# CVEs published 2021-07-23

20 CVEs were published on July 23, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-32783](https://cve.now/CVE-2021-32783.md): Authorization bypass in Contour (CVSS 8.5, projectcontour contour · github.com/projectcontour/contour)
- [CVE-2021-25809](https://cve.now/CVE-2021-25809.md): UCMS 1.5.0 was discovered to contain a physical path leakage via an error message returned by the adminchannelscache() function in top.php. (no CVSS)
- [CVE-2021-25808](https://cve.now/CVE-2021-25808.md): A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a crafted ZIP file. (no CVSS)
- [CVE-2020-20741](https://cve.now/CVE-2020-20741.md): Incorrect Access Control in Beckhoff Automation GmbH & Co. (no CVSS)
- [CVE-2021-25791](https://cve.now/CVE-2021-25791.md): Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows aut (no CVSS)
- [CVE-2021-25790](https://cve.now/CVE-2021-25790.md): Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenti (no CVSS)
- [CVE-2021-23412](https://cve.now/CVE-2021-23412.md): Command Injection (CVSS 8.1, gitlogplus)
- [CVE-2021-3159](https://cve.now/CVE-2021-3159.md): A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows (no CVSS)
- [CVE-2021-25201](https://cve.now/CVE-2021-25201.md): SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id p (no CVSS)
- [CVE-2021-25204](https://cve.now/CVE-2021-25204.md): Cross-site scripting (XSS) vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2021-25203](https://cve.now/CVE-2021-25203.md): Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \\CMSsite-master\\ad (no CVSS)
- [CVE-2021-25206](https://cve.now/CVE-2021-25206.md): Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the fi (no CVSS)
- [CVE-2021-25208](https://cve.now/CVE-2021-25208.md): Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file (no CVSS)
- [CVE-2021-25207](https://cve.now/CVE-2021-25207.md): Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file uploa (no CVSS)
- [CVE-2021-20333](https://cve.now/CVE-2021-20333.md): Server log entry spoofing via newline injection (CVSS 5.3, MongoDB Server)
- [CVE-2021-26799](https://cve.now/CVE-2021-26799.md): Cross Site Scripting (XSS) vulnerability in admin/files/edit in Omeka Classic \<=2.7 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2020-14032](https://cve.now/CVE-2020-14032.md): ASRock 4x4 BOX-R1000 before BIOS P1.40 allows privilege escalation via code execution in the SMM. (no CVSS)
- [CVE-2021-24036](https://cve.now/CVE-2021-24036.md): Passing an attacker controlled size when creating an IOBuf could cause integer overflow, leading to an out of bounds write on the heap with (no CVSS, Facebook folly · Facebook HHVM)
- [CVE-2021-3169](https://cve.now/CVE-2021-3169.md): An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not (no CVSS)
- [CVE-2021-32686](https://cve.now/CVE-2021-32686.md): Denial of Service in PJSIP (CVSS 5.9, pjsip pjproject)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.