CVEs published July 2, 2021
63 CVEs were published on July 2, 2021: 1 critical, 7 high. 2 are now in CISA KEV.
- Published
- 63
- Critical
- 1
- High
- 7
- Medium
- 1
- Low
- 0
- Unrated
- 54
- Now in CISA KEV
- 2
- Fix available
- 12
Most affected products
- Google Chrome
- 4
- lavalite/cms
- 3
- Delta Electronics DOPSoft
- 2
- Apache Software Foundation Apache Druid · fast-xml-parser +1
- 1
- django
- 1
- getkirby kirby · getkirby/cms
- 1
- js-stellar-sdk · stellar-sdk
- 1
- Microsoft Windows
- 1
- NationalSecurityAgency emissary
- 1
- OpenVPN Connect
- 1
Critical 1
High 7
- CVE-2021-34527Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-30554Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-32737XSS Injection in Media Collection Title was possiblesulu · sulu/sulu
- CVE-2021-23403Prototype Pollutionts-nodash
- CVE-2021-23402Prototype Pollutionrecord-like-deep-assign
- CVE-2021-32639Server-Side Request Forgery (SSRF) in emissary:emissaryNationalSecurityAgency emissary
- CVE-2021-32735Cross-site scripting (XSS) from field and configuration text displayed in the Panelgetkirby kirby · getkirby/cms
Medium, low and unrated 55
- CVE-2021-36143ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference.
- CVE-2021-36144The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c.
- CVE-2021-36145The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.
- CVE-2021-36146ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer.
- CVE-2021-36147An issue was discovered in ACRN before 2.5.
- CVE-2021-36148An issue was discovered in ACRN before 2.5.
- CVE-2021-35207An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16.
- CVE-2021-35208An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23.
- CVE-2021-35209An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9
- CVE-2021-34807An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0.
- CVE-2021-30557Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2021-30556Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-30555Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension Google Chrome
- CVE-2021-33889OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric_len
- CVE-2021-32738Utils.readChallengeTx does not verify the server account signaturejs-stellar-sdk · stellar-sdk
- CVE-2020-36416A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36415A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36414A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36413A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36412A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36411A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36410A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36409A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36408A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT
- CVE-2020-36399A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2020-36398A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2020-36397A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers tlavalite/cms
- CVE-2020-36396A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to exelavalite/cms
- CVE-2020-36395A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execlavalite/cms
- CVE-2020-23194A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attack
- CVE-2020-23192A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts
- CVE-2020-23190A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute a
- CVE-2020-23185A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attacke
- CVE-2020-23184A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated at
- CVE-2020-23182The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to m
- CVE-2020-23181A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to ex
- CVE-2020-23179A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers t
- CVE-2020-23178An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a sess
- CVE-2021-31874Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sy
- CVE-2021-27950A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL co
- CVE-2021-36125An issue was discovered in the CentralAuth extension in MediaWiki through 1.36.
- CVE-2021-36126An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36.
- CVE-2021-36127An issue was discovered in the CentralAuth extension in MediaWiki through 1.36.
- CVE-2021-36128An issue was discovered in the CentralAuth extension in MediaWiki through 1.36.
- CVE-2021-36129An issue was discovered in the Translate extension in MediaWiki through 1.36.
- CVE-2021-36130An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36.
- CVE-2021-36131An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36.
- CVE-2021-36132An issue was discovered in the FileImporter extension in MediaWiki through 1.36.
- CVE-2021-3613OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if preOpenVPN Connect
- CVE-2021-3606OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file ifOpenVPN-GUI
- CVE-2021-35197In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access.
- CVE-2021-27412Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitDelta Electronics DOPSoft
- CVE-2021-27455Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may allDelta Electronics DOPSoft
- CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a wdjango
- CVE-2021-26920Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendedApache Software Foundation Apache Druid · fast-xml-parser +1