# CVEs published 2021-07-19

61 CVEs were published on July 19, 2021: 5 critical, 4 high. Days are UTC.

- [CVE-2021-32773](https://cve.now/CVE-2021-32773.md): Confused deputy attack in sandbox module resolution (CVSS 6.1, racket)
- [CVE-2020-5349](https://cve.now/CVE-2020-5349.md): Dell EMC Networking S4100 and S5200 Series Switches manufactured prior to February 2020 contain a hardcoded credential vulnerability. (CVSS 9.8, Dell Networking)
- [CVE-2020-5323](https://cve.now/CVE-2020-5323.md): Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an in (CVSS 5.4, Dell OpenManage Enterprise)
- [CVE-2020-5322](https://cve.now/CVE-2020-5322.md): Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. (CVSS 9.1, Dell OpenManage Enterprise Modular)
- [CVE-2020-5321](https://cve.now/CVE-2020-5321.md): Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an im (CVSS 7.6, Dell OpenManage Enterprise)
- [CVE-2020-5320](https://cve.now/CVE-2020-5320.md): Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL (CVSS 9.0, Dell OpenManage Enterprise)
- [CVE-2020-5315](https://cve.now/CVE-2020-5315.md): Dell EMC Repository Manager (DRM) version 3.2 contains a plain-text password storage vulnerability. (CVSS 8.8, Dell EMC Repository Manager)
- [CVE-2020-29503](https://cve.now/CVE-2020-29503.md): Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission Vulnerability. (CVSS 4.1, Dell PowerStore)
- [CVE-2020-29499](https://cve.now/CVE-2020-29499.md): Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . (CVSS 6.4, Dell PowerStore)
- [CVE-2021-3135](https://cve.now/CVE-2021-3135.md): An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. (no CVSS)
- [CVE-2021-31590](https://cve.now/CVE-2021-31590.md): PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. (no CVSS)
- [CVE-2021-34618](https://cve.now/CVE-2021-34618.md): A remote denial of service (DoS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant (no CVSS, Aruba Instant Access Points)
- [CVE-2021-34617](https://cve.now/CVE-2021-34617.md): A remote cross-site scripting (XSS) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Inst (no CVSS, Aruba Instant Access Points)
- [CVE-2020-22741](https://cve.now/CVE-2020-22741.md): An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users' private key after obtaining the partia (no CVSS)
- [CVE-2020-20248](https://cve.now/CVE-2020-20248.md): Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the memtest process. (no CVSS)
- [CVE-2020-20249](https://cve.now/CVE-2020-20249.md): Mikrotik RouterOs before stable 6.47 suffers from a memory corruption vulnerability in the resolver process. (no CVSS)
- [CVE-2021-34821](https://cve.now/CVE-2021-34821.md): Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. (no CVSS)
- [CVE-2021-34820](https://cve.now/CVE-2021-34820.md): Web Path Directory Traversal in the Novus HTTP Server. (no CVSS)
- [CVE-2020-22650](https://cve.now/CVE-2020-22650.md): A memory leak vulnerability in sim-organizer.c of AlienVault Ossim v5 causes a denial of service (DOS) via a system crash triggered by the o (no CVSS)
- [CVE-2021-34675](https://cve.now/CVE-2021-34675.md): Basix NEX-Forms through 7.8.7 allows authentication bypass for stored PDF reports. (no CVSS)
- [CVE-2021-34676](https://cve.now/CVE-2021-34676.md): Basix NEX-Forms through 7.8.7 allows authentication bypass for Excel report generation. (no CVSS)
- [CVE-2021-36799](https://cve.now/CVE-2021-36799.md): KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project i (no CVSS)
- [CVE-2021-36797](https://cve.now/CVE-2021-36797.md): In Victron Energy Venus OS through 2.72, root access is granted by default to anyone with physical access to the device. (no CVSS)
- [CVE-2020-20230](https://cve.now/CVE-2020-20230.md): Mikrotik RouterOs before stable 6.47 suffers from an uncontrolled resource consumption in the sshd process. (no CVSS)
- [CVE-2021-29780](https://cve.now/CVE-2021-29780.md): IBM Resilient OnPrem v41.1 of IBM Security SOAR could allow an authenticated user to perform actions that they should not have access to due (CVSS 4.7, IBM Resilient OnPrem)
- [CVE-2021-29707](https://cve.now/CVE-2021-29707.md): IBM HMC (Hardware Management Console) V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a re (CVSS 8.4, IBM Power HMC)
- [CVE-2021-20507](https://cve.now/CVE-2021-20507.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational Team… +4)
- [CVE-2020-5031](https://cve.now/CVE-2020-5031.md): IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational Team… +4)
- [CVE-2020-36427](https://cve.now/CVE-2020-36427.md): GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image. (no CVSS)
- [CVE-2021-35043](https://cve.now/CVE-2021-35043.md): OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). (no CVSS, org.owasp.antisamy:antisamy)
- [CVE-2021-20110](https://cve.now/CVE-2021-20110.md): Due to Manage Engine Asset Explorer Agent 1.0.34 not validating HTTPS certificates, an attacker on the network can statically configure thei (no CVSS, Manage Engine Asset Explorer Agent)
- [CVE-2021-20108](https://cve.now/CVE-2021-20108.md): Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. (no CVSS, Manage Engine Asset Explorer Agent)
- [CVE-2021-20109](https://cve.now/CVE-2021-20109.md): Due to the Asset Explorer agent not validating HTTPS certificates, an attacker on the network can statically configure their IP address to m (no CVSS, Manage Engine Asset Explorer Agent)
- [CVE-2021-35449](https://cve.now/CVE-2021-35449.md): The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1 (no CVSS)
- [CVE-2021-34817](https://cve.now/CVE-2021-34817.md): A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML b (no CVSS)
- [CVE-2021-32014](https://cve.now/CVE-2021-32014.md): SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is (no CVSS, xlsx · org.webjars.npm:xlsx)
- [CVE-2021-32013](https://cve.now/CVE-2021-32013.md): SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that (no CVSS, xlsx · org.webjars.npm:xlsx)
- [CVE-2021-32012](https://cve.now/CVE-2021-32012.md): SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that (no CVSS, xlsx · org.webjars.npm:xlsx)
- [CVE-2021-31216](https://cve.now/CVE-2021-31216.md): Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by (no CVSS)
- [CVE-2021-3279](https://cve.now/CVE-2021-3279.md): sz.chat version 4 allows injection of web scripts and HTML in the message box. (no CVSS)
- [CVE-2021-35968](https://cve.now/CVE-2021-35968.md): Learningdigital.com, Inc. Orca HCM - Path Traversal-2 (CVSS 4.3, Learningdigital.com Orca HCM)
- [CVE-2021-35967](https://cve.now/CVE-2021-35967.md): Learningdigital.com, Inc. Orca HCM - Path Traversal-1 (CVSS 5.3, Learningdigital.com Orca HCM)
- [CVE-2021-35966](https://cve.now/CVE-2021-35966.md): Learningdigital.com, Inc. Orca HCM - URL Redirection to Untrusted Site ('Open Redirect') (CVSS 6.1, Learningdigital.com Orca HCM)
- [CVE-2021-35965](https://cve.now/CVE-2021-35965.md): Learningdigital.com, Inc. Orca HCM - Hard-code password (CVSS 9.8, Learningdigital.com Orca HCM)
- [CVE-2021-35964](https://cve.now/CVE-2021-35964.md): Learningdigital.com, Inc. Orca HCM - Broken Authentication (CVSS 7.3, Learningdigital.com Orca HCM)
- [CVE-2021-35963](https://cve.now/CVE-2021-35963.md): Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type (CVSS 9.8, Learningdigital.com Orca HCM)
- [CVE-2021-33027](https://cve.now/CVE-2021-33027.md): Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a nonce. (no CVSS)
- [CVE-2021-33501](https://cve.now/CVE-2021-33501.md): Overwolf Client 0.169.0.22 allows XSS, with resultant Remote Code Execution, via an overwolfstore:// URL. (no CVSS)
- [CVE-2021-24482](https://cve.now/CVE-2021-24482.md): Related Posts for WordPress \<= 2.0.4 - Authenticated Stored XSS & XFS (no CVSS, Related Posts for WordPress)
- [CVE-2021-24453](https://cve.now/CVE-2021-24453.md): Include Me \<= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning (no CVSS, Include Me)
- [CVE-2021-24452](https://cve.now/CVE-2021-24452.md): W3 Total Cache \< 2.1.5 - Reflected XSS in Extensions Page (JS Context) (no CVSS, BoldGrid W3 Total Cache)
- [CVE-2021-24447](https://cve.now/CVE-2021-24447.md): WP Image Zoom \< 1.47 - Local File Inclusion (no CVSS, WP Image Zoom)
- [CVE-2021-24436](https://cve.now/CVE-2021-24436.md): W3 Total Cache \< 2.1.4 - Reflected XSS in Extensions Page (Attribute Context) (no CVSS, BoldGrid W3 Total Cache)
- [CVE-2021-33592](https://cve.now/CVE-2021-33592.md): NAVER Toolbar before 4.0.30.323 allows remote attackers to execute arbitrary code via a crafted upgrade.xml file. (no CVSS, NAVER Toolbar)
- [CVE-2020-36421](https://cve.now/CVE-2020-36421.md): An issue was discovered in Arm Mbed TLS before 2.23.0. (CVSS 5.3)
- [CVE-2020-36422](https://cve.now/CVE-2020-36422.md): An issue was discovered in Arm Mbed TLS before 2.23.0. (no CVSS)
- [CVE-2020-36423](https://cve.now/CVE-2020-36423.md): An issue was discovered in Arm Mbed TLS before 2.23.0. (no CVSS)
- [CVE-2020-36424](https://cve.now/CVE-2020-36424.md): An issue was discovered in Arm Mbed TLS before 2.24.0. (no CVSS)
- [CVE-2020-36425](https://cve.now/CVE-2020-36425.md): An issue was discovered in Arm Mbed TLS before 2.24.0. (no CVSS)
- [CVE-2020-36426](https://cve.now/CVE-2020-36426.md): An issue was discovered in Arm Mbed TLS before 2.24.0. (no CVSS)
- [CVE-2021-32760](https://cve.now/CVE-2021-32760.md): Archive package allows chmod of file outside of unpack target directory (CVSS 5.0, containerd · github.com/containerd/containerd)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.