Skip to content
OpenAdvisories

Archive

July 2021

Vulnerabilities first published in this month (UTC), newest first.

← June 2021 2021 / July August 2021 →
  1. 157
  2. 263
  3. 3 
  4. 4 
  5. 56
  6. 626
  7. 7108
  8. 866
  9. 961
  10. 102
  11. 115
  12. 1288
  13. 13139
  14. 14172
  15. 1583
  16. 1657
  17. 175
  18. 181
  19. 1961
  20. 20174
  21. 2185
  22. 2290
  23. 2320
  24. 241
  25. 2534
  26. 2662
  27. 2740
  28. 2828
  29. 2928
  30. 3016
  31. 316
All Critical High Medium Low Exploited only Public exploit

1,584 results · Feed

  • Medium 5.3
    CVE-2021-29767

    IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain sensitive information…

    IBM i2 Analyst's Notebook Premium
  • Medium 5.3
    CVE-2021-29766

    IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sens…

    IBM i2 Analyze
  • Medium 5.4
    CVE-2021-20560

    IBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote attacker to hijack the clic…

    IBM Sterling Connect:Direct Browser User Interface
  • Medium 4.3
    CVE-2021-20431

    IBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after logout which could allow an…

    IBM i2 Analyst's Notebook Premium
  • Medium 5.3
    CVE-2021-20430

    IBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote attacker to obtain sens…

    IBM i2 Analyze
  • Medium 5.9
    CVE-2021-20337

    IBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected cryptographic algorithms that co…

    IBM QRadar SIEM
  • High 7.7
    CVE-2020-4623

    IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL…

    IBM i2 iBase
  • Medium 5.7
    CVE-2021-22144

    Denial of Service in Elasticsearch

    In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch coul…

    elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Unscored —
    CVE-2020-12681

    Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/c…

  • Low 3.5
    CVE-2021-35030

    A vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did not properly sterilize …

    Zyxel GS1900-8 firmware Network devices
  • High 7.5
    CVE-2021-33900

    StartTLS and SASL confidentiality protection bypass

    While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidential…

    Apache Software Foundation Apache Directory Studio org.apache.directory.studio:org.apache.directory.studio.parent apache-directory-server Ubuntu Maven
  • Medium 6.5
    CVE-2021-36092

    XSS attack using special link in email

    It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versio…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Ubuntu
  • Low 3.5
    CVE-2021-36091

    Unautorized access to the calendar appointments

    Agents are able to list appointments in the calendars without required permissions. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Low 3.5
    CVE-2021-21443

    Unautorized listing of the customer user emails

    Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG ((OTRS)) Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27.

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 4.5
    CVE-2021-21442

    XSS vulnerability in Time Accounting

    In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19.

    OTRS Time Accounting
  • Medium 5.2
    CVE-2021-21440

    Support Bundle includes S/Mime and PGP keys

    Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.27 and prior versions; 8.0.x versi…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Debian Ubuntu
  • Medium 5.9
    CVE-2021-32791

    Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

    mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encrypt…

    ZmartZone mod_auth_openidc httpd libapache2-mod-auth-openidc Debian Ubuntu Azure Linux
  • Low 3.1
    CVE-2021-32792

    XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

    mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vul…

    ZmartZone mod_auth_openidc httpd libapache2-mod-auth-openidc Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2021-31292

    An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow an…

    exiv2 exiv2 Debian PyPI
  • Medium 5.3
    CVE-2021-3664

    Open Redirect in unshiftio/url-parse

    url-parse is vulnerable to URL Redirection to Untrusted Site

    unshiftio unshiftio/url-parse url-parse node-url-parse Debian Ubuntu npm
  • Unscored —
    CVE-2021-37439

    NCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.

  • Unscored —
    CVE-2021-37440

    NCH Axon PBX v2.22 and earlier allows path traversal for file disclosure via the logprop?file=/.. substring.

  • Unscored —
    CVE-2021-37441

    NCH Axon PBX v2.22 and earlier allows path traversal for file deletion via the logdelete?file=/.. substring.

  • Unscored —
    CVE-2021-37442

    NCH IVM Attendant v5.12 and earlier allows path traversal via viewfile?file=/.. to read files.

  • Unscored —
    CVE-2021-37443

    NCH IVM Attendant v5.12 and earlier allows path traversal via the logdeleteselected check0 parameter for file deletion.

  • Unscored —
    CVE-2021-37444

    NCH IVM Attendant v5.12 and earlier suffers from a directory traversal weakness upon uploading plugins in a ZIP archive…

  • Unscored —
    CVE-2021-37445

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via logprop?file=/.. for file readin…

  • Unscored —
    CVE-2021-37446

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentprop?file=/.. for file r…

  • Unscored —
    CVE-2021-37447

    In NCH Quorum v2.03 and earlier, an authenticated user can use directory traversal via documentdelete?file=/.. for file…

  • Unscored —
    CVE-2021-37448

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via the Mailbox name (stored).

  • Unscored —
    CVE-2021-37449

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).

  • Unscored —
    CVE-2021-37450

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).

  • Unscored —
    CVE-2021-37451

    Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).

  • Unscored —
    CVE-2021-37452

    NCH Quorum v2.03 and earlier allows local users to discover cleartext login information relating to users by reading th…

  • Unscored —
    CVE-2021-37453

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the extension name (stored).

  • Unscored —
    CVE-2021-37454

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the line name (stored).

  • Unscored —
    CVE-2021-37455

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the outbound dialing plan (stored).

  • Unscored —
    CVE-2021-37456

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the blacklist IP address (stored).

  • Unscored —
    CVE-2021-37457

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the SipRule field (stored).

  • Unscored —
    CVE-2021-37458

    Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via the primary phone field (stored).