CVEs published July 15, 2021
83 CVEs were published on July 15, 2021: 2 critical, 25 high.
- Published
- 83
- Critical
- 2
- High
- 25
- Medium
- 23
- Low
- 3
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Juniper Networks Junos OS
- 15
- IBM Security Verify Access Docker
- 14
- D-Link DAP-1330
- 4
- Rancher · github.com/rancher/rancher
- 3
- Dell Wyse Management Suite
- 2
- icinga2
- 2
- Juniper Networks Junos OS Evolved
- 2
- bat
- 1
- discourse
- 1
- gatsbyjs gatsby · gatsby-source-wordpress
- 1
Critical 2
High 25
- CVE-2021-32764YouTube Onebox susceptible to XSSdiscourse
- CVE-2021-0286Junos OS Evolved: Specially crafted packets may cause the AFT manager process to crash and restartJuniper Networks Junos OS Evolved
- CVE-2021-0285Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact trafficJuniper Networks Junos OS
- CVE-2021-0283Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore)Juniper Networks Junos OS
- CVE-2021-0282Junos OS: RPD crash while processing a specific BGP UPDATE when Multipath or add-path features are enabledJuniper Networks Junos OS
- CVE-2021-0280Junos OS: PTX Series, QFX10K Series: Upon receipt of specific packets BFD sessions might flap due to DDoS policer implementation in Packet Forwarding EngineJuniper Networks Junos OS
- CVE-2021-0279Contrail Cloud: Hardcoded credentials for RabbitMQ serviceJuniper Networks Contrail Cloud
- CVE-2021-0278Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root.Juniper Networks Junos OS
- CVE-2021-0277Junos OS and Junos OS Evolved: LLDP Out-of-Bounds Read vulnerability in l2cpdJuniper Networks Junos OS
- CVE-2021-32770Basic-auth app bundle credential exposure in gatsby-source-wordpressgatsbyjs gatsby · gatsby-source-wordpress
- CVE-2021-34830This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouD-Link DAP-1330
- CVE-2021-34829This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouD-Link DAP-1330
- CVE-2021-34828This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouD-Link DAP-1330
- CVE-2021-34827This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rouD-Link DAP-1330
- CVE-2021-29742IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system.IBM Security Verify Access Docker
- CVE-2021-20533IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending IBM Security Verify Access Docker
- CVE-2021-3043Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web ConsolePalo Alto Networks Prisma Cloud Compute
- CVE-2021-3042Cortex XDR Agent: Improper Control of User-Controlled File Leads to Local Privilege EscalationPalo Alto Networks Cortex XDR Agent
- CVE-2021-21586Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability.Dell Wyse Management Suite
- CVE-2021-32743Passwords used to access external services inadvertently exposed through APIicinga2
- CVE-2021-29725IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to consIBM Secure External Authentication Server · IBM Secure Proxy
- CVE-2021-20439IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read bIBM Security Verify Access Docker · IBM Security Access Man…
- CVE-2021-32739Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identitiesicinga2
- CVE-2021-31999Rancher: Privilege escalation vulnerability via malicious Connection headerRancher · github.com/rancher/rancher
- CVE-2021-25318rancher: API group not properly specified when creating Kubernetes RBAC resourcesRancher · github.com/rancher/rancher
Medium, low and unrated 56
- CVE-2021-367581Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be us
- CVE-2021-36755Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.
- CVE-2020-23707A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 202
- CVE-2020-23706A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 20
- CVE-2020-23705A global buffer overflow vulnerability in jfif_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Servi
- CVE-2021-0295Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN.Juniper Networks Junos OS
- CVE-2021-0294Junos OS: QFX5000 Series and EX4600 Series: Enhanced storm control might not work leading to partial Denial of ServiceJuniper Networks Junos OS
- CVE-2021-0293Junos OS: Out-of-memory condition and crashes can occur after executing a certain CLI command repeatedlyJuniper Networks Junos OS
- CVE-2021-0292Junos OS Evolved: Memory leak in arpd or ndp processes can lead to Denial of Service (DoS)Juniper Networks Junos OS Evolved
- CVE-2021-0291Junos OS and Junos OS Evolved: A vulnerability allows a network based unauthenticated attacker which sends a high rate of specific traffic to cause a partial Denial of ServiceJuniper Networks Junos OS
- CVE-2021-0290Junos OS: MX Series, EX9200 Series, SRX4600: Ethernet interface vulnerable to specially crafted framesJuniper Networks Junos OS
- CVE-2021-0289Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restartedJuniper Networks Junos OS
- CVE-2021-0288Junos OS: MX Series, EX9200 Series: FPC may crash upon receipt of specific MPLS packet affecting Trio-based MPCsJuniper Networks Junos OS
- CVE-2021-0287Junos OS and Junos OS Evolved: RPD could crash in SR-ISIS/MPLS environment due to a flap of an ISIS link in the networkJuniper Networks Junos OS
- CVE-2021-0281Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKIJuniper Networks Junos OS
- CVE-2020-11634The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL.
- CVE-2020-11632The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code w
- CVE-2021-36753sharkdp BAT before 0.18.2 executes less.exe from the current working directory.bat
- CVE-2021-35056Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task.
- CVE-2021-29699IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could IBM Security Verify Access Docker
- CVE-2021-20537IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its ownIBM Security Verify Access Docker
- CVE-2021-20534IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Security Verify Access Docker
- CVE-2021-20524IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting.IBM Security Verify Access Docker
- CVE-2021-20523IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error messaIBM Security Verify Access Docker
- CVE-2021-20511IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system.IBM Security Verify Access Docker
- CVE-2021-20510IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user.IBM Security Verify Access Docker
- CVE-2021-20500IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user.IBM Security Verify Access Docker
- CVE-2021-20499IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error messaIBM Security Verify Access Docker
- CVE-2021-20498IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the systIBM Security Verify Access Docker
- CVE-2021-20497IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sIBM Security Verify Access Docker
- CVE-2021-20496IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation.IBM Security Verify Access Docker
- CVE-2020-11633The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers.
- CVE-2021-34429For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the conThe Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…
- CVE-2021-32750De-anonymization via messagezlatinb muwire
- CVE-2021-21587Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability.Dell Wyse Management Suite
- CVE-2021-29749IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF).IBM Secure Proxy · IBM Secure External Authentication Server
- CVE-2021-27845A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c
- CVE-2021-27847Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips_eye_point, eye.c#L83, and function vips_mask_point, mask.c#L85.
- CVE-2020-12732DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion_xxxxxxxx with a password of 12345678.
- CVE-2020-12733Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the
- CVE-2020-12734DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful de
- CVE-2020-12729MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors.
- CVE-2020-12730MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery.
- CVE-2020-12731The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read b
- CVE-2020-15495Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration.
- CVE-2020-25593Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions.
- CVE-2020-15496Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions.
- CVE-2021-34558The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expectestdlib
- CVE-2021-34692iDrive RemotePC before 7.6.48 on Windows allows privilege escalation.
- CVE-2021-34691iDrive RemotePC before 4.0.1 on Linux allows denial of service.
- CVE-2021-34690iDrive RemotePC before 7.6.48 on Windows allows authentication bypass.
- CVE-2021-34689iDrive RemotePC before 7.6.48 on Windows allows information disclosure.
- CVE-2021-34688iDrive RemotePC before 7.6.48 on Windows allows information disclosure.
- CVE-2021-34687iDrive RemotePC before 7.6.48 on Windows allows information disclosure.
- CVE-2021-33505A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls b
- CVE-2020-25736Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configurati