CVEs published July 27, 2021
40 CVEs were published on July 27, 2021: 0 critical, 2 high.
- Published
- 40
- Critical
- 0
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- Adobe InDesign
- 1
- discourse
- 1
- IBM QRadar SIEM
- 1
- IBM Sterling B2B Integrator
- 1
- isomorphic-git
- 1
- nextcloud security-advisories
- 1
- org.neo4j:neo4j-kernel
- 1
- pear/archive_tar · drupal/core
- 1
- The Eclipse Foundation Eclipse Mosquitto
- 1
- tmpdir
- 1
High 2
Medium, low and unrated 38
- CVE-2021-37596Telegram Web K Alpha 0.6.1 allows XSS via a document name.
- CVE-2021-37594In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FI
- CVE-2021-37595In FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FI
- CVE-2021-37593PEEL Shopping version 9.4.0 allows remote SQL injection.
- CVE-2020-20701A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML
- CVE-2020-20700A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HT
- CVE-2020-20699A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2020-20698A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file.
- CVE-2021-37587In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.
- CVE-2021-37588In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.
- CVE-2021-32796Misinterpretation of malicious XML input in xmldomxmldom · @xmldom/xmldom
- CVE-2021-32788Post creator of a whisper post can be revealed to non-staff users in Discoursediscourse
- CVE-2021-32748WOPI API not protected by credentials/IP checknextcloud security-advisories
- CVE-2021-30483isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.isomorphic-git
- CVE-2020-19118Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.
- CVE-2020-21806SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php..
- CVE-2021-28966In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir.tmpdir
- CVE-2021-28674The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the atta
- CVE-2021-34432In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.The Eclipse Foundation Eclipse Mosquitto
- CVE-2020-18013SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm.
- CVE-2021-36605engineercms 1.03 is vulnerable to Cross Site Scripting (XSS).
- CVE-2020-16839On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an un
- CVE-2020-14999A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection
- CVE-2021-35479Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affect
- CVE-2021-35478Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.
- CVE-2021-34802A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users org.neo4j:neo4j-kernel
- CVE-2021-20562IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2021-36766Concrete5 through 8.5.5 deserializes Untrusted Data.
- CVE-2021-36754PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a
- CVE-2021-35472An issue was discovered in LemonLDAP::NG before 2.0.12.
- CVE-2021-35458Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.
- CVE-2021-32610In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.pear/archive_tar · drupal/core
- CVE-2021-32558An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certif
- CVE-2021-31878An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1.
- CVE-2021-28095OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, du
- CVE-2021-28093OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32.
- CVE-2021-28094OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32.
- CVE-2020-11511The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a