# CVEs published 2021-07-14

172 CVEs were published on July 14, 2021: 3 critical, 70 high. 7 are now in CISA KEV. Days are UTC.

- [CVE-2020-36420](https://cve.now/CVE-2020-36420.md): Polipo through 1.1.1, when NDEBUG is omitted, allows denial of service via a reachable assertion during parsing of a malformed Range header. (no CVSS)
- [CVE-2020-24133](https://cve.now/CVE-2020-24133.md): A heap buffer overflow vulnerability in the r\_asm\_swf\_disass function of Radare2-extras before commit e74a93c allows attackers to execute ar (no CVSS)
- [CVE-2021-35211](https://cve.now/CVE-2021-35211.md): Serv-U Remote Memory Escape Vulnerability (CVSS 9.0, KEV, SolarWinds Serv-U Managed File Transfer Server and Serv-U S…)
- [CVE-2021-22867](https://cve.now/CVE-2021-22867.md): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2020-29157](https://cve.now/CVE-2020-29157.md): An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. (no CVSS)
- [CVE-2020-18155](https://cve.now/CVE-2020-18155.md): SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. (no CVSS, intelliants/subrion)
- [CVE-2021-34174](https://cve.now/CVE-2021-34174.md): A vulnerability exists in Broadcom BCM4352 and BCM43684 chips. (no CVSS)
- [CVE-2021-34173](https://cve.now/CVE-2021-34173.md): An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. (no CVSS)
- [CVE-2020-18151](https://cve.now/CVE-2020-18151.md): Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. (no CVSS, thinkcmf/thinkcmf)
- [CVE-2021-34529](https://cve.now/CVE-2021-34529.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34528](https://cve.now/CVE-2021-34528.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34525](https://cve.now/CVE-2021-34525.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2021-34523](https://cve.now/CVE-2021-34523.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 9.0, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34522](https://cve.now/CVE-2021-34522.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2021-34521](https://cve.now/CVE-2021-34521.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34520](https://cve.now/CVE-2021-34520.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-34519](https://cve.now/CVE-2021-34519.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server 2013 Service Pack… +1)
- [CVE-2021-34518](https://cve.now/CVE-2021-34518.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel 2013 Service Pack · Microsoft Excel +1)
- [CVE-2021-34517](https://cve.now/CVE-2021-34517.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server 2013 Service Pack… +2)
- [CVE-2021-34516](https://cve.now/CVE-2021-34516.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34514](https://cve.now/CVE-2021-34514.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34513](https://cve.now/CVE-2021-34513.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34512](https://cve.now/CVE-2021-34512.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34511](https://cve.now/CVE-2021-34511.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34510](https://cve.now/CVE-2021-34510.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34509](https://cve.now/CVE-2021-34509.md): Storage Spaces Controller Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34508](https://cve.now/CVE-2021-34508.md): Windows Kernel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-34507](https://cve.now/CVE-2021-34507.md): Windows Remote Assistance Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-34504](https://cve.now/CVE-2021-34504.md): Windows Address Book Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34503](https://cve.now/CVE-2021-34503.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34501](https://cve.now/CVE-2021-34501.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2021-34500](https://cve.now/CVE-2021-34500.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2021-34499](https://cve.now/CVE-2021-34499.md): Windows DNS Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-34498](https://cve.now/CVE-2021-34498.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34497](https://cve.now/CVE-2021-34497.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-34496](https://cve.now/CVE-2021-34496.md): Windows GDI Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34494](https://cve.now/CVE-2021-34494.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-34493](https://cve.now/CVE-2021-34493.md): Windows Partition Management Driver Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2021-34492](https://cve.now/CVE-2021-34492.md): Windows Certificate Spoofing Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-34491](https://cve.now/CVE-2021-34491.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-34490](https://cve.now/CVE-2021-34490.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-34489](https://cve.now/CVE-2021-34489.md): DirectWrite Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34488](https://cve.now/CVE-2021-34488.md): Windows Console Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34479](https://cve.now/CVE-2021-34479.md): Microsoft Visual Studio Spoofing Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-34477](https://cve.now/CVE-2021-34477.md): Visual Studio Code .NET Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET Education Bundle SDK Install Tool · Microsof…)
- [CVE-2021-34476](https://cve.now/CVE-2021-34476.md): Bowser.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-34474](https://cve.now/CVE-2021-34474.md): Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Dynamics 365 Business Central 2020 Release Wav… +1)
- [CVE-2021-34473](https://cve.now/CVE-2021-34473.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 9.1, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34470](https://cve.now/CVE-2021-34470.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-34469](https://cve.now/CVE-2021-34469.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +1)
- [CVE-2021-34468](https://cve.now/CVE-2021-34468.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-33788](https://cve.now/CVE-2021-33788.md): Windows LSA Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33786](https://cve.now/CVE-2021-33786.md): Windows LSA Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33785](https://cve.now/CVE-2021-33785.md): Windows AF\_UNIX Socket Provider Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33784](https://cve.now/CVE-2021-33784.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33783](https://cve.now/CVE-2021-33783.md): Windows SMB Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-33782](https://cve.now/CVE-2021-33782.md): Windows Authenticode Spoofing Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33781](https://cve.now/CVE-2021-33781.md): Azure AD Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-33780](https://cve.now/CVE-2021-33780.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33779](https://cve.now/CVE-2021-33779.md): Windows AD FS Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2021-33778](https://cve.now/CVE-2021-33778.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33777](https://cve.now/CVE-2021-33777.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33776](https://cve.now/CVE-2021-33776.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33775](https://cve.now/CVE-2021-33775.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-33774](https://cve.now/CVE-2021-33774.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-33773](https://cve.now/CVE-2021-33773.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33772](https://cve.now/CVE-2021-33772.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-33771](https://cve.now/CVE-2021-33771.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-33768](https://cve.now/CVE-2021-33768.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2021-33767](https://cve.now/CVE-2021-33767.md): Open Enclave SDK Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Open Enclave SDK)
- [CVE-2021-33766](https://cve.now/CVE-2021-33766.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 7.3, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-33765](https://cve.now/CVE-2021-33765.md): Windows Installer Spoofing Vulnerability (CVSS 6.2, Microsoft Windows)
- [CVE-2021-33764](https://cve.now/CVE-2021-33764.md): Windows Key Distribution Center Information Disclosure Vulnerability (CVSS 5.9, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33763](https://cve.now/CVE-2021-33763.md): Windows Remote Access Connection Manager Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33761](https://cve.now/CVE-2021-33761.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33760](https://cve.now/CVE-2021-33760.md): Media Foundation Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-33759](https://cve.now/CVE-2021-33759.md): Windows Desktop Bridge Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33758](https://cve.now/CVE-2021-33758.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 7.7, Microsoft Windows)
- [CVE-2021-33757](https://cve.now/CVE-2021-33757.md): Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2021-33756](https://cve.now/CVE-2021-33756.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33755](https://cve.now/CVE-2021-33755.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.3, Microsoft Windows)
- [CVE-2021-33754](https://cve.now/CVE-2021-33754.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33753](https://cve.now/CVE-2021-33753.md): Microsoft Bing Search Spoofing Vulnerability (CVSS 4.7, Microsoft Bing Search for Android)
- [CVE-2021-33752](https://cve.now/CVE-2021-33752.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33751](https://cve.now/CVE-2021-33751.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-33750](https://cve.now/CVE-2021-33750.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33749](https://cve.now/CVE-2021-33749.md): Windows DNS Snap-in Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-33746](https://cve.now/CVE-2021-33746.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33745](https://cve.now/CVE-2021-33745.md): Windows DNS Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-33744](https://cve.now/CVE-2021-33744.md): Windows Secure Kernel Mode Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2021-33743](https://cve.now/CVE-2021-33743.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-33740](https://cve.now/CVE-2021-33740.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-31984](https://cve.now/CVE-2021-31984.md): Power BI Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Power BI Desktop)
- [CVE-2021-31979](https://cve.now/CVE-2021-31979.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-31961](https://cve.now/CVE-2021-31961.md): Windows InstallService Elevation of Privilege Vulnerability (CVSS 6.1, Microsoft Windows)
- [CVE-2021-31947](https://cve.now/CVE-2021-31947.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-31206](https://cve.now/CVE-2021-31206.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.6, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-31196](https://cve.now/CVE-2021-31196.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 7.2, KEV, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-31183](https://cve.now/CVE-2021-31183.md): Windows TCP/IP Driver Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2020-18145](https://cve.now/CVE-2020-18145.md): Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. (no CVSS)
- [CVE-2020-18144](https://cve.now/CVE-2020-18144.md): SQL Injection Vulnerability in ECTouch v2 via the integral\_min parameter in index.php. (no CVSS)
- [CVE-2021-23407](https://cve.now/CVE-2021-23407.md): Directory Traversal (CVSS 7.5, elFinder.Net.Core)
- [CVE-2021-31859](https://cve.now/CVE-2021-31859.md): Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the exec (no CVSS)
- [CVE-2020-29147](https://cve.now/CVE-2020-29147.md): A SQL injection vulnerability in wy\_controlls/wy\_side\_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database informati (no CVSS)
- [CVE-2020-29146](https://cve.now/CVE-2020-29146.md): A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a c (no CVSS)
- [CVE-2021-36740](https://cve.now/CVE-2021-36740.md): Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST reque (no CVSS)
- [CVE-2021-36716](https://cve.now/CVE-2021-36716.md): A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. (no CVSS, is-email)
- [CVE-2020-25445](https://cve.now/CVE-2020-25445.md): The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. (no CVSS)
- [CVE-2020-27379](https://cve.now/CVE-2020-27379.md): Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . (no CVSS)
- [CVE-2020-25444](https://cve.now/CVE-2020-25444.md): Cross Site Scripting (XSS) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 via the (1) "About Yourself” section u (no CVSS)
- [CVE-2021-22782](https://cve.now/CVE-2021-22782.md): Missing Encryption of Sensitive Data vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22781](https://cve.now/CVE-2021-22781.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22780](https://cve.now/CVE-2021-22780.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22779](https://cve.now/CVE-2021-22779.md): Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all version (CVSS 6.5, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-22778](https://cve.now/CVE-2021-22778.md): Insufficiently Protected Credentials vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all vers (no CVSS, EcoStruxure Control Expert (all versions prior to V15.0 SP1…)
- [CVE-2021-0654](https://cve.now/CVE-2021-0654.md): In isRealSnapshot of TaskThumbnailView.java, there is possible data exposure due to a missing permission check. (no CVSS, Android)
- [CVE-2020-20231](https://cve.now/CVE-2020-20231.md): Mikrotik RouterOs through stable version 6.48.3 suffers from a memory corruption vulnerability in the /nova/bin/detnet process. (no CVSS)
- [CVE-2021-0592](https://cve.now/CVE-2021-0592.md): In various functions in WideVine, there are possible out of bounds writes due to improper input validation. (no CVSS, Android)
- [CVE-2021-33211](https://cve.now/CVE-2021-33211.md): A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write file (no CVSS)
- [CVE-2021-0577](https://cve.now/CVE-2021-0577.md): In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0587](https://cve.now/CVE-2021-0587.md): In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0585](https://cve.now/CVE-2021-0585.md): In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2021-0603](https://cve.now/CVE-2021-0603.md): In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overl (no CVSS, Android)
- [CVE-2021-0586](https://cve.now/CVE-2021-0586.md): In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacki (no CVSS, Android)
- [CVE-2021-0596](https://cve.now/CVE-2021-0596.md): In phNciNfc\_RecvMfResp of phNxpExtns\_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0589](https://cve.now/CVE-2021-0589.md): In BTM\_TryAllocateSCN of btm\_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0601](https://cve.now/CVE-2021-0601.md): In encodeFrames of avc\_enc\_fuzzer.cpp, there is a possible out of bounds write due to a double free. (no CVSS, Android)
- [CVE-2021-0604](https://cve.now/CVE-2021-0604.md): In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due to a confused deputy (no CVSS, Android)
- [CVE-2021-0600](https://cve.now/CVE-2021-0600.md): In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validatio (no CVSS, Android)
- [CVE-2021-0602](https://cve.now/CVE-2021-0602.md): In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all (no CVSS, Android)
- [CVE-2021-0588](https://cve.now/CVE-2021-0588.md): In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0518](https://cve.now/CVE-2021-0518.md): In Wi-Fi, there is a possible leak of location-sensitive data due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0597](https://cve.now/CVE-2021-0597.md): In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing pe (no CVSS, Android)
- [CVE-2021-0594](https://cve.now/CVE-2021-0594.md): In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. (no CVSS, Android)
- [CVE-2021-0599](https://cve.now/CVE-2021-0599.md): In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to (no CVSS, Android)
- [CVE-2021-33212](https://cve.now/CVE-2021-33212.md): A Cross-site scripting (XSS) vulnerability in the "View in Browser" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated (no CVSS)
- [CVE-2021-0590](https://cve.now/CVE-2021-0590.md): In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID withou (no CVSS, Android)
- [CVE-2021-0441](https://cve.now/CVE-2021-0441.md): In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. (no CVSS, Android)
- [CVE-2021-0486](https://cve.now/CVE-2021-0486.md): In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-0515](https://cve.now/CVE-2021-0515.md): In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0514](https://cve.now/CVE-2021-0514.md): In several functions of the V8 library, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2020-0417](https://cve.now/CVE-2020-0417.md): In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. (no CVSS, Android)
- [CVE-2021-33213](https://cve.now/CVE-2021-33213.md): An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTT (no CVSS)
- [CVE-2019-11098](https://cve.now/CVE-2019-11098.md): Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privilege, deni (no CVSS, Tianocore)
- [CVE-2021-0144](https://cve.now/CVE-2021-0144.md): Insecure default variable initialization for the Intel BSSA DFT feature may allow a privileged user to potentially enable an escalation of p (no CVSS, Intel BSSA DFTrs)
- [CVE-2021-35527](https://cve.now/CVE-2021-35527.md): Password Autocomplete Vulnerability in Hitachi ABB Power Grids eSOMS Application (CVSS 7.5, Hitachi ABB Power Grids eSOMS)
- [CVE-2021-24117](https://cve.now/CVE-2021-24117.md): In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attacker (no CVSS)
- [CVE-2021-24116](https://cve.now/CVE-2021-24116.md): In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain i (no CVSS)
- [CVE-2021-35469](https://cve.now/CVE-2021-35469.md): The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry (no CVSS)
- [CVE-2021-33682](https://cve.now/CVE-2021-33682.md): SAP Lumira Server version 2.4 does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. (CVSS 5.4, SAP SE SAP Lumira Server)
- [CVE-2021-33687](https://cve.now/CVE-2021-33687.md): SAP NetWeaver AS JAVA (Enterprise Portal), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50 reveals sensitive information in one of their HTTP (CVSS 4.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-33683](https://cve.now/CVE-2021-33683.md): SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22 (CVSS 5.4, SAP SE SAP Web Dispatcher and Internet Communication Manager)
- [CVE-2021-33689](https://cve.now/CVE-2021-33689.md): When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator (Administrator applications), version (CVSS 3.5, SAP SE SAP NetWeaver AS JAVA)
- [CVE-2021-33684](https://cve.now/CVE-2021-33684.md): SAP NetWeaver AS ABAP and ABAP Platform, versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC (CVSS 5.3, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-33678](https://cve.now/CVE-2021-33678.md): A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A (CVSS 6.5, SAP SE SAP NetWeaver AS ABAP)
- [CVE-2021-33670](https://cve.now/CVE-2021-33670.md): SAP NetWeaver AS for Java (Http Service Monitoring Filter), versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker to send (CVSS 7.5, SAP SE SAP NetWeaver AS for Java)
- [CVE-2021-33681](https://cve.now/CVE-2021-33681.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes out of (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-33677](https://cve.now/CVE-2021-33677.md): SAP NetWeaver ABAP Server and ABAP Platform, versions - 700, 702, 730, 731, 804, 740, 750, 784, expose functions to external which can lead (CVSS 6.5, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-33676](https://cve.now/CVE-2021-33676.md): A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to com (CVSS 6.8, SAP SE SAP CRM)
- [CVE-2021-33680](https://cve.now/CVE-2021-33680.md): SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated CGM file received from untrusted sources which causes buffer (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-33671](https://cve.now/CVE-2021-33671.md): SAP NetWeaver Guided Procedures (Administration Workset), versions - 7.10, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authoriz (CVSS 7.6, SAP SE SAP NetWeaver Guided Procedures)
- [CVE-2021-33667](https://cve.now/CVE-2021-33667.md): Under certain conditions, SAP Business Objects Web Intelligence (BI Launchpad) versions - 420, 430, allows an attacker to access jsp source (CVSS 4.3, SAP SE SAP Business Objects Web Intelligence)
- [CVE-2021-22318](https://cve.now/CVE-2021-22318.md): A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. (no CVSS, HarmonyOS)
- [CVE-2021-25953](https://cve.now/CVE-2021-25953.md): Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to (no CVSS, putil-merge)
- [CVE-2021-36374](https://cve.now/CVE-2021-36374.md): Apache Ant ZIP, and ZIP based, archive denial of service vulerability (no CVSS, Apache Software Foundation Apache Ant · org.apache.ant:ant)
- [CVE-2021-36373](https://cve.now/CVE-2021-36373.md): Apache Ant TAR archive denial of service vulnerability (no CVSS, Apache Software Foundation Apache Ant · org.apache.ant:ant)
- [CVE-2021-20784](https://cve.now/CVE-2021-20784.md): HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an (CVSS 6.1, voidtools Everything)
- [CVE-2021-20782](https://cve.now/CVE-2021-20782.md): Cross-site request forgery (CSRF) vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the au (no CVSS, Tips and Tricks HQ Software License Manager)
- [CVE-2021-20781](https://cve.now/CVE-2021-20781.md): Cross-site request forgery (CSRF) vulnerability in WordPress Meta Data Filter & Taxonomies Filter versions prior to v.1.2.8 and versions pri (no CVSS, realmag777 WordPress Meta Data Filter & Taxonomies Filter)
- [CVE-2021-20748](https://cve.now/CVE-2021-20748.md): Retty App for Android versions prior to 4.8.13 and Retty App for iOS versions prior to 4.11.14 uses a hard-coded API key for an external ser (no CVSS, Retty App)
- [CVE-2021-20747](https://cve.now/CVE-2021-20747.md): Improper authorization in handler for custom URL scheme vulnerability in Retty App for Android versions prior to 4.8.13 and Retty App for iO (no CVSS, Retty App)
- [CVE-2021-24119](https://cve.now/CVE-2021-24119.md): In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.