CVEs published July 22, 2021
90 CVEs were published on July 22, 2021: 3 critical, 12 high. 2 are now in CISA KEV.
- Published
- 90
- Critical
- 3
- High
- 12
- Medium
- 17
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 2
- Fix available
- 8
Most affected products
- NVIDIA GPU Display Driver
- 8
- Cisco Intersight Virtual Appliance
- 4
- Sage X3
- 4
- Akkadian Provisioning Manager Engine
- 3
- Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- 3
- Ivanti MobileIron Core
- 2
- Verastream Host Integrator.
- 2
- zmartzone mod_auth_openidc
- 2
- Apache Software Foundation Apache Impala
- 1
- Cisco Firepower Threat Defense Software
- 1
Critical 3
- CVE-2020-7388Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by SpoofingSage X3
- CVE-2021-35464ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.
- CVE-2021-35942The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) wh
High 12
- CVE-2021-31581Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interfaceAkkadian Provisioning Manager Engine
- CVE-2021-31580Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' commandAkkadian Provisioning Manager Engine
- CVE-2021-31579Akkadian Provisioning Manager Engine (PME) Hard-Coded CredentialsAkkadian Provisioning Manager Engine
- CVE-2020-5370Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability.Dell OpenManage Enterprise
- CVE-2020-5316Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.Dell SupportAssist Client
- CVE-2021-1600Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-1601Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-36934Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1092NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows NVIDIA GPU Display Driver
- CVE-2021-1091NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the driverNVIDIA GPU Display Driver
- CVE-2021-1089NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary coNVIDIA GPU Display Driver
- CVE-2021-1090NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for control calls wNVIDIA GPU Display Driver
Medium, low and unrated 75
- CVE-2021-34268An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) vi
- CVE-2021-34267An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) whe
- CVE-2021-34262A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attack
- CVE-2021-34261An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system han
- CVE-2021-34260A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows
- CVE-2021-34259A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attac
- CVE-2020-22284A buffer overflow vulnerability in the zepif_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allow
- CVE-2021-25205SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the
- CVE-2021-25211Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload
- CVE-2021-25213SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, vi
- CVE-2021-25209SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements,
- CVE-2021-25212SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, vi
- CVE-2021-25210Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the fil
- CVE-2021-27332Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra
- CVE-2021-26224Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script o
- CVE-2021-26223SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state
- CVE-2021-3540Ivanti MobileIron Core clish Restricted Shell Escape via Argument InjectionIvanti MobileIron Core
- CVE-2021-3198Ivanti MobileIron Core clish Restricted Shell Escape via OS Command InjectionIvanti MobileIron Core
- CVE-2020-7390Sage X3 Syracuse Persistent XSS in Edit User pageSage X3
- CVE-2020-7389Sage X3 Syracuse Missing Authentication for Critical Function in Developer EnvironmentSage X3
- CVE-2020-7387Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized ActorSage X3
- CVE-2021-33032A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 an
- CVE-2020-36033SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php.
- CVE-2021-36222ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a
- CVE-2021-25197Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web s
- CVE-2015-2098Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to th
- CVE-2015-2099Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetR
- CVE-2021-25202SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements,
- CVE-2015-2100Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspec
- CVE-2021-26226SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state
- CVE-2021-35063Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion."
- CVE-2021-33478The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achi
- CVE-2021-26227Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra
- CVE-2021-26232SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via t
- CVE-2021-29657arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on hos
- CVE-2021-26230Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra
- CVE-2021-26231SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the
- CVE-2021-26228SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state
- CVE-2021-26699OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter
- CVE-2021-37403OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i
- CVE-2021-37402OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval
- CVE-2021-26229SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state
- CVE-2021-26698OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i
- CVE-2021-26764SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the i
- CVE-2021-26762SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid
- CVE-2021-26765SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid
- CVE-2021-1599Cisco Unified Customer Voice Portal Cross-Site Scripting VulnerabilityCisco Unified Customer Voice Portal
- CVE-2021-1518Cisco Firepower Device Manager On-Box Software Remote Code Execution VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-1614Cisco SD-WAN Software Information Disclosure VulnerabilityCisco SD-WAN Solution
- CVE-2021-1617Cisco Intersight Virtual Appliance VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-1618Cisco Intersight Virtual Appliance VulnerabilitiesCisco Intersight Virtual Appliance
- CVE-2021-34700Cisco SD-WAN vManage Software Information Disclosure VulnerabilityCisco SD-WAN vManage
- CVE-2021-34431In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to theThe Eclipse Foundation Eclipse Mosquitto
- CVE-2021-29149A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 SwitAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-29148A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 SwitchAruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-29143A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…
- CVE-2021-22001In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request oCloud Foundry UAA server
- CVE-2019-20467An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices.
- CVE-2021-30110dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a
- CVE-2021-30486SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (P
- CVE-2021-30049SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.
- CVE-2021-35522A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4,
- CVE-2021-35521A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated at
- CVE-2021-35520A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate a
- CVE-2021-22523XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions.Verastream Host Integrator.
- CVE-2021-22522Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier vVerastream Host Integrator.
- CVE-2021-20596NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-MELSEC-F Series FX3U-ENET; FX3U-ENET-L; FX3U-ENET-P502
- CVE-2021-28131Impala logs contain secretsApache Software Foundation Apache Impala
- CVE-2021-1096NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscNVIDIA GPU Display Driver
- CVE-2020-22283A buffer overflow vulnerability in the icmp6_send_response_with_addrs_and_netif() function of Free Software Foundation lwIP version git head
- CVE-2021-1093NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statemNVIDIA GPU Display Driver
- CVE-2021-1094NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape wNVIDIA GPU Display Driver
- CVE-2021-1095NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlers for all control caNVIDIA GPU Display Driver
- CVE-2021-32785Format string bug in the Redis cache implementationzmartzone mod_auth_openidc
- CVE-2021-32786Open Redirect in oidc_validate_redirect_url()zmartzone mod_auth_openidc