.