CVEs published July 9, 2021
61 CVEs were published on July 9, 2021: 5 critical, 11 high. 1 is now in CISA KEV.
- Published
- 61
- Critical
- 5
- High
- 11
- Medium
- 6
- Low
- 0
- Unrated
- 39
- Now in CISA KEV
- 1
- Fix available
- 4
Most affected products
- Autodesk Design Review
- 7
- Fortinet FortiMail
- 4
- IBM InfoSphere Information Server
- 2
- linuxptp
- 2
- edgexfoundry edgex-go
- 1
- ethercreative logs · ether/logs
- 1
- Fortinet FortiAP-W2, FortiAP-S, FortiAP
- 1
- Fortinet FortiSandbox
- 1
- go/golang
- 1
- kernel
- 1
Critical 5
- CVE-2021-24007Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticatedFortinet FortiMail
- CVE-2021-301202FA bypass in Kaseya VSA <= v9.5.6
- CVE-2021-30118Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
- CVE-2021-30117Authenticated SQL injection in Kaseya VSA < v9.5.6
- CVE-2021-30116Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6
High 11
- CVE-2021-32753Weak password in API gateway in EdgeX Foundry Edinburgh, Fuji, Geneva, and Hanoi releases allows remote attackers to obtain authentication token via dictionary-based password attack when OAuth2 authentication method is enabled.edgexfoundry edgex-go
- CVE-2021-22129Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow aFortinet FortiMail
- CVE-2021-26106An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 througFortinet FortiAP-W2, FortiAP-S, FortiAP
- CVE-2021-24020A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 maFortinet FortiMail
- CVE-2021-27033Double Free File Parsing Vulnerability in Autodesk Design ReviewAutodesk Design Review
- CVE-2021-32752Files or Directories Accessible to External Parties in ether/logsethercreative logs · ether/logs
- CVE-2021-33012Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause theRockwell Automation MicroLogix
- CVE-2021-32742Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crashvapor
- CVE-2021-30201Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
- CVE-2021-23405SQL Injectionpimcore/pimcore
- CVE-2021-36367PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response.
Medium, low and unrated 45
- CVE-2020-25391A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entere
- CVE-2020-25392A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2020-25394A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML v
- CVE-2020-25875A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arb
- CVE-2020-25876A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbit
- CVE-2020-25877A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute
- CVE-2020-25878A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execu
- CVE-2020-25879A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execut
- CVE-2020-35984A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execu
- CVE-2020-35985A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execu
- CVE-2020-35986A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers t
- CVE-2020-35987A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to exec
- CVE-2021-35358A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbit
- CVE-2021-35361A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands
- CVE-2021-35360A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary comm
- CVE-2021-20024Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability orSonicWall Switch
- CVE-2021-36371Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cer
- CVE-2020-29014A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.Fortinet FortiSandbox
- CVE-2021-26100A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who inFortinet FortiMail
- CVE-2021-33214In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive inf
- CVE-2021-33792Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary.
- CVE-2021-33795Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document own
- CVE-2021-29730IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection.IBM InfoSphere Information Server
- CVE-2021-29712IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2020-21333Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.
- CVE-2021-3541A flaw was found in libxml2.libxml2
- CVE-2020-22535Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php.
- CVE-2021-27039A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for bAutodesk Design Review
- CVE-2021-27038A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF fiAutodesk Design Review
- CVE-2021-27037A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object tAutodesk Design Review
- CVE-2021-27036A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PIAutodesk Design Review
- CVE-2021-27035A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyondAutodesk Design Review
- CVE-2021-27034A heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011.Autodesk Design Review
- CVE-2021-30121(Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
- CVE-2021-30119Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6
- CVE-2021-36153Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malform
- CVE-2021-36155LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause un
- CVE-2021-36154HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages wi
- CVE-2012-2666golang/go in 1.0.2 fixes all.bash on shared machines.go/golang
- CVE-2012-1102It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untperl-xml-atom
- CVE-2021-3637A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessikeycloak-model-infinispan · org.keycloak:keycloak-model-inf…
- CVE-2021-3612An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the usekernel
- CVE-2021-3571A flaw was found in the ptp4l program of the linuxptp package.linuxptp
- CVE-2021-3570A flaw was found in the ptp4l program of the linuxptp package.linuxptp
- CVE-2021-32972Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser Panasonic FPWIN Pro