# CVEs published 2021-07-22

90 CVEs were published on July 22, 2021: 3 critical, 12 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-34268](https://cve.now/CVE-2021-34268.md): An issue in the USBH\_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) vi (no CVSS)
- [CVE-2021-34267](https://cve.now/CVE-2021-34267.md): An in the USBH\_MSC\_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) whe (no CVSS)
- [CVE-2021-34262](https://cve.now/CVE-2021-34262.md): A buffer overflow vulnerability in the USBH\_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attack (no CVSS)
- [CVE-2021-34261](https://cve.now/CVE-2021-34261.md): An issue in USBH\_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system han (no CVSS)
- [CVE-2021-34260](https://cve.now/CVE-2021-34260.md): A buffer overflow vulnerability in the USBH\_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows (no CVSS)
- [CVE-2021-34259](https://cve.now/CVE-2021-34259.md): A buffer overflow vulnerability in the USBH\_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attac (no CVSS)
- [CVE-2020-22284](https://cve.now/CVE-2020-22284.md): A buffer overflow vulnerability in the zepif\_linkoutput() function of Free Software Foundation lwIP git head version and version 2.1.2 allow (no CVSS)
- [CVE-2021-25205](https://cve.now/CVE-2021-25205.md): SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the (no CVSS)
- [CVE-2021-25211](https://cve.now/CVE-2021-25211.md): Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code, via the file upload (no CVSS)
- [CVE-2021-25213](https://cve.now/CVE-2021-25213.md): SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, vi (no CVSS)
- [CVE-2021-25209](https://cve.now/CVE-2021-25209.md): SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, (no CVSS)
- [CVE-2021-25212](https://cve.now/CVE-2021-25212.md): SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, vi (no CVSS)
- [CVE-2021-25210](https://cve.now/CVE-2021-25210.md): Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code, via the fil (no CVSS)
- [CVE-2021-27332](https://cve.now/CVE-2021-27332.md): Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2021-26224](https://cve.now/CVE-2021-26224.md): Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2021-26223](https://cve.now/CVE-2021-26223.md): SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state (no CVSS)
- [CVE-2021-3540](https://cve.now/CVE-2021-3540.md): Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection (CVSS 6.5, Ivanti MobileIron Core)
- [CVE-2021-3198](https://cve.now/CVE-2021-3198.md): Ivanti MobileIron Core clish Restricted Shell Escape via OS Command Injection (CVSS 6.5, Ivanti MobileIron Core)
- [CVE-2021-31581](https://cve.now/CVE-2021-31581.md): Akkadian Provisioning Manager Engine (PME) Shell Escape via 'vi' editor interface (CVSS 7.9, Akkadian Provisioning Manager Engine)
- [CVE-2021-31580](https://cve.now/CVE-2021-31580.md): Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' command (CVSS 8.7, Akkadian Provisioning Manager Engine)
- [CVE-2021-31579](https://cve.now/CVE-2021-31579.md): Akkadian Provisioning Manager Engine (PME) Hard-Coded Credentials (CVSS 8.2, Akkadian Provisioning Manager Engine)
- [CVE-2020-7390](https://cve.now/CVE-2020-7390.md): Sage X3 Syracuse Persistent XSS in Edit User page (CVSS 4.6, Sage X3)
- [CVE-2020-7389](https://cve.now/CVE-2020-7389.md): Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment (CVSS 5.5, Sage X3)
- [CVE-2020-7388](https://cve.now/CVE-2020-7388.md): Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing (CVSS 10.0, Sage X3)
- [CVE-2020-7387](https://cve.now/CVE-2020-7387.md): Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.3, Sage X3)
- [CVE-2021-33032](https://cve.now/CVE-2021-33032.md): A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 an (no CVSS)
- [CVE-2020-36033](https://cve.now/CVE-2020-36033.md): SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the id parameter to edituser.php. (no CVSS)
- [CVE-2021-36222](https://cve.now/CVE-2021-36222.md): ec\_verify in kdc/kdc\_preauth\_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 a (no CVSS)
- [CVE-2021-25197](https://cve.now/CVE-2021-25197.md): Cross-site scripting (XSS) vulnerability in SourceCodester Content Management System v 1.0 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2015-2098](https://cve.now/CVE-2015-2098.md): Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to th (no CVSS)
- [CVE-2015-2099](https://cve.now/CVE-2015-2099.md): Multiple buffer overflows in WebGate Control Center allow remote attackers to execute arbitrary code via unspecified vectors to the (1) GetR (no CVSS)
- [CVE-2021-25202](https://cve.now/CVE-2021-25202.md): SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, (no CVSS)
- [CVE-2021-35464](https://cve.now/CVE-2021-35464.md): ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. (CVSS 9.8, KEV)
- [CVE-2015-2100](https://cve.now/CVE-2015-2100.md): Multiple stack-based buffer overflows in WebGate eDVR Manager and Control Center allow remote attackers to execute arbitrary code via unspec (no CVSS)
- [CVE-2021-26226](https://cve.now/CVE-2021-26226.md): SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state (no CVSS)
- [CVE-2021-35063](https://cve.now/CVE-2021-35063.md): Suricata before 5.0.7 and 6.x before 6.0.3 has a "critical evasion." (no CVSS)
- [CVE-2020-5370](https://cve.now/CVE-2020-5370.md): Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. (CVSS 7.9, Dell OpenManage Enterprise)
- [CVE-2020-5316](https://cve.now/CVE-2020-5316.md): Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2. (CVSS 7.8, Dell SupportAssist Client)
- [CVE-2021-33478](https://cve.now/CVE-2021-33478.md): The TrustZone implementation in certain Broadcom MediaxChange firmware could allow an unauthenticated, physically proximate attacker to achi (no CVSS)
- [CVE-2021-26227](https://cve.now/CVE-2021-26227.md): Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2021-26232](https://cve.now/CVE-2021-26232.md): SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via t (no CVSS)
- [CVE-2021-29657](https://cve.now/CVE-2021-29657.md): arch/x86/kvm/svm/nested.c in the Linux kernel before 5.11.12 has a use-after-free in which an AMD KVM guest can bypass access control on hos (no CVSS)
- [CVE-2021-26230](https://cve.now/CVE-2021-26230.md): Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitra (no CVSS)
- [CVE-2021-26231](https://cve.now/CVE-2021-26231.md): SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the (no CVSS)
- [CVE-2021-26228](https://cve.now/CVE-2021-26228.md): SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state (no CVSS)
- [CVE-2021-26699](https://cve.now/CVE-2021-26699.md): OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter (no CVSS)
- [CVE-2021-37403](https://cve.now/CVE-2021-37403.md): OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i (no CVSS)
- [CVE-2021-37402](https://cve.now/CVE-2021-37402.md): OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval (no CVSS)
- [CVE-2021-26229](https://cve.now/CVE-2021-26229.md): SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL state (no CVSS)
- [CVE-2021-26698](https://cve.now/CVE-2021-26698.md): OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link i (no CVSS)
- [CVE-2021-26764](https://cve.now/CVE-2021-26764.md): SQL injection vulnerability in PHPGurukul Student Record System v 4.0 allows remote attackers to execute arbitrary SQL statements, via the i (no CVSS)
- [CVE-2021-26762](https://cve.now/CVE-2021-26762.md): SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the cid (no CVSS)
- [CVE-2021-26765](https://cve.now/CVE-2021-26765.md): SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid (no CVSS)
- [CVE-2021-1599](https://cve.now/CVE-2021-1599.md): Cisco Unified Customer Voice Portal Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Customer Voice Portal)
- [CVE-2021-1518](https://cve.now/CVE-2021-1518.md): Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability (CVSS 6.3, Cisco Firepower Threat Defense Software)
- [CVE-2021-1600](https://cve.now/CVE-2021-1600.md): Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding Vulnerabilities (CVSS 8.3, Cisco Intersight Virtual Appliance)
- [CVE-2021-1601](https://cve.now/CVE-2021-1601.md): Cisco Intersight Virtual Appliance IPv4 and IPv6 Forwarding Vulnerabilities (CVSS 8.3, Cisco Intersight Virtual Appliance)
- [CVE-2021-1614](https://cve.now/CVE-2021-1614.md): Cisco SD-WAN Software Information Disclosure Vulnerability (CVSS 5.3, Cisco SD-WAN Solution)
- [CVE-2021-1617](https://cve.now/CVE-2021-1617.md): Cisco Intersight Virtual Appliance Vulnerabilities (CVSS 6.5, Cisco Intersight Virtual Appliance)
- [CVE-2021-1618](https://cve.now/CVE-2021-1618.md): Cisco Intersight Virtual Appliance Vulnerabilities (CVSS 6.5, Cisco Intersight Virtual Appliance)
- [CVE-2021-34700](https://cve.now/CVE-2021-34700.md): Cisco SD-WAN vManage Software Information Disclosure Vulnerability (CVSS 5.5, Cisco SD-WAN vManage)
- [CVE-2021-34431](https://cve.now/CVE-2021-34431.md): In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2021-29149](https://cve.now/CVE-2021-29149.md): A local bypass security restrictions vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Swit (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-29148](https://cve.now/CVE-2021-29148.md): A local cross-site scripting (XSS) vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-29143](https://cve.now/CVE-2021-29143.md): A remote execution of arbitrary commands vulnerability was discovered in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 (no CVSS, Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aru…)
- [CVE-2021-22001](https://cve.now/CVE-2021-22001.md): In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request o (no CVSS, Cloud Foundry UAA server)
- [CVE-2019-20467](https://cve.now/CVE-2019-20467.md): An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. (no CVSS)
- [CVE-2021-30110](https://cve.now/CVE-2021-30110.md): dttray.exe in Greyware Automation Products Inc Domain Time II before 5.2.b.20210331 allows remote attackers to execute arbitrary code via a (no CVSS)
- [CVE-2021-30486](https://cve.now/CVE-2021-30486.md): SysAid 20.3.64 b14 is affected by Blind and Stacker SQL injection via AssetManagementChart.jsp (GET computerID), AssetManagementChart.jsp (P (no CVSS)
- [CVE-2021-30049](https://cve.now/CVE-2021-30049.md): SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI. (no CVSS)
- [CVE-2021-35522](https://cve.now/CVE-2021-35522.md): A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2, Sigma devices before 4.9.4, (no CVSS)
- [CVE-2021-35521](https://cve.now/CVE-2021-35521.md): A path traversal in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows remote authenticated at (no CVSS)
- [CVE-2021-35520](https://cve.now/CVE-2021-35520.md): A Buffer Overflow in Thrift command handlers in IDEMIA Morpho Wave Compact and VisionPass devices before 2.6.2 allows physically proximate a (no CVSS)
- [CVE-2021-22523](https://cve.now/CVE-2021-22523.md): XML External Entity vulnerability in Micro Focus Verastream Host Integrator, affecting version 7.8 Update 1 and earlier versions. (no CVSS, Verastream Host Integrator.)
- [CVE-2021-22522](https://cve.now/CVE-2021-22522.md): Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier v (no CVSS, Verastream Host Integrator.)
- [CVE-2021-20596](https://cve.now/CVE-2021-20596.md): NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U- (no CVSS, MELSEC-F Series FX3U-ENET; FX3U-ENET-L; FX3U-ENET-P502)
- [CVE-2021-28131](https://cve.now/CVE-2021-28131.md): Impala logs contain secrets (no CVSS, Apache Software Foundation Apache Impala)
- [CVE-2021-36934](https://cve.now/CVE-2021-36934.md): Windows Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-1096](https://cve.now/CVE-2021-1096.md): NVIDIA Windows GPU Display Driver for Windows contains a vulnerability in the NVIDIA kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEsc (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2021-1092](https://cve.now/CVE-2021-1092.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the NVIDIA Control Panel application where it is susceptible to a Windows (CVSS 7.1, NVIDIA GPU Display Driver)
- [CVE-2021-1091](https://cve.now/CVE-2021-1091.md): NVIDIA GPU Display driver for Windows contains a vulnerability where an unprivileged user can create a file hard link that causes the driver (CVSS 7.1, NVIDIA GPU Display Driver)
- [CVE-2021-1089](https://cve.now/CVE-2021-1089.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary co (CVSS 7.8, NVIDIA GPU Display Driver)
- [CVE-2020-22283](https://cve.now/CVE-2020-22283.md): A buffer overflow vulnerability in the icmp6\_send\_response\_with\_addrs\_and\_netif() function of Free Software Foundation lwIP version git head (no CVSS)
- [CVE-2021-1090](https://cve.now/CVE-2021-1090.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for control calls w (CVSS 7.1, NVIDIA GPU Display Driver)
- [CVE-2021-1093](https://cve.now/CVE-2021-1093.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in firmware where the driver contains an assert() or similar statem (CVSS 6.2, NVIDIA GPU Display Driver)
- [CVE-2021-1094](https://cve.now/CVE-2021-1094.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape w (CVSS 6.1, NVIDIA GPU Display Driver)
- [CVE-2021-1095](https://cve.now/CVE-2021-1095.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handlers for all control ca (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2021-32785](https://cve.now/CVE-2021-32785.md): Format string bug in the Redis cache implementation (CVSS 5.3, zmartzone mod\_auth\_openidc)
- [CVE-2021-32786](https://cve.now/CVE-2021-32786.md): Open Redirect in oidc\_validate\_redirect\_url() (CVSS 4.7, zmartzone mod\_auth\_openidc)
- [CVE-2021-35942](https://cve.now/CVE-2021-35942.md): The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse\_param (in posix/wordexp.c) wh (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.