CVEs published July 19, 2021
61 CVEs were published on July 19, 2021: 5 critical, 4 high.
- Published
- 61
- Critical
- 5
- High
- 4
- Medium
- 12
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Learningdigital.com Orca HCM
- 6
- Dell OpenManage Enterprise
- 3
- Manage Engine Asset Explorer Agent
- 3
- xlsx · org.webjars.npm:xlsx
- 3
- Aruba Instant Access Points
- 2
- BoldGrid W3 Total Cache
- 2
- Dell PowerStore
- 2
- IBM Engineering Workflow Management · IBM Rational Team… +4
- 2
- containerd · github.com/containerd/containerd
- 1
- Dell EMC Repository Manager
- 1
Critical 5
- CVE-2020-5349Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability.Dell Networking
- CVE-2020-5322Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability.Dell OpenManage Enterprise Modular
- CVE-2020-5320Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQLDell OpenManage Enterprise
- CVE-2021-35965Learningdigital.com, Inc. Orca HCM - Hard-code passwordLearningdigital.com Orca HCM
- CVE-2021-35963Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous TypeLearningdigital.com Orca HCM
High 4
- CVE-2020-5321Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an imDell OpenManage Enterprise
- CVE-2020-5315Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability.Dell EMC Repository Manager
- CVE-2021-29707IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a reIBM Power HMC
- CVE-2021-35964Learningdigital.com, Inc. Orca HCM - Broken AuthenticationLearningdigital.com Orca HCM
Medium, low and unrated 52
- CVE-2021-32773Confused deputy attack in sandbox module resolutionracket
- CVE-2020-5323Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an inDell OpenManage Enterprise
- CVE-2020-29503Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability.Dell PowerStore
- CVE-2020-29499Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment .Dell PowerStore
- CVE-2021-3135An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress.
- CVE-2021-31590PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control.
- CVE-2021-34618A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InstantAruba Instant Access Points
- CVE-2021-34617A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba InstAruba Instant Access Points
- CVE-2020-22741An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after obtaining the partia
- CVE-2020-20248Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process.
- CVE-2020-20249Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process.
- CVE-2021-34821Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2.
- CVE-2021-34820Web Path Directory Traversal in the Novus HTTP Server.
- CVE-2020-22650A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the o
- CVE-2021-34675Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports.
- CVE-2021-34676Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation.
- CVE-2021-36799KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project i
- CVE-2021-36797In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device.
- CVE-2020-20230Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process.
- CVE-2021-29780IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to dueIBM Resilient OnPrem
- CVE-2021-20507IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Rational Team… +4
- CVE-2020-5031IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting.IBM Engineering Workflow Management · IBM Rational Team… +4
- CVE-2020-36427GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image.
- CVE-2021-35043OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected).org.owasp.antisamy:antisamy
- CVE-2021-20110Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure theiManage Engine Asset Explorer Agent
- CVE-2021-20108Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server.Manage Engine Asset Explorer Agent
- CVE-2021-20109Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to mManage Engine Asset Explorer Agent
- CVE-2021-35449The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1
- CVE-2021-34817A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML b
- CVE-2021-32014SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is xlsx · org.webjars.npm:xlsx
- CVE-2021-32013SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that xlsx · org.webjars.npm:xlsx
- CVE-2021-32012SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that xlsx · org.webjars.npm:xlsx
- CVE-2021-31216Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by
- CVE-2021-3279sz.chat version 4 allows injection of web scripts and HTML in the message box.
- CVE-2021-35968Learningdigital.com, Inc. Orca HCM - Path Traversal-2Learningdigital.com Orca HCM
- CVE-2021-35967Learningdigital.com, Inc. Orca HCM - Path Traversal-1Learningdigital.com Orca HCM
- CVE-2021-35966Learningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect')Learningdigital.com Orca HCM
- CVE-2021-33027Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce.
- CVE-2021-33501Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL.
- CVE-2021-24482Related Posts for WordPress <= 2.0.4 - Authenticated Stored XSS & XFSRelated Posts for WordPress
- CVE-2021-24453Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoningInclude Me
- CVE-2021-24452W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)BoldGrid W3 Total Cache
- CVE-2021-24447WP Image Zoom < 1.47 - Local File InclusionWP Image Zoom
- CVE-2021-24436W3 Total Cache < 2.1.4 - Reflected XSS in Extensions Page (Attribute Context)BoldGrid W3 Total Cache
- CVE-2021-33592NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file.NAVER Toolbar
- CVE-2020-36421An issue was discovered in Arm Mbed TLS before 2.23.0.
- CVE-2020-36422An issue was discovered in Arm Mbed TLS before 2.23.0.
- CVE-2020-36423An issue was discovered in Arm Mbed TLS before 2.23.0.
- CVE-2020-36424An issue was discovered in Arm Mbed TLS before 2.24.0.
- CVE-2020-36425An issue was discovered in Arm Mbed TLS before 2.24.0.
- CVE-2020-36426An issue was discovered in Arm Mbed TLS before 2.24.0.
- CVE-2021-32760Archive package allows chmod of file outside of unpack target directorycontainerd · github.com/containerd/containerd