# CVEs published 2021-07-21

84 CVEs were published on July 21, 2021: 1 critical, 10 high. Days are UTC.

- [CVE-2021-37220](https://cve.now/CVE-2021-37220.md): MuPDF through 1.18.1 has an out-of-bounds write because the cached color converter does not properly consider the maximum key size of a hash (no CVSS)
- [CVE-2021-32761](https://cve.now/CVE-2021-32761.md): Integer overflow issues with \*BIT commands on 32-bit systems (CVSS 7.5, redis)
- [CVE-2021-32776](https://cve.now/CVE-2021-32776.md): No CSRF form token cleanup on Windows servers (CVSS 6.8, Combodo iTop)
- [CVE-2021-32775](https://cve.now/CVE-2021-32775.md): Any user can see any fields (including mailbox password) with GroupBy Dashlet (CVSS 7.7, Combodo iTop)
- [CVE-2021-32756](https://cve.now/CVE-2021-32756.md): Arbitrary eval through MiqExpression (CVSS 8.8, manageiq)
- [CVE-2021-34816](https://cve.now/CVE-2021-34816.md): An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary code on the server by i (no CVSS)
- [CVE-2021-32745](https://cve.now/CVE-2021-32745.md): Reflected Cross-Site-Scripting vulnerability (CVSS 7.3, CollaboraOnline online)
- [CVE-2021-35482](https://cve.now/CVE-2021-35482.md): An issue was discovered in Barco MirrorOp Windows Sender before 2.5.4.70. (no CVSS)
- [CVE-2020-19499](https://cve.now/CVE-2020-19499.md): An issue was discovered in heif::Box\_iref::get\_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other (no CVSS)
- [CVE-2020-19498](https://cve.now/CVE-2020-19498.md): Floating point exception in function Fraction in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified (no CVSS)
- [CVE-2020-19497](https://cve.now/CVE-2020-19497.md): Integer overflow vulnerability in Mat\_VarReadNextInfo5 in mat5.c in tbeu matio (aka MAT File I/O Library) 1.5.17, allows attackers to cause (no CVSS)
- [CVE-2020-19492](https://cve.now/CVE-2020-19492.md): There is a floating point exception in ReadImage that leads to a Segmentation fault in sam2p 0.49.4. (no CVSS)
- [CVE-2020-19491](https://cve.now/CVE-2020-19491.md): There is an invalid memory access bug in cgif.c that leads to a Segmentation fault in sam2p 0.49.4. (no CVSS)
- [CVE-2020-19490](https://cve.now/CVE-2020-19490.md): tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code. (no CVSS)
- [CVE-2020-19488](https://cve.now/CVE-2020-19488.md): An issue was discovered in box\_code\_apple.c:119 in Gpac MP4Box 0.8.0, allows attackers to cause a Denial of Service due to an invalid read o (no CVSS)
- [CVE-2020-19481](https://cve.now/CVE-2020-19481.md): An issue was discovered in GPAC before 0.8.0, as demonstrated by MP4Box. (no CVSS)
- [CVE-2020-19475](https://cve.now/CVE-2020-19475.md): An issue has been found in function CCITTFaxStream::lookChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an i (no CVSS)
- [CVE-2020-19474](https://cve.now/CVE-2020-19474.md): An issue has been found in function Gfx::doShowText in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an Use After (no CVSS)
- [CVE-2020-19473](https://cve.now/CVE-2020-19473.md): An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an unc (no CVSS)
- [CVE-2020-19472](https://cve.now/CVE-2020-19472.md): An issue has been found in function DCTStream::readHuffSym in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an inv (no CVSS)
- [CVE-2020-19471](https://cve.now/CVE-2020-19471.md): An issue has been found in function DCTStream::decodeImage in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an inv (no CVSS)
- [CVE-2020-19470](https://cve.now/CVE-2020-19470.md): An issue has been found in function DCTStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a NULL poi (no CVSS)
- [CVE-2020-19469](https://cve.now/CVE-2020-19469.md): An issue has been found in function DCTStream::reset in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an invalid w (no CVSS)
- [CVE-2020-19468](https://cve.now/CVE-2020-19468.md): An issue has been found in function EmbedStream::getChar in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a null p (no CVSS)
- [CVE-2020-19467](https://cve.now/CVE-2020-19467.md): An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to (no CVSS)
- [CVE-2020-19466](https://cve.now/CVE-2020-19466.md): An issue has been found in function DCTStream::transformDataUnit in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to (no CVSS)
- [CVE-2020-19465](https://cve.now/CVE-2020-19465.md): An issue has been found in function ObjectStream::getObject in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to an in (no CVSS)
- [CVE-2020-19464](https://cve.now/CVE-2020-19464.md): An issue has been found in function XRef::fetch in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow (no CVSS)
- [CVE-2020-19463](https://cve.now/CVE-2020-19463.md): An issue has been found in function vfprintf in PDF2JSON 0.70 that allows attackers to cause a Denial of Service due to a stack overflow. (no CVSS)
- [CVE-2020-22150](https://cve.now/CVE-2020-22150.md): A cross site scripting (XSS) vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts (no CVSS)
- [CVE-2020-22148](https://cve.now/CVE-2020-22148.md): A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts (no CVSS)
- [CVE-2021-32744](https://cve.now/CVE-2021-32744.md): Unauthenticated attacker could gain access to currently open files (CVSS 9.8, CollaboraOnline online)
- [CVE-2021-23408](https://cve.now/CVE-2021-23408.md): Prototype Pollution (CVSS 5.4, com.graphhopper:graphhopper-web-bundle)
- [CVE-2021-21407](https://cve.now/CVE-2021-21407.md): Portal : the CSRF token isn't validated (CVSS 8.0, Combodo iTop)
- [CVE-2021-21406](https://cve.now/CVE-2021-21406.md): Command Injection vulnerability in the Setup Wizard (CVSS 5.8, Combodo iTop)
- [CVE-2021-23411](https://cve.now/CVE-2021-23411.md): Cross-site Scripting (XSS) (CVSS 5.4, anchorme)
- [CVE-2020-19609](https://cve.now/CVE-2020-19609.md): Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff\_expand\_colormap() function when parsing TIFF files allowing attackers (no CVSS)
- [CVE-2020-20221](https://cve.now/CVE-2020-20221.md): Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the /nova/bin/cerm proce (no CVSS)
- [CVE-2021-37155](https://cve.now/CVE-2021-37155.md): wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request differs from the seria (no CVSS)
- [CVE-2020-20262](https://cve.now/CVE-2020-20262.md): Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/nova/bin/ipsec process (no CVSS)
- [CVE-2020-20219](https://cve.now/CVE-2020-20219.md): Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy process. (no CVSS)
- [CVE-2020-21937](https://cve.now/CVE-2020-21937.md): An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers (no CVSS)
- [CVE-2020-21936](https://cve.now/CVE-2020-21936.md): An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access the components GetSt (no CVSS)
- [CVE-2020-21935](https://cve.now/CVE-2020-21935.md): A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows att (no CVSS)
- [CVE-2020-21934](https://cve.now/CVE-2020-21934.md): An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the Syslog could be bypas (no CVSS)
- [CVE-2020-21933](https://cve.now/CVE-2020-21933.md): An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in (no CVSS)
- [CVE-2020-21932](https://cve.now/CVE-2020-21932.md): A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass login and obtain a parti (no CVSS)
- [CVE-2020-23282](https://cve.now/CVE-2020-23282.md): SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user with a generic password (no CVSS)
- [CVE-2020-23283](https://cve.now/CVE-2020-23283.md): Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users from the application's d (no CVSS)
- [CVE-2021-25701](https://cve.now/CVE-2021-25701.md): The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the handling of a variety (no CVSS, - PCoIP Software Client)
- [CVE-2021-25695](https://cve.now/CVE-2021-25695.md): The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attack (no CVSS, - PCoIP Agent for Windows)
- [CVE-2021-25698](https://cve.now/CVE-2021-25698.md): The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, whic (no CVSS, - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Softw…)
- [CVE-2021-25699](https://cve.now/CVE-2021-25699.md): The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, whi (no CVSS, - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Softw…)
- [CVE-2021-22146](https://cve.now/CVE-2021-22146.md): All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. (no CVSS)
- [CVE-2021-22145](https://cve.now/CVE-2021-22145.md): A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. (no CVSS, Elasticsearch · org.elasticsearch.client:elasticsearch-rest…)
- [CVE-2021-34619](https://cve.now/CVE-2021-34619.md): Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin (CVSS 8.8, StoreApps WooCommerce Stock Manager)
- [CVE-2021-22774](https://cve.now/CVE-2021-22774.md): A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1) (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22773](https://cve.now/CVE-2021-22773.md): A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink P (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22730](https://cve.now/CVE-2021-22730.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22729](https://cve.now/CVE-2021-22729.md): A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink P (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22728](https://cve.now/CVE-2021-22728.md): A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22727](https://cve.now/CVE-2021-22727.md): A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22726](https://cve.now/CVE-2021-22726.md): A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22723](https://cve.now/CVE-2021-22723.md): A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request Forgery (CSRF) vulner (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22722](https://cve.now/CVE-2021-22722.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exists in EVlink City (E (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22721](https://cve.now/CVE-2021-22721.md): A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22708](https://cve.now/CVE-2021-22708.md): A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22707](https://cve.now/CVE-2021-22707.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlin (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22706](https://cve.now/CVE-2021-22706.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in EVlink City (EVC1S22P (no CVSS, EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8…)
- [CVE-2021-22772](https://cve.now/CVE-2021-22772.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Ease (no CVSS, Easergy T200 ((Modbus) SC2-04MOD-07000100 and earlier), Eas…)
- [CVE-2021-22784](https://cve.now/CVE-2021-22784.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that could allow an attacker (no CVSS, C-Bus Toolkit v1.15.8 and prior)
- [CVE-2021-22777](https://cve.now/CVE-2021-22777.md): A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a malicious project file. (no CVSS, SoSafe Configurable prior to)
- [CVE-2021-22771](https://cve.now/CVE-2021-22771.md): A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmware V2.7.1 and older th (no CVSS, Easergy T300 with firmware V2.7.1 and older)
- [CVE-2021-22770](https://cve.now/CVE-2021-22770.md): A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensitive information to an (no CVSS, Easergy T300 with firmware V2.7.1 and older)
- [CVE-2021-20106](https://cve.now/CVE-2021-20106.md): Nessus Agent versions 8.2.5 and earlier were found to contain a privilege escalation vulnerability which could allow a Nessus administrator (no CVSS, Nessus Agent)
- [CVE-2021-23409](https://cve.now/CVE-2021-23409.md): Denial of Service (DoS) (CVSS 7.5, github.com/pires/go-proxyproto)
- [CVE-2021-1103](https://cve.now/CVE-2021-1103.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may l (CVSS 4.4, NVIDIA Virtual GPU Software)
- [CVE-2021-1102](https://cve.now/CVE-2021-1102.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can lead to floating point exceptions, whic (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1101](https://cve.now/CVE-2021-1101.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may l (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1100](https://cve.now/CVE-2021-1100.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel mode driver (nvidia.ko), in which a pointer to a user-space (CVSS 6.2, NVIDIA Virtual GPU Software)
- [CVE-2021-1099](https://cve.now/CVE-2021-1099.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) that could allow an attacker to cause stack-based buf (CVSS 7.0, NVIDIA Virtual GPU Software)
- [CVE-2021-1098](https://cve.now/CVE-2021-1098.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it doesn't release some resources during drive (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-1097](https://cve.now/CVE-2021-1097.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it improperly validates the length field in a (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2021-37159](https://cve.now/CVE-2021-37159.md): hso\_free\_net\_device in drivers/net/usb/hso.c in the Linux kernel through 5.13.4 calls unregister\_netdev without checking for the NETREG\_REGI (no CVSS, :linux\_kernel:)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.