CVEs published August 17, 2021
73 CVEs were published on August 17, 2021: 3 critical, 8 high. Browse them by severity, product and exploitation status.
- Published
- 73
- Critical
- 3
- High
- 8
- Medium
- 11
- Low
- 2
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Android
- 18
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 6
- Lenovo Smart Camera X3, X5, and C2E firmware
- 3
- Mozilla Firefox · Mozilla Thunderbird
- 3
- dolibarr · dolibarr/dolibarr
- 2
- Motorola MM1000 MoCA Adapter
- 2
- Mozilla Firefox
- 2
- Rukovoditel
- 2
- AT&T Labs
- 1
- BlackBerry QNX Software Development Platform (SDP), QNX OS…
- 1
Critical 3
- CVE-2021-22156An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software…BlackBerry QNX Software Development Platform (SDP), QNX OS…
- CVE-2021-3616A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information…Lenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-32829Post-authentication Remote Code Execution (RCE) in ZStack REST APIzstackio zstack
High 8
- CVE-2021-0284Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore)Juniper Networks Junos OS
- CVE-2021-39131Improper Handling of Unexpected Data Type in cedsonicdoe ced · ced
- CVE-2021-21810A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7.AT&T Labs
- CVE-2020-28594A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and…Prusa Research
- CVE-2021-21832A memory corruption vulnerability exists in the ISO Parsing functionality of Disc Soft Ltd Deamon Tools Pro 8.3.0.0767.Disc
- CVE-2021-3633A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege…Lenovo Driver Management
- CVE-2021-3617A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted…Lenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-25957Account Takeover in "Dolibarr" via Password Reset Functionalitydolibarr · dolibarr/dolibarr
Medium, low and unrated 62
- CVE-2021-39249Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files…
- CVE-2021-39250Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an…
- CVE-2021-28372ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte…
- CVE-2020-23341A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute…
- CVE-2020-23333A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9.
- CVE-2020-23334A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a…
- CVE-2020-23331An issue was discovered in Bento4 version 06c39d9.
- CVE-2020-23332A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of…
- CVE-2020-23330An issue was discovered in Bento4 version 06c39d9.
- CVE-2021-39248Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
- CVE-2021-39247Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is_last_single_ascii in code1.c, and rs_encode_uint in…
- CVE-2021-38702Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.
- CVE-2020-18164SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.
- CVE-2020-13589An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2020-13588An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2021-29980Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable…Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29981An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code…Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-29982Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a…Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-29983Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit.Mozilla Firefox
- CVE-2021-29984Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage…Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29985A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29986A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29987After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a…Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-29988Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a…Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29989Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.Mozilla Thunderbird · Mozilla Firefox ESR +1
Show all 62 entriesShow fewer entries
- CVE-2021-29990Mozilla developers and community members reported memory safety bugs present in Firefox 90.Mozilla Firefox
- CVE-2021-3619Rapid7 Velociraptor Notebooks Authenticated Persistent XSSRapid7 Velociraptor
- CVE-2020-22937A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious…
- CVE-2021-25263Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute…Yandex Browser
- CVE-2021-39240An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-39241An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-39242An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-0639In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive…Android
- CVE-2021-0640In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0576In flv extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0574In asf extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0581In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0580In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0579In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0573In asf extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0578In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0582In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0641In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing…Android
- CVE-2021-0642In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a…Android
- CVE-2021-0591In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to…Android
- CVE-2021-0593In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a…Android
- CVE-2021-0584In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation.Android
- CVE-2021-0519In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0645In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass.Android
- CVE-2021-0646In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation.Android
- CVE-2021-29313Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,
- CVE-2021-32830The @diez/generation npm package is a client for Diez.diez · @diez/generation
- CVE-2021-29056Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php.
- CVE-2020-29548An issue was discovered in SmarterTools SmarterMail through 100.0.7537.
- CVE-2020-15955In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client…
- CVE-2021-3615A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the…Lenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-3459A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access…Motorola MM1000 MoCA Adapter
- CVE-2021-3458The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.Motorola MM1000 MoCA Adapter
- CVE-2020-28846Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin…
- CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeoverdolibarr · dolibarr/dolibarr
- CVE-2020-4992IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute…IBM DataPower Gateway
- CVE-2020-4706IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.IBM API Connect