# CVEs published 2021-07-27

40 CVEs were published on July 27, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2021-37596](https://cve.now/CVE-2021-37596.md): Telegram Web K Alpha 0.6.1 allows XSS via a document name. (no CVSS)
- [CVE-2021-37594](https://cve.now/CVE-2021-37594.md): In FreeRDP before 2.4.0 on Windows, wf\_cliprdr\_server\_file\_contents\_request in client/Windows/wf\_cliprdr.c has missing input checks for a FI (no CVSS)
- [CVE-2021-37595](https://cve.now/CVE-2021-37595.md): In FreeRDP before 2.4.0 on Windows, wf\_cliprdr\_server\_file\_contents\_request in client/Windows/wf\_cliprdr.c has missing input checks for a FI (no CVSS)
- [CVE-2021-37593](https://cve.now/CVE-2021-37593.md): PEEL Shopping version 9.4.0 allows remote SQL injection. (no CVSS)
- [CVE-2020-20701](https://cve.now/CVE-2020-20701.md): A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML (no CVSS)
- [CVE-2020-20700](https://cve.now/CVE-2020-20700.md): A stored cross site scripting (XSS) vulnerability in /app/form\_add/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-20699](https://cve.now/CVE-2020-20699.md): A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload (no CVSS)
- [CVE-2020-20698](https://cve.now/CVE-2020-20698.md): A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file. (no CVSS)
- [CVE-2021-37587](https://cve.now/CVE-2021-37587.md): In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data. (no CVSS)
- [CVE-2021-37588](https://cve.now/CVE-2021-37588.md): In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data. (no CVSS)
- [CVE-2021-32796](https://cve.now/CVE-2021-32796.md): Misinterpretation of malicious XML input in xmldom (CVSS 6.5, xmldom · @xmldom/xmldom)
- [CVE-2021-32788](https://cve.now/CVE-2021-32788.md): Post creator of a whisper post can be revealed to non-staff users in Discourse (CVSS 4.3, discourse)
- [CVE-2021-32748](https://cve.now/CVE-2021-32748.md): WOPI API not protected by credentials/IP check (CVSS 4.3, nextcloud security-advisories)
- [CVE-2021-30483](https://cve.now/CVE-2021-30483.md): isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository. (no CVSS, isomorphic-git)
- [CVE-2020-19118](https://cve.now/CVE-2020-19118.md): Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site\_code parameter in admin/index/init.html. (no CVSS)
- [CVE-2020-21806](https://cve.now/CVE-2020-21806.md): SQL Injection Vulnerability in ECTouch v2 via the shop page in index.php.. (no CVSS)
- [CVE-2021-28966](https://cve.now/CVE-2021-28966.md): In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. (no CVSS, tmpdir)
- [CVE-2021-28674](https://cve.now/CVE-2021-28674.md): The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node (outside of the atta (no CVSS)
- [CVE-2021-34432](https://cve.now/CVE-2021-34432.md): In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0. (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2020-18013](https://cve.now/CVE-2020-18013.md): SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin\_banned/add.htm. (no CVSS)
- [CVE-2021-36605](https://cve.now/CVE-2021-36605.md): engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2020-16839](https://cve.now/CVE-2020-16839.md): On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an un (no CVSS)
- [CVE-2020-14999](https://cve.now/CVE-2020-14999.md): A logic bug in system monitoring driver of Acronis Agent after 12.5.21540 and before 12.5.23094 allowed to bypass Windows memory protection (no CVSS)
- [CVE-2021-36004](https://cve.now/CVE-2021-36004.md): Adobe InDesign CoolType out of bounds write vulnerability could lead to arbitrary stack manipulation (CVSS 8.8, Adobe InDesign)
- [CVE-2021-35479](https://cve.now/CVE-2021-35479.md): Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affect (no CVSS)
- [CVE-2021-35478](https://cve.now/CVE-2021-35478.md): Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. (no CVSS)
- [CVE-2021-34802](https://cve.now/CVE-2021-34802.md): A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users (no CVSS, org.neo4j:neo4j-kernel)
- [CVE-2021-20562](https://cve.now/CVE-2021-20562.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5\_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2021-20399](https://cve.now/CVE-2021-20399.md): IBM Qradar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA is vulnerable to an XML External Entity Injection (XXE) attack when processing (CVSS 7.1, IBM QRadar SIEM)
- [CVE-2021-36766](https://cve.now/CVE-2021-36766.md): Concrete5 through 8.5.5 deserializes Untrusted Data. (no CVSS)
- [CVE-2021-36754](https://cve.now/CVE-2021-36754.md): PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes a (no CVSS)
- [CVE-2021-35472](https://cve.now/CVE-2021-35472.md): An issue was discovered in LemonLDAP::NG before 2.0.12. (no CVSS)
- [CVE-2021-35458](https://cve.now/CVE-2021-35458.md): Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter. (no CVSS)
- [CVE-2021-32610](https://cve.now/CVE-2021-32610.md): In Archive\_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. (no CVSS, pear/archive\_tar · drupal/core)
- [CVE-2021-32558](https://cve.now/CVE-2021-32558.md): An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certif (no CVSS)
- [CVE-2021-31878](https://cve.now/CVE-2021-31878.md): An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. (no CVSS)
- [CVE-2021-28095](https://cve.now/CVE-2021-28095.md): OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash collisions can occur, du (no CVSS)
- [CVE-2021-28093](https://cve.now/CVE-2021-28093.md): OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due to use of Adler32. (no CVSS)
- [CVE-2021-28094](https://cve.now/CVE-2021-28094.md): OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur, due to use of CRC32. (no CVSS)
- [CVE-2020-11511](https://cve.now/CVE-2020-11511.md): The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.