CVEs published in July 2021
1,759 vulnerabilities, 199 critical, 18 exploited.
- flatpressCross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in...8.8 High
- fetchmail, fedoraproject fedora +1 morereport_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the...7.5 High
- ibm powervm hypervisorThe PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950)...4.4 Medium
- vscode-phpmd project vscode-phpmdThe unofficial vscode-phpmd (aka PHP Mess Detector) extension before 1.3.0 for Visual Studio Code...9.8 Critical
- atlassian jira core data center, jira data center, jira service management data center +3 more +5 moreJira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5...9.8 Critical
- apache juddiRemote code execution via RMI9.8 Critical
c-blosc2OSS-FuzzHeap-buffer-overflow in ZSTD_decompressBlock_internalNo scoreunicornOSS-FuzzSegv on unknown address in helper_uc_tracecodeNo score- egain chateGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.6.1 Medium
- meow hash project hashMeow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query...5.3 Medium
mariadb-10.3Ubuntumariadb-10.3 regressionNo score- github.com/whyrusleeping/tar-utils, tar-utils project tar-utils +1 morePath traversal in github.com/whyrusleeping/tar-utils9.1 Critical
- tidesec wdscannerCross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.6.1 Medium
drupal/pages_restrictionPackagistThis project enables administrators to restrict access from anonymous and regular users to pre-defined pages. The administration routes used by the project lacked proper permissions, allowing untruste…No score- elfinder.aspnet project elfinder.aspnetDirectory Traversal7.5 High
- curly-bracket-parser project curly-bracket-parserCross-site Scripting (XSS)5.4 Medium
- deepmergefn project deepmergefnPrototype Pollution5.6 Medium
- learning management system project management systemArbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows...9.8 Critical
- simple food website project food websiteA SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker...9.8 Critical
- basic shopping cart project shopping cartA SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker...9.8 Critical
- prosodymuc.lib.lua in Prosody 0.11.0 through 0.11.9 allows remote attackers to obtain sensitive...7.5 High
- ibm engineering lifecycle optimization, engineering test management, engineering workflow management +7 more +9 moreIBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows...5.4 Medium
- ibm engineering lifecycle optimization, engineering test management, engineering workflow management +7 more +9 moreIBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow...6.3 Medium
- replicated classicReplicated Classic 2.x versions have an improperly secured API that exposes sensitive data from...7.5 High
- opensuse factory, suse linux enterprise server, opensuse factory +2 more +4 moreclone-master-clean-up: dangerous file system operations3.2 Low
- suse rancher, rancher k3s, rancher rke2 +2 moreK3s/RKE2 bootstrap data is encrypted with empty string if user does not supply a token6.5 Medium
- unknown video.js, fedoraproject fedora +1 moreCross-site Scripting (XSS)6.5 Medium
- replaysorcery project replaysorceryreplay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a...7.8 High
- groupsession, groupsession bycloud, zion +2 moreOpen redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the...6.1 Medium
- groupsession, groupsession bycloud, zion +2 moreServer-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from...4.3 Medium
- groupsession, groupsession bycloud, zion +2 moreCross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to...4.8 Medium
- groupsession, groupsession bycloud, zion +2 moreCross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from...4.3 Medium
- groupsession, groupsession bycloud, zion +2 moreCross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to...4.8 Medium
- softbank optical bb unit e-wmta2.3, optical bb unit e-wmta firmware +1 moreCross-site request forgery (CSRF) vulnerability in Optical BB unit E-WMTA2.3 allows a remote...8.8 High
- dell data protection advisor, emc data protection advisor +1 moreDell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented account with...7.5 High
- dell emc avamar server, avamar virtual edition, emc integrated data protection appliance firmware +2 moreDeserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7...9.8 Critical
- dell emc isilon onefs, emc powerscale onefs, powerscale onefs +2 moreDell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported...6.3 Medium
- kernel util-linux, netapp ontap select deploy administration utility, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreAn integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an...5.5 Medium
- bluez, fedoraproject fedora +1 morebluetoothd from bluez incorrectly saves adapters' Discoverable status when a device is powered...6.5 Medium
- telegram web k alphaTelegram Web K Alpha 0.6.1 allows XSS via a document name.6.1 Medium
- freerdpIn FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_SIZE File Contents Request PDU.9.8 Critical
- freerdpIn FreeRDP before 2.4.0 on Windows, wf_cliprdr_server_file_contents_request in client/Windows/wf_cliprdr.c has missing input checks for a FILECONTENTS_RANGE File Contents Request PDU.9.8 Critical
- peel shoppingPEEL Shopping before 9.4.0.1 allows remote SQL injection. A public user/guest (unauthenticated)...9.1 Critical
- s-cmsA stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows...4.8 Medium
- s-cmsA stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows...4.8 Medium
- s-cmsA cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute...4.8 Medium
- s-cmsA remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to...7.2 High
- jhu charmIn Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.6.5 Medium
- jhu charmIn Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.5.9 Medium
- xmldomMisinterpretation of malicious XML input in xmldom6.5 Medium
- Show moreLoading…