# CVEs published 2021-07-07

108 CVEs were published on July 7, 2021: 20 critical, 14 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-21807](https://cve.now/CVE-2021-21807.md): An integer overflow vulnerability exists in the DICOM parse\_dicom\_meta\_info functionality of Accusoft ImageGear 19.9. (CVSS 9.8, Accusoft)
- [CVE-2021-21775](https://cve.now/CVE-2021-21775.md): A use-after-free vulnerability exists in the way certain events are processed for ImageLoader objects of Webkit WebKitGTK 2.30.4. (CVSS 6.8, Webkit)
- [CVE-2021-32715](https://cve.now/CVE-2021-32715.md): Lenient Parsing of Content-Length Header When Prefixed with Plus Sign (CVSS 3.1, hyperium hyper · hyper)
- [CVE-2021-32714](https://cve.now/CVE-2021-32714.md): Integer Overflow in Chunked Transfer-Encoding (CVSS 5.9, hyperium hyper · hyper)
- [CVE-2020-23702](https://cve.now/CVE-2020-23702.md): Cross Site Scripting (XSS) vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutbox\_panel/shoutbox\_admin.php. (no CVSS)
- [CVE-2020-23700](https://cve.now/CVE-2020-23700.md): Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature. (no CVSS, lavalite/cms)
- [CVE-2021-21786](https://cve.now/CVE-2021-21786.md): A privilege escalation vulnerability exists in the IOCTL 0x9c406144 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. (CVSS 8.8, Iobit)
- [CVE-2021-21789](https://cve.now/CVE-2021-21789.md): A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write req (CVSS 8.8, Iobit)
- [CVE-2021-21788](https://cve.now/CVE-2021-21788.md): A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write req (CVSS 8.8, Iobit)
- [CVE-2021-21787](https://cve.now/CVE-2021-21787.md): A privilege escalation vulnerability exists in the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O write req (CVSS 8.8, Iobit)
- [CVE-2021-29759](https://cve.now/CVE-2021-29759.md): IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from int (CVSS 4.4, IBM App Connect Enterprise Certified Container)
- [CVE-2021-20474](https://cve.now/CVE-2021-20474.md): IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not perform any authentication for functionality that requires a provable user i (CVSS 6.5, IBM Guardium Data Encryption)
- [CVE-2021-20417](https://cve.now/CVE-2021-20417.md): IBM Guardium Data Encryption (GDE) 4.0.0.4 could allow a remote attacker to obtain sensitive information when a detailed technical error mes (CVSS 4.3, IBM Guardium Data Encryption)
- [CVE-2021-20416](https://cve.now/CVE-2021-20416.md): IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 could allow a remote attacker to obtain sensitive information, caused by the failure (CVSS 3.7, IBM Guardium Data Encryption)
- [CVE-2021-20415](https://cve.now/CVE-2021-20415.md): IBM Guardium Data Encryption (GDE) 4.0.0.4 uses an inadequate account lockout setting that could allow a remote attacker to brute force acco (CVSS 5.9, IBM Guardium Data Encryption)
- [CVE-2021-20379](https://cve.now/CVE-2021-20379.md): IBM Guardium Data Encryption (GDE) 3.0.0.3 and 4.0.0.4 uses weaker than expected cryptographic algorithms that could allow an attacker to de (CVSS 5.9, IBM Guardium Data Encryption)
- [CVE-2021-20378](https://cve.now/CVE-2021-20378.md): IBM Guardium Data Encryption (GDE) 3.0.0.2 and 4.0.0.4 does not invalidate session after logout which could allow an authenticated user to i (CVSS 6.3, IBM Guardium Data Encryption)
- [CVE-2021-33221](https://cve.now/CVE-2021-33221.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-33220](https://cve.now/CVE-2021-33220.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-33219](https://cve.now/CVE-2021-33219.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-32538](https://cve.now/CVE-2021-32538.md): ARTWARE CMS - Unrestricted Upload of File (CVSS 9.8, ARTWARE CMS)
- [CVE-2021-32537](https://cve.now/CVE-2021-32537.md): Realtek High definition audio Windows driver crashed (CVSS 6.5, Realtek HDA driver)
- [CVE-2021-32535](https://cve.now/CVE-2021-32535.md): QSAN SANOS - Use of Hard-coded Credentials (CVSS 9.8, QSAN SANOS)
- [CVE-2021-32534](https://cve.now/CVE-2021-32534.md): QSAN SANOS - Command Injection (CVSS 9.8, QSAN SANOS)
- [CVE-2021-32533](https://cve.now/CVE-2021-32533.md): QSAN SANOS - Command Injection (CVSS 9.8, QSAN SANOS)
- [CVE-2021-32532](https://cve.now/CVE-2021-32532.md): QSAN XEVO - Path Traversal (CVSS 7.5, QSAN XEVO)
- [CVE-2021-32531](https://cve.now/CVE-2021-32531.md): QSAN XEVO - Command Injection Following via Init function (CVSS 9.8, QSAN XEVO)
- [CVE-2021-32530](https://cve.now/CVE-2021-32530.md): QSAN XEVO - Command Injection Following via Array function (CVSS 9.8, QSAN XEVO)
- [CVE-2021-32529](https://cve.now/CVE-2021-32529.md): QSAN XEVO, SANOS - Command Injection -1 (CVSS 9.8, QSAN XEVO · QSAN SANOS)
- [CVE-2021-32528](https://cve.now/CVE-2021-32528.md): QSAN Storage Manager - Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, QSAN Storage Manager)
- [CVE-2021-32527](https://cve.now/CVE-2021-32527.md): QSAN Storage Manager - Path Traversal-2 (CVSS 7.5, QSAN Storage Manager)
- [CVE-2021-32526](https://cve.now/CVE-2021-32526.md): QSAN Storage Manager - Incorrect Permission Assignment for Critical Resource (CVSS 6.5, QSAN Storage Manager)
- [CVE-2021-32525](https://cve.now/CVE-2021-32525.md): QSAN Storage Manager - Use of Hard-coded Password-2 (CVSS 9.1, QSAN Storage Manager)
- [CVE-2021-32524](https://cve.now/CVE-2021-32524.md): QSAN Storage Manager - Command Injection-3 (CVSS 9.1, QSAN Storage Manager)
- [CVE-2021-32523](https://cve.now/CVE-2021-32523.md): QSAN Storage Manager - Improper Authorization (CVSS 9.1, QSAN Storage Manager)
- [CVE-2021-32522](https://cve.now/CVE-2021-32522.md): QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts (CVSS 9.8, QSAN Storage Manager · QSAN XEVO +1)
- [CVE-2021-32521](https://cve.now/CVE-2021-32521.md): QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password (CVSS 7.3, QSAN Storage Manager · QSAN XEVO +1)
- [CVE-2021-32520](https://cve.now/CVE-2021-32520.md): QSAN Storage Manager - Use of Hard-coded Cryptographic Key (CVSS 9.8, QSAN Storage Manager)
- [CVE-2021-32519](https://cve.now/CVE-2021-32519.md): QSAN Storage Manager, XEVO, SANOS - Use of Password Hash With Insufficient Computational Effort (CVSS 9.8, QSAN Storage Manager · QSAN XEVO +1)
- [CVE-2021-32518](https://cve.now/CVE-2021-32518.md): QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following (CVSS 7.5, QSAN Storage Manager)
- [CVE-2021-32517](https://cve.now/CVE-2021-32517.md): QSAN Storage Manager - Improper Access Control (CVSS 7.5, QSAN Storage Manager)
- [CVE-2021-32516](https://cve.now/CVE-2021-32516.md): QSAN Storage Manager - Path Traversal (CVSS 7.5, QSAN Storage Manager)
- [CVE-2021-33218](https://cve.now/CVE-2021-33218.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-32515](https://cve.now/CVE-2021-32515.md): QSAN Storage Manager - Exposure of Information Through Directory Listing (CVSS 5.3, QSAN Storage Manager)
- [CVE-2021-32514](https://cve.now/CVE-2021-32514.md): QSAN Storage Manager - Improper Access Control Following via FirwareUpgrade function (CVSS 7.5, QSAN Storage Manager)
- [CVE-2021-32513](https://cve.now/CVE-2021-32513.md): QSAN Storage Manager - Command Injection Following via QsanTorture function (CVSS 9.8, QSAN Storage Manager)
- [CVE-2021-32512](https://cve.now/CVE-2021-32512.md): QSAN Storage Manager - Command Injection Following via QuickInstall function (CVSS 9.8, QSAN Storage Manager)
- [CVE-2021-32511](https://cve.now/CVE-2021-32511.md): QSAN Storage Manager - Exposure of Information Through Directory Listing Following via ViewBroserList function (CVSS 4.3, QSAN Storage Manager)
- [CVE-2021-32510](https://cve.now/CVE-2021-32510.md): QSAN Storage Manager - Exposure of Information Through Directory Listing Following via Antivirus function (CVSS 4.3, QSAN Storage Manager)
- [CVE-2021-32509](https://cve.now/CVE-2021-32509.md): QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc function (CVSS 6.5, QSAN Storage Manager)
- [CVE-2021-32508](https://cve.now/CVE-2021-32508.md): QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming function (CVSS 6.5, QSAN Storage Manager)
- [CVE-2021-32507](https://cve.now/CVE-2021-32507.md): QSAN Storage Manager - Absolute Path Traversal via FileDownload function (CVSS 6.5, QSAN Storage Manager)
- [CVE-2021-32506](https://cve.now/CVE-2021-32506.md): QSAN Storage Manager - Absolute Path Traversal via GetImage function (CVSS 6.5, QSAN Storage Manager)
- [CVE-2021-33217](https://cve.now/CVE-2021-33217.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-33216](https://cve.now/CVE-2021-33216.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-33215](https://cve.now/CVE-2021-33215.md): An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. (no CVSS)
- [CVE-2021-31925](https://cve.now/CVE-2021-31925.md): Pexip Infinity 25.x before 25.4 has Improper Input Validation, and thus an unauthenticated remote attacker can cause a denial of service via (no CVSS)
- [CVE-2021-28931](https://cve.now/CVE-2021-28931.md): Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a c (no CVSS, forkcms/forkcms)
- [CVE-2021-26274](https://cve.now/CVE-2021-26274.md): The Agent in NinjaRMM 5.0.909 has Insecure Permissions. (no CVSS)
- [CVE-2021-26273](https://cve.now/CVE-2021-26273.md): The Agent in NinjaRMM 5.0.909 has Incorrect Access Control. (no CVSS)
- [CVE-2020-25925](https://cve.now/CVE-2020-25925.md): Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2020-25868](https://cve.now/CVE-2020-25868.md): Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. (no CVSS)
- [CVE-2020-24149](https://cve.now/CVE-2020-24149.md): Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podca (no CVSS)
- [CVE-2020-24148](https://cve.now/CVE-2020-24148.md): Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a (no CVSS)
- [CVE-2020-24147](https://cve.now/CVE-2020-24147.md): Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field. (no CVSS)
- [CVE-2020-24146](https://cve.now/CVE-2020-24146.md): Directory traversal in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows authorized users to delete arbitr (no CVSS)
- [CVE-2020-24145](https://cve.now/CVE-2020-24145.md): Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attac (no CVSS)
- [CVE-2020-24144](https://cve.now/CVE-2020-24144.md): Directory traversal in the Media File Organizer (aka media-file-organizer) plugin 1.0.1 for WordPress lets an attacker get access to files t (no CVSS)
- [CVE-2020-24143](https://cve.now/CVE-2020-24143.md): Directory traversal in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker get access to files (no CVSS)
- [CVE-2020-24142](https://cve.now/CVE-2020-24142.md): Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafte (no CVSS)
- [CVE-2020-24141](https://cve.now/CVE-2020-24141.md): Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end s (no CVSS)
- [CVE-2020-24038](https://cve.now/CVE-2020-24038.md): myFax version 229 logs sensitive information in the export log module which allows any user to access critical information. (no CVSS)
- [CVE-2020-20225](https://cve.now/CVE-2020-20225.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /nova/bin/user process. (no CVSS)
- [CVE-2021-35451](https://cve.now/CVE-2021-35451.md): In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web app (no CVSS)
- [CVE-2020-20216](https://cve.now/CVE-2020-20216.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/graphing process. (no CVSS)
- [CVE-2020-20215](https://cve.now/CVE-2020-20215.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/diskd process. (no CVSS)
- [CVE-2020-20213](https://cve.now/CVE-2020-20213.md): Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. (no CVSS)
- [CVE-2020-20212](https://cve.now/CVE-2020-20212.md): Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console process. (no CVSS)
- [CVE-2020-20211](https://cve.now/CVE-2020-20211.md): Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console process. (no CVSS)
- [CVE-2021-22233](https://cve.now/CVE-2021-22233.md): An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details (CVSS 4.3, GitLab)
- [CVE-2021-36212](https://cve.now/CVE-2021-36212.md): app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view. (no CVSS)
- [CVE-2021-34625](https://cve.now/CVE-2021-34625.md): WP Upload Restriction \<= 2.2.3 - Authenticated Stored Cross-Site Scripting (CVSS 6.4, WP Upload Restriction)
- [CVE-2021-34627](https://cve.now/CVE-2021-34627.md): WP Upload Restriction \<= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function (CVSS 4.3, WP Upload Restriction)
- [CVE-2021-34626](https://cve.now/CVE-2021-34626.md): WP Upload Restriction \<= 2.2.3 - Missing Access Control in deleteCustomType function (CVSS 4.3, WP Upload Restriction)
- [CVE-2021-34624](https://cve.now/CVE-2021-34624.md): ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component (CVSS 9.8, ProfilePress)
- [CVE-2021-34621](https://cve.now/CVE-2021-34621.md): ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation (CVSS 9.8, ProfilePress)
- [CVE-2021-34623](https://cve.now/CVE-2021-34623.md): ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component (CVSS 9.8, ProfilePress)
- [CVE-2021-34620](https://cve.now/CVE-2021-34620.md): CSRF in WP Fluent Forms \< 3.6.67 allows stored XSS and Privilege Escalation (CVSS 8.8, WP Manage Ninja WP Fluent Forms)
- [CVE-2021-34622](https://cve.now/CVE-2021-34622.md): ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation (CVSS 9.8, ProfilePress)
- [CVE-2021-25952](https://cve.now/CVE-2021-25952.md): Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may le (no CVSS, just-safe-set)
- [CVE-2021-22224](https://cve.now/CVE-2021-22224.md): A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed a (CVSS 7.1, GitLab)
- [CVE-2021-22555](https://cve.now/CVE-2021-22555.md): Heap Out-Of-Bounds Write in Netfilter IP6T\_SO\_SET\_REPLACE (CVSS 8.3, KEV, Linux Kernel)
- [CVE-2021-22225](https://cve.now/CVE-2021-22225.md): Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulne (CVSS 4.7, GitLab)
- [CVE-2021-22230](https://cve.now/CVE-2021-22230.md): Improper code rendering while rendering merge requests could be exploited to submit malicious code. (CVSS 4.9, GitLab)
- [CVE-2021-22227](https://cve.now/CVE-2021-22227.md): A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious li (CVSS 6.1, GitLab)
- [CVE-2021-22231](https://cve.now/CVE-2021-22231.md): A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile pa (CVSS 3.5, GitLab)
- [CVE-2021-26039](https://cve.now/CVE-2021-26039.md): \[20210705\] - Core - XSS in com\_media imagelist (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26038](https://cve.now/CVE-2021-26038.md): \[20210704\] - Core - Privilege escalation through com\_installer (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26037](https://cve.now/CVE-2021-26037.md): \[20210703\] - Core - Lack of enforced session termination (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26036](https://cve.now/CVE-2021-26036.md): \[20210702\] - Core - DoS through usergroup table manipulation (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-26035](https://cve.now/CVE-2021-26035.md): \[20210701\] - Core - XSS in JForm Rules field (no CVSS, Joomla! Project Joomla! CMS)
- [CVE-2021-20780](https://cve.now/CVE-2021-20780.md): Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote attackers to hijack th (no CVSS, realmag777 WPCS - WordPress Currency Switcher)
- [CVE-2021-20779](https://cve.now/CVE-2021-20779.md): Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8 allows remote at (no CVSS, codemiq WordPress Email Template Designer - WP HTML Mail)
- [CVE-2021-20777](https://cve.now/CVE-2021-20777.md): Improper authorization in handler for custom URL scheme vulnerability in GU App for Android versions from 4.8.0 to 5.0.2 allows a remote att (no CVSS, G.U. CO. GU App for Android)
- [CVE-2021-20776](https://cve.now/CVE-2021-20776.md): Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction and execute an arbitra (no CVSS, A-Stage SCT-40CM01SR and AT-40CM01SR)
- [CVE-2021-20739](https://cve.now/CVE-2021-20739.md): WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all v (no CVSS, ELECOM CO. WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD,…)
- [CVE-2021-20738](https://cve.now/CVE-2021-20738.md): WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain sensitive information (no CVSS, ELECOM CO. WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA)
- [CVE-2021-35039](https://cve.now/CVE-2021-35039.md): kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.