Skip to content
OpenAdvisories

Archive

29 July 2021

Vulnerabilities first published on this day (UTC), newest first.

← June 2021 2021 / July /29 August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

28 results · Feed

  • High 7.8
    CVE-2021-36742 Exploited

    A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free …

    Trend Micro Trend Micro Apex One Trend Micro OfficeScan Trend Micro Worry-Free Business Security
    KEV Nov 3, 2021
  • High 8.8
    CVE-2021-36741 Exploited

    An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Fre…

    Trend Micro Trend Micro Apex One Trend Micro OfficeScan Trend Micro Worry-Free Business Security
    KEV Nov 3, 2021
  • Unscored —
    CVE-2021-25273

    Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

    Sophos Sophos UTM Network devices
  • Unscored —
    CVE-2021-20114

    When installed following the default/recommended settings, TCExam <= 14.8.1 allowed unauthenticated users to access the…

  • Unscored —
    CVE-2021-20113

    An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for…

  • Unscored —
    CVE-2021-20112

    A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.p…

  • Unscored —
    CVE-2021-20111

    A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php wi…

  • Medium 6.3
    CVE-2021-23418

    XML External Entity (XXE) Injection

    The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.

    glances glances glances Debian Ubuntu PyPI
  • Unscored —
    CVE-2021-37144

    CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and use…

  • Unscored —
    CVE-2021-36624

    Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that a…

  • Unscored —
    CVE-2021-36621

    Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is …

  • Unscored —
    CVE-2020-18175

    SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php.

  • Unscored —
    CVE-2020-18158

    Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.

  • Unscored —
    CVE-2020-18157

    Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php.

  • High 7.8
    CVE-2021-21546

    Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vul…

    Dell NetWorker
  • Critical 9.6
    CVE-2021-21538

    Dell EMC iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.10.00, contain an improper authentication vulnerabilit…

    Dell Integrated Dell Remote Access Controller (iDRAC)
  • High 8.8
    CVE-2020-5353

    The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for …

    Dell Isilon OneFS
  • Medium 6.1
    CVE-2020-5329

    Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vuln…

    Dell Avamar
  • Critical 9.8
    CVE-2020-21809

    NukeViet SQL Injection vulnerability

    SQL Injection vulnerability in NukeViet CMS module Shops 4.0.29 and 4.3 via the (1) listid parameter in detail.php and the (2) group_price or groupid parameters in search_result.php.

    nukeviet/nukeviet Packagist
  • Critical 9.8
    CVE-2020-21808

    NukeViet SQL Injection vulnerability via topicsid parameter

    SQL Injection vulnerability in NukeViet CMS 4.0.10 - 4.3.07 via:the topicsid parameter in modules/news/admin/addtotopics.php.

    nukeviet/nukeviet Packagist
  • Medium 6.1
    CVE-2020-22765

    NukeViet Cross-site Scripting via the editor in the News module

    Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.

    nukeviet/nukeviet Packagist
  • Unscored —
    CVE-2020-22761

    Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.

  • Unscored —
    CVE-2021-36386

    report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument, …

    fetchmail fetchmail fetchmail Debian Ubuntu Alpine
  • Medium 4.4
    CVE-2021-20505

    The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange…

    IBM PowerVM Hypervisor
  • Unscored —
    CVE-2021-30124

    The unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code allows remote attacke…

  • Critical 9.8
    CVE-2020-36239 EPSS 50%

    Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before …

    Atlassian Jira Data Center Jira Service Management Data Center Jira Software Data Center Web / CMS
  • Critical 9.8
    CVE-2021-37578

    Remote code execution via RMI

    Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services. RMI uses the default Java serialization mechanism to pass parameters in RMI invocat…

    Apache Software Foundation Apache jUDDI org.apache.juddi:juddi-core Maven
  • High 7.0
    CVE-2021-31799

    Arbitrary Code Execution in Rdoc

    In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine RubyGems