# CVEs published 2021-07-28

27 CVEs were published on July 28, 2021: 1 critical, 3 high. Days are UTC.

- [CVE-2020-15948](https://cve.now/CVE-2020-15948.md): eGain Chat 15.5.5 allows XSS via the Name (aka full\_name) field. (no CVSS)
- [CVE-2021-37606](https://cve.now/CVE-2021-37606.md): Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision in the bottom bits o (no CVSS)
- [CVE-2020-21854](https://cve.now/CVE-2020-21854.md): Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page. (no CVSS)
- [CVE-2021-23415](https://cve.now/CVE-2021-23415.md): Directory Traversal (CVSS 7.5, elFinder.AspNet)
- [CVE-2021-23416](https://cve.now/CVE-2021-23416.md): Cross-site Scripting (XSS) (CVSS 5.4, curly-bracket-parser)
- [CVE-2021-23417](https://cve.now/CVE-2021-23417.md): Prototype Pollution (CVSS 5.6, deepmergefn)
- [CVE-2021-25200](https://cve.now/CVE-2021-25200.md): Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the f (no CVSS)
- [CVE-2021-34166](https://cve.now/CVE-2021-34166.md): A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin. (no CVSS)
- [CVE-2021-34165](https://cve.now/CVE-2021-34165.md): A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin. (no CVSS)
- [CVE-2021-37601](https://cve.now/CVE-2021-37601.md): muc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive information (list of admins, members, owners, and b (CVSS 7.5)
- [CVE-2020-5004](https://cve.now/CVE-2020-5004.md): IBM Jazz Foundation products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Rational Quality Manager +6)
- [CVE-2020-4974](https://cve.now/CVE-2020-4974.md): IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). (CVSS 6.3, IBM Engineering Test Management · IBM Rational Team Conc… +6)
- [CVE-2020-10590](https://cve.now/CVE-2020-10590.md): Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. (no CVSS)
- [CVE-2021-32000](https://cve.now/CVE-2021-32000.md): clone-master-clean-up: dangerous file system operations (CVSS 3.2, SUSE Linux Enterprise Server 12 SP3 · SUSE Linux Enterpr… +1)
- [CVE-2021-32001](https://cve.now/CVE-2021-32001.md): K3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token (CVSS 6.5, SUSE Rancher)
- [CVE-2021-23414](https://cve.now/CVE-2021-23414.md): Cross-site Scripting (XSS) (CVSS 6.5, video.js)
- [CVE-2021-36983](https://cve.now/CVE-2021-36983.md): replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp/replay-sorcery or /t (no CVSS)
- [CVE-2021-20789](https://cve.now/CVE-2021-20789.md): Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud (no CVSS, Japan Total System Co. GroupSession)
- [CVE-2021-20788](https://cve.now/CVE-2021-20788.md): Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, (no CVSS, Japan Total System Co. GroupSession)
- [CVE-2021-20787](https://cve.now/CVE-2021-20787.md): Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession b (no CVSS, Japan Total System Co. GroupSession)
- [CVE-2021-20786](https://cve.now/CVE-2021-20786.md): Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, G (no CVSS, Japan Total System Co. GroupSession)
- [CVE-2021-20785](https://cve.now/CVE-2021-20785.md): Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession b (no CVSS, Japan Total System Co. GroupSession)
- [CVE-2021-20783](https://cve.now/CVE-2021-20783.md): Cross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote attacker to hijack the authentication of admini (no CVSS, SoftBank Optical BB unit E-WMTA2.3)
- [CVE-2020-5351](https://cve.now/CVE-2020-5351.md): Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with limited privileges that is protected with a (CVSS 7.5, Dell Data Protection Advisor)
- [CVE-2020-5341](https://cve.now/CVE-2020-5341.md): Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integr (CVSS 9.8, Dell Avamar Virtual Edition)
- [CVE-2020-26180](https://cve.now/CVE-2020-26180.md): Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an access issue with th (CVSS 6.3, Dell PowerScale OneFS)
- [CVE-2021-37600](https://cve.now/CVE-2021-37600.md): An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.