CVEs published in July 2021
1,759 vulnerabilities, 199 critical, 18 exploited.
- twothink project twothinkCode injection in topthink/think9.8 Critical
- evo evolution cmsCross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.5.4 Medium
- archisteamfarm project archisteamfarmDenial of Service via Steam chat in ArchiSteamFarm6.5 Medium
- lavaliteCross Site Scripting in LavaLite CMS4.8 Medium
- archisteamfarm project archisteamfarmAccidental removal of IPCPassword (< 5.1.2.4)6.8 Medium
- autohotkeyA process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to...9.8 Critical
- 1passwordA DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute...7.8 High
- trezor bridgeA code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows...9.8 Critical
- techsmith snagitTechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to...8.8 High
- abloy key managerAn issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows...9.8 Critical
- techsmith snagitA vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows...7.8 High
- checkmkThe CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in...5.4 Medium
- naviwebs navigatecmsIn NavigateCMS version 2.9.4 and below, function `block` is vulnerable to sql injection on...9.8 Critical
- naviwebs navigatecmsIn NavigateCMS version 2.9.4 and below, function in `structure.php` is vulnerable to sql...9.8 Critical
- naviwebs navigatecmsIn NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection...9.8 Critical
- naviwebs navigatecmsIn NavigateCMS version 2.9.4 and below, function in `templates.php` is vulnerable to sql...9.8 Critical
- naviwebs navigatecmsIn NavigateCMS version 2.9.4 and below, function in `product.php` is vulnerable to sql injection...9.8 Critical
- rpcmsIn RPCMS v1.8 and below, attackers can interact with API and change variable "role" to "admin" to...8.8 High
- rpcmsIn RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed...5.4 Medium
- rpcmsIn RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed...5.4 Medium
- automattic woocommerceBlind SQL Injection possible via Authenticated Web-hook Search API Endpoint4.9 Medium
- automattic woocommerce blocks, woocommerce woocommerce-gutenberg-products-block +1 moreArbitrary SQL (SQL injection) possible via the Store API component.7.5 High
- nimble-platform commonJSON Web Tokens not properly verified6.5 Medium
- misp-project mispapp/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.5.4 Medium
- dm fingertool project fingertoolDM FingerTool v1.19 in the DM PD065 Secure USB is susceptible to improper authentication by a replay attack, allowing local attackers to bypass user authentication and access all features and data on…7.1 High
- ibm i2 analyzeIBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2 could allow a remote attacker to obtain sensitive...4.3 Medium
- ibm i2 analyzeIBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow an...4.1 Medium
- ibm i2 analyzeIBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) does not set the...3.1 Low
- ibm i2 analyst's notebook premium, i2 analysts notebook +1 moreIBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 could allow a remote attacker to obtain...5.3 Medium
- ibm i2 analyzeIBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote...5.3 Medium
- ibm sterling connect:direct browser user interface, sterling connect direct user interface +1 moreIBM Sterling Connect:Direct Browser User Interface 1.4.1.1 and 1.5.0.2 could allow a remote...5.4 Medium
- ibm i2 analyst's notebook premium, i2 analysts notebook +1 moreIBM i2 Analyst's Notebook Premium 9.2.0, 9.2.1, and 9.2.2 does not invalidate session after...4.3 Medium
- ibm i2 analyzeIBM i2 Analyst's Notebook Premium (IBM i2 Analyze 4.3.0, 4.3.1, and 4.3.2) could allow a remote...5.3 Medium
- ibm qradar siem, qradar security information and event manager +1 moreIBM QRadar SIEM 7.3.0 to 7.3.3 Patch 8 and 7.4.0 to 7.4.3 GA uses weaker than expected...5.9 Medium
- ibm i2 ibaseIBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the...7.7 High
- elastic elasticsearch, oracle communications cloud native core automated test suite +1 moreDenial of Service in Elasticsearch6.5 Medium
- 3xlogic infinias eidc32 firmwareMissing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an...7.5 High
- zyxel gs1900-8 firmware, gs1900-10hp firmware, gs1900-16 firmware +9 more +11 moreA vulnerability was found in the CGI program in Zyxel GS1900-8 firmware version V2.60, that did...3.5 Low
- apache directory studioStartTLS and SASL confidentiality protection bypass7.5 High
- otrs, otrs ag ((otrs)) community edition +1 moreXSS attack using special link in email6.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized access to the calendar appointments3.5 Low
- otrs, otrs ag ((otrs)) community edition +1 moreUnautorized listing of the customer user emails3.5 Low
- otrs time accountingXSS vulnerability in Time Accounting4.5 Medium
- otrs, otrs ag ((otrs)) community edition +1 moreSupport Bundle includes S/Mime and PGP keys5.2 Medium
wasm3OSS-FuzzUNKNOWN WRITE in CompileBlockNo score- unshiftio unshiftio/url-parse, url-parse project url-parse +1 moreOpen Redirect in unshiftio/url-parse5.3 Medium
- fedoraproject fedora, openidc mod auth openidc +1 moreXSS vulnerability when using OIDCPreservePost On in mod_auth_openidc3.1 Low
- fedoraproject fedora, openidc mod auth openidc +1 moreHardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc5.9 Medium
- exiv2, debian linux, fedoraproject fedora +2 moreAn integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap...7.5 High
- nch flexiserverNCH FlexiServer v6.00 suffers from a syslog?file=/.. path traversal vulnerability.6.5 Medium
- Show moreLoading…