# CVEs published 2021-07-29

28 CVEs were published on July 29, 2021: 2 critical, 5 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-36742](https://cve.now/CVE-2021-36742.md): A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10. (CVSS 7.8, KEV, Trend Micro Apex One · Trend Micro OfficeScan +1)
- [CVE-2021-36741](https://cve.now/CVE-2021-36741.md): An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1 (CVSS 8.8, KEV, Trend Micro Apex One · Trend Micro OfficeScan +1)
- [CVE-2021-25273](https://cve.now/CVE-2021-25273.md): Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706. (no CVSS, Sophos UTM)
- [CVE-2021-20114](https://cve.now/CVE-2021-20114.md): When installed following the default/recommended settings, TCExam \<= 14.8.1 allowed unauthenticated users to access the /cache/backup/ direc (no CVSS, TCExam)
- [CVE-2021-20113](https://cve.now/CVE-2021-20113.md): An exposure of sensitive information vulnerability exists in TCExam \<= 14.8.1. (no CVSS, TCExam)
- [CVE-2021-20112](https://cve.now/CVE-2021-20112.md): A stored cross-site scripting vulnerability exists in TCExam \<= 14.8.1. (no CVSS, TCExam)
- [CVE-2021-20111](https://cve.now/CVE-2021-20111.md): A stored cross-site scripting vulnerability exists in TCExam \<= 14.8.1. (no CVSS, TCExam)
- [CVE-2021-23418](https://cve.now/CVE-2021-23418.md): XML External Entity (XXE) Injection (CVSS 6.3, Glances)
- [CVE-2021-37144](https://cve.now/CVE-2021-37144.md): CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. (no CVSS)
- [CVE-2021-36624](https://cve.now/CVE-2021-36624.md): Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that allows for authenticat (no CVSS)
- [CVE-2021-36621](https://cve.now/CVE-2021-36621.md): Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2020-18175](https://cve.now/CVE-2020-18175.md): SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety\_emailadd action in basic.php. (no CVSS)
- [CVE-2020-18158](https://cve.now/CVE-2020-18158.md): Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php. (no CVSS)
- [CVE-2020-18157](https://cve.now/CVE-2020-18157.md): Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php. (no CVSS)
- [CVE-2021-21546](https://cve.now/CVE-2021-21546.md): Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. (CVSS 7.8, Dell NetWorker)
- [CVE-2021-21538](https://cve.now/CVE-2021-21538.md): Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerability. (CVSS 9.6, Integrated Dell Remote Access Controller)
- [CVE-2020-5353](https://cve.now/CVE-2020-5353.md): The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System ( (CVSS 8.8, Dell Isilon OneFS)
- [CVE-2020-5329](https://cve.now/CVE-2020-5329.md): Dell EMC Avamar Server contains an open redirect vulnerability. (CVSS 6.1, Dell Avamar)
- [CVE-2020-21809](https://cve.now/CVE-2020-21809.md): SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group\_price o (no CVSS, nukeviet/nukeviet)
- [CVE-2020-21808](https://cve.now/CVE-2020-21808.md): SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php. (no CVSS, nukeviet/nukeviet)
- [CVE-2020-22765](https://cve.now/CVE-2020-22765.md): Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module. (no CVSS, nukeviet/nukeviet)
- [CVE-2020-22761](https://cve.now/CVE-2020-22761.md): Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php. (no CVSS)
- [CVE-2021-36386](https://cve.now/CVE-2021-36386.md): report\_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va\_list argument, which might allow mai (no CVSS)
- [CVE-2021-20505](https://cve.now/CVE-2021-20505.md): The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be comp (CVSS 4.4, IBM PowerVM Hypervisor)
- [CVE-2021-30124](https://cve.now/CVE-2021-30124.md): The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attackers to execute arbitra (no CVSS)
- [CVE-2020-36239](https://cve.now/CVE-2020-36239.md): Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 b (CVSS 9.8, Atlassian Jira Data Center · Atlassian Jira Core Data Ce… +2)
- [CVE-2021-37578](https://cve.now/CVE-2021-37578.md): Remote code execution via RMI (no CVSS, Apache Software Foundation Apache jUDDI · org.apache.juddi:…)
- [CVE-2021-31799](https://cve.now/CVE-2021-31799.md): In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a (CVSS 7.0, rdoc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.