CVEs published July 7, 2021
108 CVEs were published on July 7, 2021: 20 critical, 14 high. 1 is now in CISA KEV.
- Published
- 108
- Critical
- 20
- High
- 14
- Medium
- 25
- Low
- 3
- Unrated
- 46
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- QSAN Storage Manager
- 20
- GitLab
- 6
- IBM Guardium Data Encryption
- 6
- Joomla! Project Joomla! CMS
- 5
- Iobit
- 4
- ProfilePress
- 4
- QSAN SANOS
- 3
- QSAN Storage Manager · QSAN XEVO +1
- 3
- QSAN XEVO
- 3
- WP Upload Restriction
- 3
Critical 20
- CVE-2021-21807An integer overflow vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.9.Accusoft
- CVE-2021-32538ARTWARE CMS - Unrestricted Upload of FileARTWARE CMS
- CVE-2021-32535QSAN SANOS - Use of Hard-coded CredentialsQSAN SANOS
- CVE-2021-32534QSAN SANOS - Command InjectionQSAN SANOS
- CVE-2021-32533QSAN SANOS - Command InjectionQSAN SANOS
- CVE-2021-32531QSAN XEVO - Command Injection Following via Init functionQSAN XEVO
- CVE-2021-32530QSAN XEVO - Command Injection Following via Array functionQSAN XEVO
- CVE-2021-32529QSAN XEVO, SANOS - Command Injection -1QSAN XEVO · QSAN SANOS
- CVE-2021-32525QSAN Storage Manager - Use of Hard-coded Password-2QSAN Storage Manager
- CVE-2021-32524QSAN Storage Manager - Command Injection-3QSAN Storage Manager
- CVE-2021-32523QSAN Storage Manager - Improper AuthorizationQSAN Storage Manager
- CVE-2021-32522QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication AttemptsQSAN Storage Manager · QSAN XEVO +1
- CVE-2021-32520QSAN Storage Manager - Use of Hard-coded Cryptographic KeyQSAN Storage Manager
- CVE-2021-32519QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational EffortQSAN Storage Manager · QSAN XEVO +1
- CVE-2021-32513QSAN Storage Manager - Command Injection Following via QsanTorture functionQSAN Storage Manager
- CVE-2021-32512QSAN Storage Manager - Command Injection Following via QuickInstall functionQSAN Storage Manager
- CVE-2021-34624ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader ComponentProfilePress
- CVE-2021-34621ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege EscalationProfilePress
- CVE-2021-34623ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader ComponentProfilePress
- CVE-2021-34622ProfilePress 3.0 - 3.1.3 - Authenticated Privilege EscalationProfilePress
High 14
- CVE-2021-21786A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220.Iobit
- CVE-2021-21789A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqIobit
- CVE-2021-21788A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqIobit
- CVE-2021-21787A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write reqIobit
- CVE-2021-32532QSAN XEVO - Path TraversalQSAN XEVO
- CVE-2021-32527QSAN Storage Manager - Path Traversal-2QSAN Storage Manager
- CVE-2021-32521QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordQSAN Storage Manager · QSAN XEVO +1
- CVE-2021-32518QSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingQSAN Storage Manager
- CVE-2021-32517QSAN Storage Manager - Improper Access ControlQSAN Storage Manager
- CVE-2021-32516QSAN Storage Manager - Path TraversalQSAN Storage Manager
- CVE-2021-32514QSAN Storage Manager - Improper Access Control Following via FirwareUpgrade functionQSAN Storage Manager
- CVE-2021-34620CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege EscalationWP Manage Ninja WP Fluent Forms
- CVE-2021-22224A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed aGitLab
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACELinux Kernel
Medium, low and unrated 74
- CVE-2021-21775A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4.Webkit
- CVE-2021-32715Lenient Parsing of Content-Length Header When Prefixed with Plus Signhyperium hyper · hyper
- CVE-2021-32714Integer Overflow in Chunked Transfer-Encodinghyperium hyper · hyper
- CVE-2020-23702Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox_panel/shoutbox_admin.php.
- CVE-2020-23700Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.lavalite/cms
- CVE-2021-29759IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from intIBM App Connect Enterprise Certified Container
- CVE-2021-20474IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user iIBM Guardium Data Encryption
- CVE-2021-20417IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error mesIBM Guardium Data Encryption
- CVE-2021-20416IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure IBM Guardium Data Encryption
- CVE-2021-20415IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force accoIBM Guardium Data Encryption
- CVE-2021-20379IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to deIBM Guardium Data Encryption
- CVE-2021-20378IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to iIBM Guardium Data Encryption
- CVE-2021-33221An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-33220An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-33219An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-32537Realtek High definition audio Windows driver crashedRealtek HDA driver
- CVE-2021-32528QSAN Storage Manager - Exposure of Sensitive Information to an Unauthorized ActorQSAN Storage Manager
- CVE-2021-32526QSAN Storage Manager - Incorrect Permission Assignment for Critical ResourceQSAN Storage Manager
- CVE-2021-33218An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-32515QSAN Storage Manager - Exposure of Information Through Directory ListingQSAN Storage Manager
- CVE-2021-32511QSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList functionQSAN Storage Manager
- CVE-2021-32510QSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus functionQSAN Storage Manager
- CVE-2021-32509QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc functionQSAN Storage Manager
- CVE-2021-32508QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming functionQSAN Storage Manager
- CVE-2021-32507QSAN Storage Manager - Absolute Path Traversal via FileDownload functionQSAN Storage Manager
- CVE-2021-32506QSAN Storage Manager - Absolute Path Traversal via GetImage functionQSAN Storage Manager
- CVE-2021-33217An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-33216An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-33215An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier.
- CVE-2021-31925Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via
- CVE-2021-28931Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a cforkcms/forkcms
- CVE-2021-26274The Agent in NinjaRMM 5.0.909 has Insecure Permissions.
- CVE-2021-26273The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
- CVE-2020-25925Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML vi
- CVE-2020-25868Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup.
- CVE-2020-24149Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podca
- CVE-2020-24148Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a
- CVE-2020-24147Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
- CVE-2020-24146Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitr
- CVE-2020-24145Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attac
- CVE-2020-24144Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files t
- CVE-2020-24143Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files
- CVE-2020-24142Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafte
- CVE-2020-24141Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end s
- CVE-2020-24038myFax version 229 logs sensitive information in the export log module which allows any user to access critical information.
- CVE-2020-20225Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process.
- CVE-2021-35451In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web app
- CVE-2020-20216Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process.
- CVE-2020-20215Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process.
- CVE-2020-20213Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process.
- CVE-2020-20212Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process.
- CVE-2020-20211Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process.
- CVE-2021-22233An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project detailsGitLab
- CVE-2021-36212app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
- CVE-2021-34625WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site ScriptingWP Upload Restriction
- CVE-2021-34627WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole functionWP Upload Restriction
- CVE-2021-34626WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType functionWP Upload Restriction
- CVE-2021-25952Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lejust-safe-set
- CVE-2021-22225Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulneGitLab
- CVE-2021-22230Improper code rendering while rendering merge requests could be exploited to submit malicious code.GitLab
- CVE-2021-22227A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious liGitLab
- CVE-2021-22231A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile paGitLab
- CVE-2021-26039[20210705] - Core - XSS in com_media imagelistJoomla! Project Joomla! CMS
- CVE-2021-26038[20210704] - Core - Privilege escalation through com_installerJoomla! Project Joomla! CMS
- CVE-2021-26037[20210703] - Core - Lack of enforced session terminationJoomla! Project Joomla! CMS
- CVE-2021-26036[20210702] - Core - DoS through usergroup table manipulationJoomla! Project Joomla! CMS
- CVE-2021-26035[20210701] - Core - XSS in JForm Rules fieldJoomla! Project Joomla! CMS
- CVE-2021-20780Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack threalmag777 WPCS - WordPress Currency Switcher
- CVE-2021-20779Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote atcodemiq WordPress Email Template Designer - WP HTML Mail
- CVE-2021-20777Improper authorization in handler for custom URL scheme vulnerability in GU App for Android versions from 4.8.0 to 5.0.2 allows a remote attG.U. CO. GU App for Android
- CVE-2021-20776Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitraA-Stage SCT-40CM01SR and AT-40CM01SR
- CVE-2021-20739WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all vELECOM CO. WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD,…
- CVE-2021-20738WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information ELECOM CO. WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA
- CVE-2021-35039kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c.