Skip to content
OpenAdvisories

Archive

July 2021

Vulnerabilities first published in this month (UTC), newest first.

← June 2021 2021 / July August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

1,584 results · Feed

  • Medium 5.8
    CVE-2021-21406

    Command Injection vulnerability in the Setup Wizard

    Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.

    Combodo iTop
  • Medium 5.4
    CVE-2021-23411

    Cross-site Scripting (XSS)

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the main functionality. It accepts input that can result in the output (an anchor a tag) containing undesirable Javascript code that can be executed upon user interaction.

    anchorme npm
  • Unscored —
    CVE-2020-19609

    Artifex MuPDF before 1.18.0 has a heap based buffer over-write in tiff_expand_colormap() function when parsing TIFF fil…

    mupdf mupdf Debian Ubuntu
  • Unscored —
    CVE-2020-20221

    Mikrotik RouterOs before 6.44.6 (long-term tree) suffers from an uncontrolled resource consumption vulnerability in the…

  • Unscored —
    CVE-2021-37155

    wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request d…

    wolfssl wolfssl Debian Ubuntu
  • Unscored —
    CVE-2020-20262

    Mikrotik RouterOs before 6.47 (stable tree) suffers from an assertion failure vulnerability in the /ram/pckg/security/n…

  • Unscored —
    CVE-2020-20219

    Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/igmp-proxy pr…

  • Unscored —
    CVE-2020-21937

    An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.973…

  • Unscored —
    CVE-2020-21936

    An issue in HNAP1/GetMultipleHNAPs of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to access…

  • Unscored —
    CVE-2020-21935

    A command injection vulnerability in HNAP1/GetNetworkTomographySettings of Motorola CX2 router CX 1.0.2 Build 20190508 …

  • Unscored —
    CVE-2020-21934

    An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where authentication to download the …

  • Unscored —
    CVE-2020-21933

    An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private …

  • Unscored —
    CVE-2020-21932

    A vulnerability in /Login.html of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to bypass log…

  • Unscored —
    CVE-2020-23282

    SQL injection in Logon Page in MV's mConnect application, v02.001.00, allows an attacker to use a non existing user wit…

  • Unscored —
    CVE-2020-23283

    Information disclosure in Logon Page in MV's mConnect application v02.001.00 allows an attacker to know valid users fro…

  • Unscored —
    CVE-2021-25701

    The fUSBHub driver in the PCoIP Software Client prior to version 21.07.0 had an error in object management during the h…

  • Unscored —
    CVE-2021-25695

    The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, whic…

    Windows
  • Unscored —
    CVE-2021-25698

    The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoloa…

  • Unscored —
    CVE-2021-25699

    The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autolo…

  • Unscored —
    CVE-2021-22146 Public exploit EPSS 36%

    All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters…

  • Medium 6.5
    CVE-2021-22145 Public exploit Scanner template EPSS 76%

    Generation of Error Message Containing Sensitive Information in Elasticsearch

    A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing p…

    Elastic Elasticsearch elasticsearch org.elasticsearch.client:elasticsearch-rest-client Ubuntu Maven
  • High 8.8
    CVE-2021-34619

    Cross-Site Request Forgery in WooCommerce Stock Manager WordPress Plugin

    The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/im…

    StoreApps WooCommerce Stock Manager Web / CMS
  • Unscored —
    CVE-2021-22774

    A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions …

  • Unscored —
    CVE-2021-22773

    A CWE-620: Unverified Password Change vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R…

  • Unscored —
    CVE-2021-22730

    A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior t…

  • Unscored —
    CVE-2021-22729

    A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R…

  • Unscored —
    CVE-2021-22728

    A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4…

  • Unscored —
    CVE-2021-22727

    A CWE-331: Insufficient Entropy vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4…

  • Unscored —
    CVE-2021-22726

    A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions pr…

  • Unscored —
    CVE-2021-22723

    A CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-siteScripting) through Cross-Site Request …

  • Unscored —
    CVE-2021-22722

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Stored Cross-site Scripting') vulnerability exi…

  • Unscored —
    CVE-2021-22721

    A CWE-200: Information Exposure vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4…

  • Unscored —
    CVE-2021-22708

    A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 a…

  • Unscored —
    CVE-2021-22707 Scanner template EPSS 65%

    A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior t…

  • Unscored —
    CVE-2021-22706

    A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in …

  • Unscored —
    CVE-2021-22772

    A CWE-306: Missing Authentication for Critical Function vulnerability exists in Easergy T200 ((Modbus) SC2-04MOD-070001…

  • Unscored —
    CVE-2021-22784 EPSS 12%

    A CWE-306: Missing Authentication for Critical Function vulnerability exists in C-Bus Toolkit v1.15.8 and prior that co…

  • Unscored —
    CVE-2021-22777

    A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code execution by opening a maliciou…

  • Unscored —
    CVE-2021-22771

    A CWE-1236: Improper Neutralization of Formula Elements in a CSV File vulnerability exists in Easergy T300 with firmwar…

  • Unscored —
    CVE-2021-22770

    A CWE-200: Information Exposure vulnerability exists in Easergy T300 with firmware V2.7.1 and older that exposes sensit…