# CVEs published 2021-08-26

61 CVEs were published on August 26, 2021: 2 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-39167](https://cve.now/CVE-2021-39167.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0, openzeppelin-contracts · @openzeppelin/contracts)
- [CVE-2021-39168](https://cve.now/CVE-2021-39168.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0, openzeppelin-contracts-upgradeable · @openzeppelin/contract…)
- [CVE-2020-20675](https://cve.now/CVE-2020-20675.md): Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/. (no CVSS)
- [CVE-2021-39165](https://cve.now/CVE-2021-39165.md): Unauthenticated SQL Injection (CVSS 8.1, fiveai Cachet · cachethq/cachet)
- [CVE-2021-39161](https://cve.now/CVE-2021-39161.md): Cross-site scripting via category name in Discourse (CVSS 4.4, discourse)
- [CVE-2021-37715](https://cve.now/CVE-2021-37715.md): A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-29862](https://cve.now/CVE-2021-29862.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of… (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2021-29801](https://cve.now/CVE-2021-29801.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. (CVSS 8.4, IBM VIOS · IBM AIX)
- [CVE-2021-29772](https://cve.now/CVE-2021-29772.md): IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. (CVSS 5.6, IBM API Connect)
- [CVE-2021-29727](https://cve.now/CVE-2021-29727.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2021-29715](https://cve.now/CVE-2021-29715.md): IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks… (CVSS 6.5, IBM API Connect)
- [CVE-2021-29487](https://cve.now/CVE-2021-29487.md): Authentication bypass in Octobercms (CVSS 7.4, octobercms october · october/system)
- [CVE-2021-32648](https://cve.now/CVE-2021-32648.md): Account Takeover in Octobercms (CVSS 8.2, KEV, octobercms october · october/system)
- [CVE-2021-30604](https://cve.now/CVE-2021-30604.md): Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-30603](https://cve.now/CVE-2021-30603.md): Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a… (no CVSS, Google Chrome)
- [CVE-2021-30602](https://cve.now/CVE-2021-30602.md): Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to… (no CVSS, Google Chrome)
- [CVE-2021-30601](https://cve.now/CVE-2021-30601.md): Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious… (no CVSS, Google Chrome)
- [CVE-2021-30600](https://cve.now/CVE-2021-30600.md): Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to… (no CVSS, Google Chrome)
- [CVE-2021-30599](https://cve.now/CVE-2021-30599.md): Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (no CVSS, Google Chrome)
- [CVE-2021-30598](https://cve.now/CVE-2021-30598.md): Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (no CVSS, Google Chrome)
- [CVE-2020-18477](https://cve.now/CVE-2020-18477.md): SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con\_content field. (no CVSS)
- [CVE-2020-18476](https://cve.now/CVE-2020-18476.md): SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd\_image field. (no CVSS)
- [CVE-2020-18475](https://cve.now/CVE-2020-18475.md): Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes\_title field. (no CVSS)
- [CVE-2020-18470](https://cve.now/CVE-2020-18470.md): Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel… (no CVSS)
- [CVE-2020-18469](https://cve.now/CVE-2020-18469.md): Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in… (no CVSS)
- [CVE-2020-18468](https://cve.now/CVE-2020-18468.md): Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a… (no CVSS)
- [CVE-2020-18467](https://cve.now/CVE-2020-18467.md): Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu… (no CVSS)
- [CVE-2021-36931](https://cve.now/CVE-2021-36931.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 4.4, Microsoft Edge)
- [CVE-2021-36929](https://cve.now/CVE-2021-36929.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2021-36928](https://cve.now/CVE-2021-36928.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.0, Microsoft Edge)
- [CVE-2021-30597](https://cve.now/CVE-2021-30597.md): Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap… (no CVSS, Google Chrome)
- [CVE-2021-30596](https://cve.now/CVE-2021-30596.md): Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of… (no CVSS, Google Chrome)
- [CVE-2021-30594](https://cve.now/CVE-2021-30594.md): Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-30593](https://cve.now/CVE-2021-30593.md): Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious… (no CVSS, Google Chrome)
- [CVE-2021-30592](https://cve.now/CVE-2021-30592.md): Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious… (no CVSS, Google Chrome)
- [CVE-2021-30591](https://cve.now/CVE-2021-30591.md): Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-30590](https://cve.now/CVE-2021-30590.md): Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption… (no CVSS, Google Chrome)
- [CVE-2021-40147](https://cve.now/CVE-2021-40147.md): EmTec ZOC before 8.02.2 allows \\e\[201~ pastes, a different vulnerability than CVE-2021-32198. (no CVSS)
- [CVE-2021-32076](https://cve.now/CVE-2021-32076.md): Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass (CVSS 5.3, SolarWinds Web Help Desk)
- [CVE-2021-36352](https://cve.now/CVE-2021-36352.md): Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. (no CVSS)
- [CVE-2021-3734](https://cve.now/CVE-2021-3734.md): Improper Restriction of Rendered UI Layers or Frames in yourls/yourls (CVSS 6.5, yourls/yourls)
- [CVE-2021-38559](https://cve.now/CVE-2021-38559.md): DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. (no CVSS)
- [CVE-2021-27944](https://cve.now/CVE-2021-27944.md): Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an… (no CVSS)
- [CVE-2020-14160](https://cve.now/CVE-2020-14160.md): An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able… (no CVSS)
- [CVE-2020-14161](https://cve.now/CVE-2020-14161.md): It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint. (no CVSS)
- [CVE-2020-19822](https://cve.now/CVE-2020-19822.md): A remote code execution (RCE) vulnerability in template\_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via… (no CVSS)
- [CVE-2020-19821](https://cve.now/CVE-2020-19821.md): A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders\[\] parameter. (no CVSS)
- [CVE-2020-19705](https://cve.now/CVE-2020-19705.md): thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add. (no CVSS)
- [CVE-2020-19709](https://cve.now/CVE-2020-19709.md): Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload. (no CVSS, feehi/feehicms)
- [CVE-2020-19704](https://cve.now/CVE-2020-19704.md): A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to… (no CVSS)
- [CVE-2020-19703](https://cve.now/CVE-2020-19703.md): A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or… (no CVSS)
- [CVE-2021-20815](https://cve.now/CVE-2021-20815.md): Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series)… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20814](https://cve.now/CVE-2021-20814.md): Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20813](https://cve.now/CVE-2021-20813.md): Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20812](https://cve.now/CVE-2021-20812.md): Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20811](https://cve.now/CVE-2021-20811.md): Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series)… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20810](https://cve.now/CVE-2021-20810.md): Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20809](https://cve.now/CVE-2021-20809.md): Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20808](https://cve.now/CVE-2021-20808.md): Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable… (no CVSS, Six Apart Movable Type)
- [CVE-2021-20793](https://cve.now/CVE-2021-20793.md): Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer… (no CVSS, The installers of multiple Sony products)
- [CVE-2021-40145](https://cve.now/CVE-2021-40145.md): gdImageGd2Ptr in gd\_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.