CVEs published July 12, 2021
88 CVEs were published on July 12, 2021: 2 critical, 7 high.
- Published
- 88
- Critical
- 2
- High
- 7
- Medium
- 25
- Low
- 6
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- nextcloud security-advisories
- 14
- Fortinet FortiMail
- 4
- IBM Tivoli Netcool/OMNIbus
- 4
- Dell Unity
- 3
- Apache Software Foundation Apache Tomcat · tomcat +1
- 2
- https://github.com/brave/brave-core
- 2
- icingaweb2
- 2
- Jeff Starr Prismatic
- 2
- NodeJS Node
- 2
- Sign-up Sheets
- 2
Critical 2
High 7
- CVE-2021-32726Webauthn tokens not removed after user has been deletednextcloud security-advisories
- CVE-2021-32689Nextcloud Talk not properly disassociating users from chats after account deletionnextcloud security-advisories
- CVE-2021-32688Application specific tokens can change their own scopenextcloud security-advisories
- CVE-2020-7872DaviewIndy v8.98.7.0 and earlier versions have a Integer overflow vulnerability, triggered when the user opens a malformed format file that HumanTalk DaviewIndy
- CVE-2021-24013Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to fFortinet FortiMail
- CVE-2021-24015An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4Fortinet FortiMail
- CVE-2021-26088An improper authentication vulnerability in FSSO Collector version 5.0.295 and below may allow an unauthenticated user to bypass a FSSO fireFortinet FSSO Windows DC Agent, FSSO Windows CA
Medium, low and unrated 79
- CVE-2021-32754Improper Restriction of XML External Entity Reference in de.tud.ssesecure-software-engineering FlowDroid
- CVE-2021-32747Custom variable protection and blacklists can be circumventedicingaweb2
- CVE-2021-32746Possible path traversal by use of the `doc` moduleicingaweb2
- CVE-2021-32741Lack of ratelimit on public share link mount endpointnextcloud security-advisories
- CVE-2021-32734File path disclosure of shared files in Nextcloud Text applicationnextcloud security-advisories
- CVE-2021-32733XSS in Nextcloud Text applicationnextcloud security-advisories
- CVE-2021-32727End-to-end encryption device setup did not verify public keynextcloud security-advisories
- CVE-2020-18544SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php".
- CVE-2021-32725Default share permissions not respected for federated resharesnextcloud security-advisories
- CVE-2021-24454YOP Poll < 6.2.8 - Stored Cross-Site ScriptingYOP Poll
- CVE-2021-24442Poll, Survey, Questionnaire and Voting system < 1.5.3 - Unauthenticated Blind SQL Injectionwpdevart Poll, Survey, Questionnaire and Voting system
- CVE-2021-24441Sign-up Sheets < 1.0.14 - Authenticated CSV InjectionSign-up Sheets
- CVE-2021-24440Sign-up Sheets < 1.0.14 - Authenticated Stored Cross-Site Scripting (XSS)Sign-up Sheets
- CVE-2021-24439Browser Screenshots < 1.7.6 - Contributor+ Stored XSSBrowser Screenshots
- CVE-2021-24434Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)Glass
- CVE-2021-24429Salon Booking System < 6.3.1 - Unauthenticated Stored Cross-Site Scripting (XSS)Salon booking system
- CVE-2021-24426Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)Backup by 10Web – Backup and Restore Plugin
- CVE-2021-24427W3 Total Cache < 2.1.3 - Authenticated Stored XSSBoldGrid W3 Total Cache
- CVE-2021-24424WP Reset < 1.90 - Authenticated Stored XSSWP Reset – Most Advanced WordPress Reset Tool
- CVE-2021-24421WP JobSearch < 1.7.4 - Authenticated Stored XSSWP JobSearch
- CVE-2021-24420Request a Quote < 2.3.4 - Authenticated Stored XSSRequest a Quote
- CVE-2021-24419WP YouTube Lyte < 1.7.16 - Authenticated Stored XSSWP YouTube Lyte
- CVE-2021-24418Smooth Scroll Page Up/Down Buttons <= 1.4 - Authenticated Stored XSS via psb_positioningMark Senff Smooth Scroll Page Up/Down Buttons
- CVE-2021-24409Prismatic < 2.8 - Reflected Cross-Site Scripting (XSS)Jeff Starr Prismatic
- CVE-2021-24408Prismatic < 2.8 - Contributor+ Stored XSSJeff Starr Prismatic
- CVE-2021-24385Filebird 4.7.3 - Unauthenticated SQL InjectionNinja Team FileBird – WordPress Media Library Folders & Fil…
- CVE-2021-24365Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom FieldAdminColumns Admin Columns
- CVE-2020-19907A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command o
- CVE-2021-32707Bypass of image blocking in Nextcloud Mailnextcloud security-advisories
- CVE-2020-19038File Deletion vulnerability in Halo 0.4.3 via delBackup.
- CVE-2020-19037Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookie
- CVE-2020-23079SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
- CVE-2020-18982Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
- CVE-2021-29822IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting.IBM Tivoli Netcool/OMNIbus
- CVE-2021-29805IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting.IBM Tivoli Netcool/OMNIbus
- CVE-2021-29804IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting.IBM Tivoli Netcool/OMNIbus
- CVE-2021-29803IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting.IBM Tivoli Netcool/OMNIbus
- CVE-2021-29794IBM Tivoli Netcool/Impact 7.1.0.20 and 7.1.0.21 uses an insecure SSH server configuration which enables weaker than expected cryptographic aIBM Tivoli Netcool Impact
- CVE-2021-29792IBM Event Streams 10.0, 10.1, 10.2, and 10.3 could allow a user the CA private key to create their own certificates and deploy them in the cIBM Event Streams
- CVE-2021-20414IBM Guardium Data Encryption (GDE) 3.0.0.2 could allow a user to bruce force sensitive information due to not properly limiting the number oIBM Guardium Data Encryption
- CVE-2020-4938IBM MQ Appliance 9.1 and 9.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorizedIBM MQ Appliance
- CVE-2020-19201A Stored Cross-Site Scripting (XSS) vulnerability was found in status_filter_reload.php, a page in the pfSense software WebGUI, on Netgate p
- CVE-2021-36381In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?
- CVE-2021-21591Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability.Dell Unity
- CVE-2021-21590Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability.Dell Unity
- CVE-2021-21589Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed Initialization.Dell Unity
- CVE-2021-21588Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI.Dell PowerFlex
- CVE-2020-19203An authenticated Cross-Site Scripting (XSS) vulnerability was found in widgets/widgets/wake_on_lan_widget.php, a component of the pfSense so
- CVE-2021-32705Lack of ratelimit on public DAV endpointnextcloud security-advisories
- CVE-2021-32703Lack of ratelimit on shareinfo endpointnextcloud security-advisories
- CVE-2020-19204An authenticated Stored Cross-Site Scriptiong (XSS) vulnerability exists in Lightning Wire Labs IPFire 2.21 (x86_64) - Core Update 130 in th
- CVE-2020-18980Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.
- CVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.0Apache Software Foundation Apache Tomcat · tomcat +1
- CVE-2021-30640Auth weakness in JNDIRealmApache Software Foundation Apache Tomcat · tomcat +1
- CVE-2021-30639DoS after non-blocking IO errorApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2021-33807Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData.
- CVE-2020-18979Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
- CVE-2021-32680Audit log is not properly logging unsetting of share expiration datenextcloud security-advisories
- CVE-2021-36383Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resoxo-web · xo-server
- CVE-2021-36382Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack aga
- CVE-2021-26090A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2Fortinet FortiMail
- CVE-2021-32679Filenames not escaped by default in controllers using DownloadResponsenextcloud security-advisories
- CVE-2021-26089An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell Fortinet FortiClientMac
- CVE-2020-21133SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
- CVE-2020-21132SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
- CVE-2020-21131SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.
- CVE-2021-32678Ratelimit not applied on OCS API responsesnextcloud security-advisories
- CVE-2021-36377Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.
- CVE-2021-30129DoS/OOM leak vulnerability in Apache Mina SSHD ServerApache Software Foundation Apache Mina SSHD · org.apache… +1
- CVE-2021-35064KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo.
- CVE-2021-35037Jamf Pro before 10.30.1 allows for an unvalidated URL redirect vulnerability affecting Jamf Pro customers who host their environments on-pre
- CVE-2021-27293RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when convertinRestSharp
- CVE-2021-3547OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unreOpenVPN 3 Core Library
- CVE-2021-22917Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowihttps://github.com/brave/brave-core
- CVE-2021-22916In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblockhttps://github.com/brave/brave-core
- CVE-2021-22921Node.js before 16.4.1, 14.17.2, and 12.22.2 is vulnerable to local privilege escalation attacks under certain conditions on Windows platformNodeJS Node
- CVE-2021-22515Multi-Factor Authentication (MFA) downgrade exposure in NetIQ Advanced Authentication ServerMicro Focus NetIQ Advanced Authentication
- CVE-2021-26099Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possessionFortinet FortiMail
- CVE-2021-22918Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uv__idna_toascii() is used to convert strings to ASCII.NodeJS Node