# CVEs published 2021-07-15

83 CVEs were published on July 15, 2021: 2 critical, 25 high. Days are UTC.

- [CVE-2021-36758](https://cve.now/CVE-2021-36758.md): 1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be us (no CVSS)
- [CVE-2021-36755](https://cve.now/CVE-2021-36755.md): Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header. (no CVSS)
- [CVE-2020-23707](https://cve.now/CVE-2020-23707.md): A heap-based buffer overflow vulnerability in the function ok\_jpg\_decode\_block\_progressive() at ok\_jpg.c:1054 of ok-file-formats through 202 (no CVSS)
- [CVE-2020-23706](https://cve.now/CVE-2020-23706.md): A heap-based buffer overflow vulnerability in the function ok\_jpg\_decode\_block\_subsequent\_scan() ok\_jpg.c:1102 of ok-file-formats through 20 (no CVSS)
- [CVE-2020-23705](https://cve.now/CVE-2020-23705.md): A global buffer overflow vulnerability in jfif\_encode at jfif.c:701 of ffjpeg through 2020-06-22 allows attackers to cause a Denial of Servi (no CVSS)
- [CVE-2021-32764](https://cve.now/CVE-2021-32764.md): YouTube Onebox susceptible to XSS (CVSS 8.1, discourse)
- [CVE-2021-0295](https://cve.now/CVE-2021-0295.md): Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN. (CVSS 6.1, Juniper Networks Junos OS)
- [CVE-2021-0294](https://cve.now/CVE-2021-0294.md): Junos OS: QFX5000 Series and EX4600 Series: Enhanced storm control might not work leading to partial Denial of Service (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2021-0293](https://cve.now/CVE-2021-0293.md): Junos OS: Out-of-memory condition and crashes can occur after executing a certain CLI command repeatedly (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2021-0292](https://cve.now/CVE-2021-0292.md): Junos OS Evolved: Memory leak in arpd or ndp processes can lead to Denial of Service (DoS) (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2021-0291](https://cve.now/CVE-2021-0291.md): Junos OS and Junos OS Evolved: A vulnerability allows a network based unauthenticated attacker which sends a high rate of specific traffic to cause a partial Denial of Service (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0290](https://cve.now/CVE-2021-0290.md): Junos OS: MX Series, EX9200 Series, SRX4600: Ethernet interface vulnerable to specially crafted frames (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0289](https://cve.now/CVE-2021-0289.md): Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0288](https://cve.now/CVE-2021-0288.md): Junos OS: MX Series, EX9200 Series: FPC may crash upon receipt of specific MPLS packet affecting Trio-based MPCs (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0287](https://cve.now/CVE-2021-0287.md): Junos OS and Junos OS Evolved: RPD could crash in SR-ISIS/MPLS environment due to a flap of an ISIS link in the network (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2021-0286](https://cve.now/CVE-2021-0286.md): Junos OS Evolved: Specially crafted packets may cause the AFT manager process to crash and restart (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2021-0285](https://cve.now/CVE-2021-0285.md): Junos OS: QFX5000 Series and EX4600 Series: Continuous traffic destined to a device configured with MC-LAG leading to nodes losing their control connection which can impact traffic (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0283](https://cve.now/CVE-2021-0283.md): Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore) (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0282](https://cve.now/CVE-2021-0282.md): Junos OS: RPD crash while processing a specific BGP UPDATE when Multipath or add-path features are enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0281](https://cve.now/CVE-2021-0281.md): Junos OS and Junos OS Evolved: Specific packets can trigger rpd crash when BGP Origin Validation is configured with RPKI (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2021-0280](https://cve.now/CVE-2021-0280.md): Junos OS: PTX Series, QFX10K Series: Upon receipt of specific packets BFD sessions might flap due to DDoS policer implementation in Packet Forwarding Engine (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-0279](https://cve.now/CVE-2021-0279.md): Contrail Cloud: Hardcoded credentials for RabbitMQ service (CVSS 8.6, Juniper Networks Contrail Cloud)
- [CVE-2021-0278](https://cve.now/CVE-2021-0278.md): Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root. (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2021-0277](https://cve.now/CVE-2021-0277.md): Junos OS and Junos OS Evolved: LLDP Out-of-Bounds Read vulnerability in l2cpd (CVSS 8.8, Juniper Networks Junos OS)
- [CVE-2021-0276](https://cve.now/CVE-2021-0276.md): Steel-Belted Radius Carrier Edition: Remote code execution vulnerability when EAP Authentication is configured. (CVSS 9.8, Juniper Networks SBR Carrier)
- [CVE-2020-11634](https://cve.now/CVE-2020-11634.md): The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. (no CVSS)
- [CVE-2020-11632](https://cve.now/CVE-2020-11632.md): The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code w (no CVSS)
- [CVE-2021-36753](https://cve.now/CVE-2021-36753.md): sharkdp BAT before 0.18.2 executes less.exe from the current working directory. (no CVSS, bat)
- [CVE-2021-32770](https://cve.now/CVE-2021-32770.md): Basic-auth app bundle credential exposure in gatsby-source-wordpress (CVSS 7.5, gatsbyjs gatsby · gatsby-source-wordpress)
- [CVE-2021-35056](https://cve.now/CVE-2021-35056.md): Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. (no CVSS)
- [CVE-2021-34830](https://cve.now/CVE-2021-34830.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rou (CVSS 8.8, D-Link DAP-1330)
- [CVE-2021-34829](https://cve.now/CVE-2021-34829.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rou (CVSS 8.8, D-Link DAP-1330)
- [CVE-2021-34828](https://cve.now/CVE-2021-34828.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rou (CVSS 8.8, D-Link DAP-1330)
- [CVE-2021-34827](https://cve.now/CVE-2021-34827.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA rou (CVSS 8.8, D-Link DAP-1330)
- [CVE-2021-29742](https://cve.now/CVE-2021-29742.md): IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. (CVSS 7.9, IBM Security Verify Access Docker)
- [CVE-2021-29699](https://cve.now/CVE-2021-29699.md): IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could (CVSS 6.6, IBM Security Verify Access Docker)
- [CVE-2021-20537](https://cve.now/CVE-2021-20537.md): IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own (CVSS 6.5, IBM Security Verify Access Docker)
- [CVE-2021-20534](https://cve.now/CVE-2021-20534.md): IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. (CVSS 4.5, IBM Security Verify Access Docker)
- [CVE-2021-20533](https://cve.now/CVE-2021-20533.md): IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending (CVSS 8.4, IBM Security Verify Access Docker)
- [CVE-2021-20524](https://cve.now/CVE-2021-20524.md): IBM Security Verify Access Docker 10.0.0 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Security Verify Access Docker)
- [CVE-2021-20523](https://cve.now/CVE-2021-20523.md): IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error messa (CVSS 2.7, IBM Security Verify Access Docker)
- [CVE-2021-20511](https://cve.now/CVE-2021-20511.md): IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. (CVSS 5.2, IBM Security Verify Access Docker)
- [CVE-2021-20510](https://cve.now/CVE-2021-20510.md): IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. (CVSS 6.8, IBM Security Verify Access Docker)
- [CVE-2021-20500](https://cve.now/CVE-2021-20500.md): IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. (CVSS 4.4, IBM Security Verify Access Docker)
- [CVE-2021-20499](https://cve.now/CVE-2021-20499.md): IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error messa (CVSS 2.7, IBM Security Verify Access Docker)
- [CVE-2021-20498](https://cve.now/CVE-2021-20498.md): IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the syst (CVSS 5.3, IBM Security Verify Access Docker)
- [CVE-2021-20497](https://cve.now/CVE-2021-20497.md): IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly s (CVSS 5.9, IBM Security Verify Access Docker)
- [CVE-2021-20496](https://cve.now/CVE-2021-20496.md): IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. (CVSS 2.7, IBM Security Verify Access Docker)
- [CVE-2020-11633](https://cve.now/CVE-2020-11633.md): The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. (no CVSS)
- [CVE-2021-34429](https://cve.now/CVE-2021-34429.md): For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con (CVSS 5.3, The Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:je…)
- [CVE-2021-3043](https://cve.now/CVE-2021-3043.md): Prisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web Console (CVSS 7.5, Palo Alto Networks Prisma Cloud Compute)
- [CVE-2021-3042](https://cve.now/CVE-2021-3042.md): Cortex XDR Agent: Improper Control of User-Controlled File Leads to Local Privilege Escalation (CVSS 7.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2021-32750](https://cve.now/CVE-2021-32750.md): De-anonymization via message (CVSS 6.8, zlatinb muwire)
- [CVE-2021-21587](https://cve.now/CVE-2021-21587.md): Dell Wyse Management Suite versions 3.2 and earlier contain a full path disclosure vulnerability. (CVSS 5.3, Dell Wyse Management Suite)
- [CVE-2021-21586](https://cve.now/CVE-2021-21586.md): Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. (CVSS 8.1, Dell Wyse Management Suite)
- [CVE-2021-32743](https://cve.now/CVE-2021-32743.md): Passwords used to access external services inadvertently exposed through API (CVSS 8.8, icinga2)
- [CVE-2021-29749](https://cve.now/CVE-2021-29749.md): IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 is vulnerable to server-side request forgery (SSRF). (CVSS 6.5, IBM Secure Proxy · IBM Secure External Authentication Server)
- [CVE-2021-29725](https://cve.now/CVE-2021-29725.md): IBM Secure External Authentication Server 2.4.3.2, 6.0.1, 6.0.2 and IBM Secure Proxy 3.4.3.2, 6.0.1, 6.0.2 could allow a remote user to cons (CVSS 7.5, IBM Secure External Authentication Server · IBM Secure Proxy)
- [CVE-2021-20439](https://cve.now/CVE-2021-20439.md): IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read b (CVSS 7.5, IBM Security Verify Access Docker · IBM Security Access Man…)
- [CVE-2021-27845](https://cve.now/CVE-2021-27845.md): A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc\_enc.c (no CVSS)
- [CVE-2021-27847](https://cve.now/CVE-2021-27847.md): Division-By-Zero vulnerability in Libvips 8.10.5 in the function vips\_eye\_point, eye.c#L83, and function vips\_mask\_point, mask.c#L85. (no CVSS)
- [CVE-2020-12732](https://cve.now/CVE-2020-12732.md): DEPSTECH WiFi Digital Microscope 3 has a default SSID of Jetion\_xxxxxxxx with a password of 12345678. (no CVSS)
- [CVE-2020-12733](https://cve.now/CVE-2020-12733.md): Certain Shenzhen PENGLIXIN components on DEPSTECH WiFi Digital Microscope 3, as used by Shekar Endoscope, allow a TELNET connection with the (no CVSS)
- [CVE-2020-12734](https://cve.now/CVE-2020-12734.md): DEPSTECH WiFi Digital Microscope 3 allows remote attackers to change the SSID and password, and demand a ransom payment from the rightful de (no CVSS)
- [CVE-2020-12729](https://cve.now/CVE-2020-12729.md): MagicMotion Flamingo 2 has a lack of access control for reading from device descriptors. (no CVSS)
- [CVE-2020-12730](https://cve.now/CVE-2020-12730.md): MagicMotion Flamingo 2 lacks BLE encryption, enabling data sniffing and packet forgery. (no CVSS)
- [CVE-2020-12731](https://cve.now/CVE-2020-12731.md): The MagicMotion Flamingo 2 application for Android stores data on an sdcard under com.vt.magicmotion/files/Pictures, whence it can be read b (no CVSS)
- [CVE-2021-32739](https://cve.now/CVE-2021-32739.md): Results of queries for ApiListener objects include the ticket salt which allows in turn to steal (more privileged) identities (CVSS 8.8, icinga2)
- [CVE-2020-15495](https://cve.now/CVE-2020-15495.md): Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration. (no CVSS)
- [CVE-2020-25593](https://cve.now/CVE-2020-25593.md): Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. (no CVSS)
- [CVE-2020-15496](https://cve.now/CVE-2020-15496.md): Acronis True Image for Mac before 2021 Update 4 allowed local privilege escalation due to insecure folder permissions. (no CVSS)
- [CVE-2021-34558](https://cve.now/CVE-2021-34558.md): The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expecte (no CVSS, stdlib)
- [CVE-2021-34692](https://cve.now/CVE-2021-34692.md): iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. (no CVSS)
- [CVE-2021-34691](https://cve.now/CVE-2021-34691.md): iDrive RemotePC before 4.0.1 on Linux allows denial of service. (no CVSS)
- [CVE-2021-34690](https://cve.now/CVE-2021-34690.md): iDrive RemotePC before 7.6.48 on Windows allows authentication bypass. (no CVSS)
- [CVE-2021-34689](https://cve.now/CVE-2021-34689.md): iDrive RemotePC before 7.6.48 on Windows allows information disclosure. (no CVSS)
- [CVE-2021-34688](https://cve.now/CVE-2021-34688.md): iDrive RemotePC before 7.6.48 on Windows allows information disclosure. (no CVSS)
- [CVE-2021-34687](https://cve.now/CVE-2021-34687.md): iDrive RemotePC before 7.6.48 on Windows allows information disclosure. (no CVSS)
- [CVE-2021-33505](https://cve.now/CVE-2021-33505.md): A local malicious user can circumvent the Falco detection engine through 0.28.1 by running a program that alters arguments of system calls b (no CVSS)
- [CVE-2021-31999](https://cve.now/CVE-2021-31999.md): Rancher: Privilege escalation vulnerability via malicious Connection header (CVSS 8.8, Rancher · github.com/rancher/rancher)
- [CVE-2021-25320](https://cve.now/CVE-2021-25320.md): Rancher: Cloud credentials can be used through proxy API by users without access (CVSS 9.9, Rancher · github.com/rancher/rancher)
- [CVE-2021-25318](https://cve.now/CVE-2021-25318.md): rancher: API group not properly specified when creating Kubernetes RBAC resources (CVSS 8.8, Rancher · github.com/rancher/rancher)
- [CVE-2020-25736](https://cve.now/CVE-2020-25736.md): Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configurati (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.