# CVEs published 2021-07-09

61 CVEs were published on July 9, 2021: 5 critical, 11 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-25391](https://cve.now/CVE-2020-25391.md): A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entere (no CVSS)
- [CVE-2020-25392](https://cve.now/CVE-2020-25392.md): A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (no CVSS)
- [CVE-2020-25394](https://cve.now/CVE-2020-25394.md): A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML v (no CVSS)
- [CVE-2020-25875](https://cve.now/CVE-2020-25875.md): A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arb (no CVSS)
- [CVE-2020-25876](https://cve.now/CVE-2020-25876.md): A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbit (no CVSS)
- [CVE-2020-25877](https://cve.now/CVE-2020-25877.md): A stored cross site scripting (XSS) vulnerability in the 'Add Page' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execute (no CVSS)
- [CVE-2020-25878](https://cve.now/CVE-2020-25878.md): A stored cross site scripting (XSS) vulnerability in the 'Admin-Tools' feature of BlackCat CMS 1.3.6 allows authenticated attackers to execu (no CVSS)
- [CVE-2020-25879](https://cve.now/CVE-2020-25879.md): A stored cross site scripting (XSS) vulnerability in the 'Manage Users' feature of Codoforum v5.0.2 allows authenticated attackers to execut (no CVSS)
- [CVE-2020-35984](https://cve.now/CVE-2020-35984.md): A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execu (no CVSS)
- [CVE-2020-35985](https://cve.now/CVE-2020-35985.md): A stored cross site scripting (XSS) vulnerability in the 'Global Lists" feature of Rukovoditel 2.7.2 allows authenticated attackers to execu (no CVSS)
- [CVE-2020-35986](https://cve.now/CVE-2020-35986.md): A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers t (no CVSS)
- [CVE-2020-35987](https://cve.now/CVE-2020-35987.md): A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to exec (no CVSS)
- [CVE-2021-35358](https://cve.now/CVE-2021-35358.md): A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c\_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbit (no CVSS)
- [CVE-2021-35361](https://cve.now/CVE-2021-35361.md): A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands (no CVSS)
- [CVE-2021-35360](https://cve.now/CVE-2021-35360.md): A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary comm (no CVSS)
- [CVE-2021-20024](https://cve.now/CVE-2021-20024.md): Multiple Out-of-Bound read vulnerability in SonicWall Switch when handling LLDP Protocol allows an attacker to cause a system instability or (no CVSS, SonicWall Switch)
- [CVE-2021-36371](https://cve.now/CVE-2021-36371.md): Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cer (no CVSS)
- [CVE-2021-32753](https://cve.now/CVE-2021-32753.md): Weak password in API gateway in EdgeX Foundry Edinburgh, Fuji, Geneva, and Hanoi releases allows remote attackers to obtain authentication token via dictionary-based password attack when OAuth2 authentication method is enabled. (CVSS 8.3, edgexfoundry edgex-go)
- [CVE-2021-24007](https://cve.now/CVE-2021-24007.md): Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated (CVSS 9.8, Fortinet FortiMail)
- [CVE-2021-22129](https://cve.now/CVE-2021-22129.md): Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow a (CVSS 8.8, Fortinet FortiMail)
- [CVE-2021-26106](https://cve.now/CVE-2021-26106.md): An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 throug (CVSS 7.8, Fortinet FortiAP-W2, FortiAP-S, FortiAP)
- [CVE-2020-29014](https://cve.now/CVE-2020-29014.md): A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3. (CVSS 6.3, Fortinet FortiSandbox)
- [CVE-2021-26100](https://cve.now/CVE-2021-26100.md): A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who in (CVSS 5.9, Fortinet FortiMail)
- [CVE-2021-24020](https://cve.now/CVE-2021-24020.md): A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 ma (CVSS 7.5, Fortinet FortiMail)
- [CVE-2021-33214](https://cve.now/CVE-2021-33214.md): In HMS Ewon eCatcher through 6.6.4, weak filesystem permissions could allow malicious users to access files that could lead to sensitive inf (no CVSS)
- [CVE-2021-33792](https://cve.now/CVE-2021-33792.md): Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary. (no CVSS)
- [CVE-2021-33795](https://cve.now/CVE-2021-33795.md): Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document own (no CVSS)
- [CVE-2021-29730](https://cve.now/CVE-2021-29730.md): IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. (CVSS 6.3, IBM InfoSphere Information Server)
- [CVE-2021-29712](https://cve.now/CVE-2021-29712.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 6.1, IBM InfoSphere Information Server)
- [CVE-2020-21333](https://cve.now/CVE-2020-21333.md): Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case. (no CVSS)
- [CVE-2021-3541](https://cve.now/CVE-2021-3541.md): A flaw was found in libxml2. (no CVSS, libxml2)
- [CVE-2020-22535](https://cve.now/CVE-2020-22535.md): Incorrect Access Control vulnerability in PbootCMS 2.0.6 via the list parameter in the update function in upgradecontroller.php. (no CVSS)
- [CVE-2021-27039](https://cve.now/CVE-2021-27039.md): A maliciously crafted TIFF and PCX file can be forced to read and write beyond allocated boundaries when parsing the TIFF and PCX file for b (no CVSS, Autodesk Design Review)
- [CVE-2021-27038](https://cve.now/CVE-2021-27038.md): A Type Confusion vulnerability in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF fi (no CVSS, Autodesk Design Review)
- [CVE-2021-27037](https://cve.now/CVE-2021-27037.md): A maliciously crafted PNG, PDF or DWF file in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object t (no CVSS, Autodesk Design Review)
- [CVE-2021-27036](https://cve.now/CVE-2021-27036.md): A maliciously crafted PCX, PICT, RCL, TIF, BMP, PSD or TIFF file can be used to write beyond the allocated buffer while parsing PCX, PDF, PI (no CVSS, Autodesk Design Review)
- [CVE-2021-27035](https://cve.now/CVE-2021-27035.md): A maliciously crafted TIFF, TIF, PICT, TGA, or DWF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011 can be forced to read beyond (no CVSS, Autodesk Design Review)
- [CVE-2021-27034](https://cve.now/CVE-2021-27034.md): A heap-based buffer overflow could occur while parsing PICT, PCX, RCL or TIFF files in Autodesk Design Review 2018, 2017, 2013, 2012, 2011. (no CVSS, Autodesk Design Review)
- [CVE-2021-27033](https://cve.now/CVE-2021-27033.md): Double Free File Parsing Vulnerability in Autodesk Design Review (CVSS 8.1, Autodesk Design Review)
- [CVE-2021-32752](https://cve.now/CVE-2021-32752.md): Files or Directories Accessible to External Parties in ether/logs (CVSS 7.2, ethercreative logs · ether/logs)
- [CVE-2021-33012](https://cve.now/CVE-2021-33012.md): Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the (CVSS 7.5, Rockwell Automation MicroLogix)
- [CVE-2021-32742](https://cve.now/CVE-2021-32742.md): Untrusted data fed into \`Data.init(base32Encoded:)\` can result in exposing server memory and/or crash (CVSS 7.5, vapor)
- [CVE-2021-30201](https://cve.now/CVE-2021-30201.md): Unauthenticated XML External Entity vulnerability in Kaseya VSA \< v9.5.6 (CVSS 7.5)
- [CVE-2021-30121](https://cve.now/CVE-2021-30121.md): (Semi-)Authenticated local file inclusion in Kaseya VSA \< v9.5.6 (CVSS 6.5)
- [CVE-2021-30120](https://cve.now/CVE-2021-30120.md): 2FA bypass in Kaseya VSA \<= v9.5.6 (CVSS 9.9)
- [CVE-2021-30119](https://cve.now/CVE-2021-30119.md): Authenticated Authenticated reflective XSS in Kaseya VSA \<= v9.5.6 (CVSS 5.4)
- [CVE-2021-30118](https://cve.now/CVE-2021-30118.md): Unauthenticated Remote Code Execution in Kaseya VSA \< v9.5.5 (CVSS 9.8)
- [CVE-2021-30117](https://cve.now/CVE-2021-30117.md): Authenticated SQL injection in Kaseya VSA \< v9.5.6 (CVSS 9.8)
- [CVE-2021-23405](https://cve.now/CVE-2021-23405.md): SQL Injection (CVSS 8.3, pimcore/pimcore)
- [CVE-2021-36153](https://cve.now/CVE-2021-36153.md): Mismanaged state in GRPCWebToHTTP2ServerCodec.swift in gRPC Swift 1.1.0 and 1.1.1 allows remote attackers to deny service by sending malform (no CVSS)
- [CVE-2021-36155](https://cve.now/CVE-2021-36155.md): LengthPrefixedMessageReader in gRPC Swift 1.1.0 and earlier allocates buffers of arbitrary length, which allows remote attackers to cause un (no CVSS)
- [CVE-2021-36154](https://cve.now/CVE-2021-36154.md): HTTP2ToRawGRPCServerCodec in gRPC Swift 1.1.1 and earlier allows remote attackers to deny service via the delivery of many small messages wi (no CVSS)
- [CVE-2012-2666](https://cve.now/CVE-2012-2666.md): golang/go in 1.0.2 fixes all.bash on shared machines. (no CVSS, go/golang)
- [CVE-2012-1102](https://cve.now/CVE-2012-1102.md): It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially unt (no CVSS, perl-xml-atom)
- [CVE-2021-3637](https://cve.now/CVE-2021-3637.md): A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessi (no CVSS, keycloak-model-infinispan · org.keycloak:keycloak-model-inf…)
- [CVE-2021-3612](https://cve.now/CVE-2021-3612.md): An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the use (no CVSS, kernel)
- [CVE-2021-3571](https://cve.now/CVE-2021-3571.md): A flaw was found in the ptp4l program of the linuxptp package. (no CVSS, linuxptp)
- [CVE-2021-3570](https://cve.now/CVE-2021-3570.md): A flaw was found in the ptp4l program of the linuxptp package. (no CVSS, linuxptp)
- [CVE-2021-32972](https://cve.now/CVE-2021-32972.md): Panasonic FPWIN Pro, all Versions 7.5.1.1 and prior, allows an attacker to craft a project file specifying a URI that causes the XML parser (no CVSS, Panasonic FPWIN Pro)
- [CVE-2021-30116](https://cve.now/CVE-2021-30116.md): Unauthenticated credential leak and business logic flaw in Kaseya VSA \<= v9.5.6 (CVSS 10.0, KEV)
- [CVE-2021-36367](https://cve.now/CVE-2021-36367.md): PuTTY through 0.75 proceeds with establishing an SSH session even if it has never sent a substantive authentication response. (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.