# CVEs published 2021-07-08

66 CVEs were published on July 8, 2021: 4 critical, 5 high. Days are UTC.

- [CVE-2021-34616](https://cve.now/CVE-2021-34616.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-34615](https://cve.now/CVE-2021-34615.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-34613](https://cve.now/CVE-2021-34613.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-34612](https://cve.now/CVE-2021-34612.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2020-23580](https://cve.now/CVE-2020-23580.md): Remote Code Execution vulnerability in PbootCMS 2.0.8 in the message board. (no CVSS)
- [CVE-2021-1607](https://cve.now/CVE-2021-1607.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-1606](https://cve.now/CVE-2021-1606.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-1605](https://cve.now/CVE-2021-1605.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-1604](https://cve.now/CVE-2021-1604.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-1603](https://cve.now/CVE-2021-1603.md): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-1598](https://cve.now/CVE-2021-1598.md): Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1597](https://cve.now/CVE-2021-1597.md): Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1596](https://cve.now/CVE-2021-1596.md): Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1595](https://cve.now/CVE-2021-1595.md): Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Memory Leak Vulnerabilities (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-1585](https://cve.now/CVE-2021-1585.md): Cisco Adaptive Security Device Manager Remote Code Execution Vulnerability (CVSS 7.5, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-1576](https://cve.now/CVE-2021-1576.md): Cisco Business Process Automation Privilege Escalation Vulnerabilities (CVSS 8.8, Cisco Business Process Automation)
- [CVE-2021-1562](https://cve.now/CVE-2021-1562.md): Cisco BroadWorks Application Server Information Disclosure Vulnerability (CVSS 4.3, Cisco BroadWorks)
- [CVE-2021-1359](https://cve.now/CVE-2021-1359.md): Cisco Web Security Appliance Privilege Escalation Vulnerability (CVSS 6.3, Cisco Web Security Appliance)
- [CVE-2021-1574](https://cve.now/CVE-2021-1574.md): Cisco Business Process Automation Privilege Escalation Vulnerabilities (CVSS 8.8, Cisco Business Process Automation)
- [CVE-2021-1575](https://cve.now/CVE-2021-1575.md): Cisco Virtualized Voice Browser Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Virtualized Voice Browser)
- [CVE-2020-20363](https://cve.now/CVE-2020-20363.md): Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php. (no CVSS)
- [CVE-2021-34614](https://cve.now/CVE-2021-34614.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-34609](https://cve.now/CVE-2021-34609.md): A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2020-18741](https://cve.now/CVE-2020-18741.md): Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and " (no CVSS)
- [CVE-2021-29711](https://cve.now/CVE-2021-29711.md): IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 6.2.7.8 , 6.2.7.9, 7.0.3.0, 7.0.4.0, 7.0.5.4, 7.1.0.0, 7.1.1.0, 7.1.1.1, and 7.1.1.2 could allo (CVSS 4.9, IBM UrbanCode Deploy)
- [CVE-2020-20586](https://cve.now/CVE-2020-20586.md): A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any informa (no CVSS)
- [CVE-2020-20585](https://cve.now/CVE-2020-20585.md): A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information. (no CVSS)
- [CVE-2020-20584](https://cve.now/CVE-2020-20584.md): A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form paramet (no CVSS)
- [CVE-2020-20583](https://cve.now/CVE-2020-20583.md): A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information. (no CVSS)
- [CVE-2020-20582](https://cve.now/CVE-2020-20582.md): A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive infor (no CVSS)
- [CVE-2021-34610](https://cve.now/CVE-2021-34610.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-34611](https://cve.now/CVE-2021-34611.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29152](https://cve.now/CVE-2021-29152.md): A remote denial of service (DoS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29151](https://cve.now/CVE-2021-29151.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8.9. (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-29150](https://cve.now/CVE-2021-29150.md): A remote insecure deserialization vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior to 6.10.0, 6.9.6 and 6.8. (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-25442](https://cve.now/CVE-2021-25442.md): Improper MDM policy management vulnerability in KME module prior to KCS version 1.39 allows MDM users to bypass Knox Manage authentication. (no CVSS, Samsung Mobile Knox Mobile Enrollment)
- [CVE-2021-25441](https://cve.now/CVE-2021-25441.md): Improper input validation vulnerability in AR Emoji Editor prior to version 4.4.03.5 in Android Q(10.0) and above allows untrusted applicati (no CVSS, Samsung Mobile AR Emoji Editor)
- [CVE-2021-25440](https://cve.now/CVE-2021-25440.md): Improper access control vulnerability in FactoryCameraFB prior to version 3.4.74 allows untrusted applications to access arbitrary files wit (no CVSS, Samsung Mobile FactoryCameraFB)
- [CVE-2021-25439](https://cve.now/CVE-2021-25439.md): Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P (no CVSS, Samsung Mobile Samsung Members)
- [CVE-2021-25438](https://cve.now/CVE-2021-25438.md): Improper access control vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P (no CVSS, Samsung Mobile Samsung Members)
- [CVE-2021-25437](https://cve.now/CVE-2021-25437.md): Improper access control vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows attackers to arbitrary code exe (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25436](https://cve.now/CVE-2021-25436.md): Improper input validation vulnerability in Tizen FOTA service prior to Firmware update JUL-2021 Release allows arbitrary code execution via (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25435](https://cve.now/CVE-2021-25435.md): Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25434](https://cve.now/CVE-2021-25434.md): Improper input validation vulnerability in Tizen bootloader prior to Firmware update JUL-2021 Release allows arbitrary code execution using (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25433](https://cve.now/CVE-2021-25433.md): Improper authorization vulnerability in Tizen factory reset policy prior to Firmware update JUL-2021 Release allows untrusted applications t (no CVSS, Samsung Mobile Tizen wearable devices)
- [CVE-2021-25432](https://cve.now/CVE-2021-25432.md): Information exposure vulnerability in Samsung Members prior to versions 2.4.85.11 in Android O(8.1) and below, and 3.9.10.11 in Android P(9. (no CVSS, Samsung Mobile Samsung Members)
- [CVE-2021-25431](https://cve.now/CVE-2021-25431.md): Improper access control vulnerability in Cameralyzer prior to versions 3.2.1041 in 3.2.x, 3.3.1040 in 3.3.x, and 3.4.4210 in 3.4.x allows un (no CVSS, Samsung Mobile Cameralyzer)
- [CVE-2021-25430](https://cve.now/CVE-2021-25430.md): Improper access control vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access the B (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25429](https://cve.now/CVE-2021-25429.md): Improper privilege management vulnerability in Bluetooth application prior to SMR July-2021 Release 1 allows untrusted application to access (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25428](https://cve.now/CVE-2021-25428.md): Improper validation check vulnerability in PackageManager prior to SMR July-2021 Release 1 allows untrusted applications to get dangerous le (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25427](https://cve.now/CVE-2021-25427.md): SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device information (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25426](https://cve.now/CVE-2021-25426.md): Improper component protection vulnerability in SmsViewerActivity of Samsung Message prior to SMR July-2021 Release 1 allows untrusted applic (no CVSS, Samsung Mobile Devices)
- [CVE-2021-34110](https://cve.now/CVE-2021-34110.md): WinWaste.NET version 1.0.6183.16475 has incorrect permissions, allowing a local unprivileged user to replace the executable with a malicious (no CVSS)
- [CVE-2020-20217](https://cve.now/CVE-2020-20217.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/route process. (no CVSS)
- [CVE-2020-28598](https://cve.now/CVE-2020-28598.md): An out-of-bounds write vulnerability exists in the Admesh stl\_fix\_normal\_directions() functionality of Prusa Research PrusaSlicer 2.2.0 and (CVSS 8.8, Prusa Research)
- [CVE-2021-21779](https://cve.now/CVE-2021-21779.md): A use-after-free vulnerability exists in the way Webkit’s GraphicsContext handles certain events in WebKitGTK 2.30.4. (CVSS 6.8, Webkit)
- [CVE-2021-21794](https://cve.now/CVE-2021-21794.md): An out-of-bounds write vulnerability exists in the TIF bits\_per\_sample processing functionality of Accusoft ImageGear 19.9. (CVSS 9.8, Accusoft")
- [CVE-2021-21793](https://cve.now/CVE-2021-21793.md): An out-of-bounds write vulnerability exists in the JPG sof\_nb\_comp header processing functionality of Accusoft ImageGear 19.8 and 19.9. (CVSS 9.8, Accusoft)
- [CVE-2021-21806](https://cve.now/CVE-2021-21806.md): An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.3 x64. (CVSS 8.8, Webkit)
- [CVE-2021-21821](https://cve.now/CVE-2021-21821.md): A stack-based buffer overflow vulnerability exists in the PDF process\_fontname functionality of Accusoft ImageGear 19.9. (CVSS 9.8, Accusoft)
- [CVE-2021-32462](https://cve.now/CVE-2021-32462.md): Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remote Code Execution vu (no CVSS, Trend Micro Password Manager)
- [CVE-2021-32461](https://cve.now/CVE-2021-32461.md): Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Integer Truncation Privilege Escalation vulnerabili (no CVSS, Trend Micro Password Manager)
- [CVE-2021-31817](https://cve.now/CVE-2021-31817.md): When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2021-31816](https://cve.now/CVE-2021-31816.md): When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2021-28809](https://cve.now/CVE-2021-28809.md): Missing Authentication for Critical Function in RTRR Server in HBS3 (CVSS 9.8, QNAP Systems HBS)
- [CVE-2021-34430](https://cve.now/CVE-2021-34430.md): Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the mas (no CVSS, The Eclipse Foundation Eclipse TinyDTLS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.