# CVEs published 2021-07-02

63 CVEs were published on July 2, 2021: 1 critical, 7 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-34527](https://cve.now/CVE-2021-34527.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2021-36143](https://cve.now/CVE-2021-36143.md): ACRN before 2.5 has a hw/pci/virtio/virtio.c vq\_endchains NULL Pointer Dereference. (no CVSS)
- [CVE-2021-36144](https://cve.now/CVE-2021-36144.md): The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/\*.c. (no CVSS)
- [CVE-2021-36145](https://cve.now/CVE-2021-36145.md): The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb\_entry. (no CVSS)
- [CVE-2021-36146](https://cve.now/CVE-2021-36146.md): ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer. (no CVSS)
- [CVE-2021-36147](https://cve.now/CVE-2021-36147.md): An issue was discovered in ACRN before 2.5. (no CVSS)
- [CVE-2021-36148](https://cve.now/CVE-2021-36148.md): An issue was discovered in ACRN before 2.5. (no CVSS)
- [CVE-2021-35207](https://cve.now/CVE-2021-35207.md): An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. (no CVSS)
- [CVE-2021-35208](https://cve.now/CVE-2021-35208.md): An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. (no CVSS)
- [CVE-2021-35209](https://cve.now/CVE-2021-35209.md): An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9 (no CVSS)
- [CVE-2021-34807](https://cve.now/CVE-2021-34807.md): An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. (no CVSS)
- [CVE-2021-30557](https://cve.now/CVE-2021-30557.md): Use after free in TabGroups in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extensio (no CVSS, Google Chrome)
- [CVE-2021-30556](https://cve.now/CVE-2021-30556.md): Use after free in WebAudio in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-30555](https://cve.now/CVE-2021-30555.md): Use after free in Sharing in Google Chrome prior to 91.0.4472.114 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30554](https://cve.now/CVE-2021-30554.md): Use after free in WebGL in Google Chrome prior to 91.0.4472.114 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-33889](https://cve.now/CVE-2021-33889.md): OpenThread wpantund through 2021-07-02 has a stack-based Buffer Overflow because of an inconsistency in the integer data type for metric\_len (no CVSS)
- [CVE-2021-32738](https://cve.now/CVE-2021-32738.md): Utils.readChallengeTx does not verify the server account signature (CVSS 6.5, js-stellar-sdk · stellar-sdk)
- [CVE-2021-32737](https://cve.now/CVE-2021-32737.md): XSS Injection in Media Collection Title was possible (CVSS 8.4, sulu · sulu/sulu)
- [CVE-2020-36416](https://cve.now/CVE-2020-36416.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36415](https://cve.now/CVE-2020-36415.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36414](https://cve.now/CVE-2020-36414.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36413](https://cve.now/CVE-2020-36413.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36412](https://cve.now/CVE-2020-36412.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36411](https://cve.now/CVE-2020-36411.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36410](https://cve.now/CVE-2020-36410.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36409](https://cve.now/CVE-2020-36409.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36408](https://cve.now/CVE-2020-36408.md): A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-36399](https://cve.now/CVE-2020-36399.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a (no CVSS)
- [CVE-2020-36398](https://cve.now/CVE-2020-36398.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a (no CVSS)
- [CVE-2020-36397](https://cve.now/CVE-2020-36397.md): A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers t (no CVSS, lavalite/cms)
- [CVE-2020-36396](https://cve.now/CVE-2020-36396.md): A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to exe (no CVSS, lavalite/cms)
- [CVE-2020-36395](https://cve.now/CVE-2020-36395.md): A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to exec (no CVSS, lavalite/cms)
- [CVE-2020-23194](https://cve.now/CVE-2020-23194.md): A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attack (no CVSS)
- [CVE-2020-23192](https://cve.now/CVE-2020-23192.md): A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts (no CVSS)
- [CVE-2020-23190](https://cve.now/CVE-2020-23190.md): A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute a (no CVSS)
- [CVE-2020-23185](https://cve.now/CVE-2020-23185.md): A stored cross site scripting (XSS) vulnerability in /administration/setting\_security.php of PHP-Fusion 9.03.60 allows authenticated attacke (no CVSS)
- [CVE-2020-23184](https://cve.now/CVE-2020-23184.md): A stored cross site scripting (XSS) vulnerability in /administration/settings\_registration.php of PHP-Fusion 9.03.60 allows authenticated at (no CVSS)
- [CVE-2020-23182](https://cve.now/CVE-2020-23182.md): The component /php-fusion/infusions/shoutbox\_panel/shoutbox\_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to m (no CVSS)
- [CVE-2020-23181](https://cve.now/CVE-2020-23181.md): A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to ex (no CVSS)
- [CVE-2020-23179](https://cve.now/CVE-2020-23179.md): A stored cross site scripting (XSS) vulnerability in administration/settings\_main.php of PHP-Fusion 9.03.50 allows authenticated attackers t (no CVSS)
- [CVE-2020-23178](https://cve.now/CVE-2020-23178.md): An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a sess (no CVSS)
- [CVE-2021-31874](https://cve.now/CVE-2021-31874.md): Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sy (no CVSS)
- [CVE-2021-23403](https://cve.now/CVE-2021-23403.md): Prototype Pollution (CVSS 7.3, ts-nodash)
- [CVE-2021-23402](https://cve.now/CVE-2021-23402.md): Prototype Pollution (CVSS 7.3, record-like-deep-assign)
- [CVE-2021-32639](https://cve.now/CVE-2021-32639.md): Server-Side Request Forgery (SSRF) in emissary:emissary (CVSS 7.2, NationalSecurityAgency emissary)
- [CVE-2021-32735](https://cve.now/CVE-2021-32735.md): Cross-site scripting (XSS) from field and configuration text displayed in the Panel (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2021-27950](https://cve.now/CVE-2021-27950.md): A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL co (no CVSS)
- [CVE-2021-36125](https://cve.now/CVE-2021-36125.md): An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36126](https://cve.now/CVE-2021-36126.md): An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36127](https://cve.now/CVE-2021-36127.md): An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36128](https://cve.now/CVE-2021-36128.md): An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36129](https://cve.now/CVE-2021-36129.md): An issue was discovered in the Translate extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36130](https://cve.now/CVE-2021-36130.md): An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36131](https://cve.now/CVE-2021-36131.md): An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-36132](https://cve.now/CVE-2021-36132.md): An issue was discovered in the FileImporter extension in MediaWiki through 1.36. (no CVSS)
- [CVE-2021-3613](https://cve.now/CVE-2021-3613.md): OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if pre (no CVSS, OpenVPN Connect)
- [CVE-2021-3606](https://cve.now/CVE-2021-3606.md): OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if (no CVSS, OpenVPN-GUI)
- [CVE-2021-35197](https://cve.now/CVE-2021-35197.md): In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. (no CVSS)
- [CVE-2021-27412](https://cve.now/CVE-2021-27412.md): Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbit (no CVSS, Delta Electronics DOPSoft)
- [CVE-2021-27455](https://cve.now/CVE-2021-27455.md): Delta Electronics DOPSoft Versions 4.0.10.17 and prior are vulnerable to an out-of-bounds read while processing project files, which may all (no CVSS, Delta Electronics DOPSoft)
- [CVE-2021-35029](https://cve.now/CVE-2021-35029.md): An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 (CVSS 9.8, Zyxel USG/Zywall series Firmware · Zyxel USG FLEX series… +2)
- [CVE-2021-35042](https://cve.now/CVE-2021-35042.md): Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order\_by SQL injection if order\_by is untrusted input from a client of a w (no CVSS, django)
- [CVE-2021-26920](https://cve.now/CVE-2021-26920.md): Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (no CVSS, Apache Software Foundation Apache Druid · fast-xml-parser +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.