CVEs published July 21, 2021
84 CVEs were published on July 21, 2021: 1 critical, 10 high.
- Published
- 84
- Critical
- 1
- High
- 10
- Medium
- 8
- Low
- 0
- Unrated
- 65
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- 13
- NVIDIA Virtual GPU Software
- 7
- Combodo iTop
- 4
- - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Softw…
- 2
- CollaboraOnline online
- 2
- Easergy T300 with firmware V2.7.1 and older
- 2
- - PCoIP Agent for Windows
- 1
- - PCoIP Software Client
- 1
- :linux_kernel:
- 1
- anchorme
- 1
Critical 1
High 10
- CVE-2021-32761Integer overflow issues with *BIT commands on 32-bit systemsredis
- CVE-2021-32775Any user can see any fields (including mailbox password) with GroupBy DashletCombodo iTop
- CVE-2021-32756Arbitrary eval through MiqExpressionmanageiq
- CVE-2021-32745Reflected Cross-Site-Scripting vulnerabilityCollaboraOnline online
- CVE-2021-21407Portal : the CSRF token isn't validatedCombodo iTop
- CVE-2021-34619Cross-Site Request Forgery in WooCommerce Stock Manager WordPress PluginStoreApps WooCommerce Stock Manager
- CVE-2021-23409Denial of Service (DoS)github.com/pires/go-proxyproto
- CVE-2021-1099NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) that could allow an attacker to cause stack-based bufNVIDIA Virtual GPU Software
- CVE-2021-1098NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it doesn't release some resources during driveNVIDIA Virtual GPU Software
- CVE-2021-1097NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it improperly validates the length field in a NVIDIA Virtual GPU Software
Medium, low and unrated 73
- CVE-2021-37220MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash
- CVE-2021-32776No CSRF form token cleanup on Windows serversCombodo iTop
- CVE-2021-34816An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by i
- CVE-2021-35482An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70.
- CVE-2020-19499An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other
- CVE-2020-19498Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified
- CVE-2020-19497Integer overflow vulnerability in Mat_VarReadNextInfo5 in mat5.c in tbeu matio (aka MAT File I/O Library) 1.5.17, allows attackers to cause
- CVE-2020-19492There is a floating point exception in ReadImage that leads to a Segmentation fault in sam2p 0.49.4.
- CVE-2020-19491There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4.
- CVE-2020-19490tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.
- CVE-2020-19488An issue was discovered in box_code_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read o
- CVE-2020-19481An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box.
- CVE-2020-19475An issue has been found in function CCITTFaxStream::lookChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an i
- CVE-2020-19474An issue has been found in function Gfx::doShowText in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Use After
- CVE-2020-19473An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an unc
- CVE-2020-19472An issue has been found in function DCTStream::readHuffSym in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an inv
- CVE-2020-19471An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an inv
- CVE-2020-19470An issue has been found in function DCTStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a NULL poi
- CVE-2020-19469An issue has been found in function DCTStream::reset in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid w
- CVE-2020-19468An issue has been found in function EmbedStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a null p
- CVE-2020-19467An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to
- CVE-2020-19466An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to
- CVE-2020-19465An issue has been found in function ObjectStream::getObject in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an in
- CVE-2020-19464An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow
- CVE-2020-19463An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow.
- CVE-2020-22150A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts
- CVE-2020-22148A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts
- CVE-2021-23408Prototype Pollutioncom.graphhopper:graphhopper-web-bundle
- CVE-2021-21406Command Injection vulnerability in the Setup WizardCombodo iTop
- CVE-2021-23411Cross-site Scripting (XSS)anchorme
- CVE-2020-19609Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF files allowing attackers
- CVE-2020-20221Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm proce
- CVE-2021-37155wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the seria
- CVE-2020-20262Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process
- CVE-2020-20219Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process.
- CVE-2020-21937An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers
- CVE-2020-21936An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetSt
- CVE-2020-21935A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows att
- CVE-2020-21934An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypas
- CVE-2020-21933An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in
- CVE-2020-21932A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a parti
- CVE-2020-23282SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password
- CVE-2020-23283Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's d
- CVE-2021-25701The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety - PCoIP Software Client
- CVE-2021-25695The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attack- PCoIP Agent for Windows
- CVE-2021-25698The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, whic- PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Softw…
- CVE-2021-25699The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, whi- PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Softw…
- CVE-2021-22146All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
- CVE-2021-22145A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting.Elasticsearch · org.elasticsearch.client:elasticsearch-rest…
- CVE-2021-22774A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1)EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22773A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink PEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22730A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlinEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22729A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink PEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22728A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22727A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22726A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22723A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulnerEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22722A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (EEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22721A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink ParkingEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22708A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22707A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlinEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22706A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22PEVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…
- CVE-2021-22772A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), EaseEasergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Eas…
- CVE-2021-22784A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attackerC-Bus Toolkit v1.15.8 and prior
- CVE-2021-22777A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file.SoSafe Configurable prior to
- CVE-2021-22771A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older thEasergy T300 with firmware V2.7.1 and older
- CVE-2021-22770A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to anEasergy T300 with firmware V2.7.1 and older
- CVE-2021-20106Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator Nessus Agent
- CVE-2021-1103NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lNVIDIA Virtual GPU Software
- CVE-2021-1102NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can lead to floating point exceptions, whicNVIDIA Virtual GPU Software
- CVE-2021-1101NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lNVIDIA Virtual GPU Software
- CVE-2021-1100NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel mode driver (nvidia.ko), in which a pointer to a user-space NVIDIA Virtual GPU Software
- CVE-2021-37159hso_free_net_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister_netdev without checking for the NETREG_REGI:linux_kernel: