CVEs published August 2, 2021
122 CVEs were published on August 2, 2021: 3 critical, 13 high.
- Published
- 122
- Critical
- 3
- High
- 13
- Medium
- 13
- Low
- 3
- Unrated
- 90
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- Huawei EMUI · Huawei Magic UI
- 23
- IBM Cloud Pak for Security
- 5
- Dell PowerScale OneFS
- 4
- stdlib
- 4
- CODESYS
- 3
- MB connect line mbDIALUP
- 2
- Ypsomed mylife Cloud, mylife Mobile Application
- 2
- :linux_kernel:
- 1
- Any Hostname
- 1
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
Critical 3
- CVE-2021-37843The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e.
- CVE-2021-32810Data race in crossbeam-dequecrossbeam-rs crossbeam · crossbeam-deque
- CVE-2021-33527OS Command Injection in mbDIALUP <= 3.9R0.0MB connect line mbDIALUP
High 13
- CVE-2021-21553Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific conditions, this can allowDell PowerScale OneFS
- CVE-2021-32811Remote Code Execution via Script (Python) objects under Python 3zopefoundation Zope · zope +1
- CVE-2021-34632SEO Backlinks <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingSEO Backlinks
- CVE-2021-34628Admin Custom Login <= 3.2.7 - Cross-Site Request Forgery to Stored Cross-Site ScriptingWeblizar Admin Custom Login
- CVE-2021-34637Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site ScriptingiTux Post Index
- CVE-2021-21866A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESCODESYS
- CVE-2021-21865A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYSCODESYS
- CVE-2021-21864A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH COCODESYS
- CVE-2021-29696IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to exIBM Cloud Pak for Security
- CVE-2021-29741IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges.IBM VIOS · IBM AIX
- CVE-2021-34575Information Exposure in mymbCONNECT24, mbCONNECT24 <= 2.8.0MB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- CVE-2021-33526Privilege escalation in mbDIALUP <= 3.9R0.0MB connect line mbDIALUP
- CVE-2017-18113The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a syAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 106
- CVE-2021-21565Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability.Dell PowerScale OneFS
- CVE-2021-21563Dell EMC PowerScale OneFS versions 8.1.2-9.1.0.x contain an Improper Check for Unusual or Exceptional Conditions in its auditing component.TDell PowerScale OneFS
- CVE-2021-21562Dell EMC PowerScale OneFS contains an untrusted search path vulnerability.Dell PowerScale OneFS
- CVE-2021-37916Joplin before 2.0.9 allows XSS via button and form in the note body.joplin
- CVE-2021-37914In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when runninggithub.com/argoproj/argo-workflows/v3 · github.com/argop… +1
- CVE-2021-32812Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.jsTekMonksGitHub monkshu
- CVE-2021-32787Low risk information disclosure in Sourcegraphsourcegraph
- CVE-2021-29979Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instanMozilla Hubs Cloud
- CVE-2021-27503Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior tYpsomed mylife Cloud, mylife Mobile Application
- CVE-2021-27499Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior tYpsomed mylife Cloud, mylife Mobile Application
- CVE-2021-27943The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute-
- CVE-2021-34635Poll Maker <= 3.2.8 - Reflected Cross-Site ScriptingAYS Pro Extensions Poll Maker
- CVE-2021-32019There is missing input validation of host names displayed in OpenWrt before 19.07.8.
- CVE-2021-37848common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.
- CVE-2021-37847crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification.
- CVE-2021-35450A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template
- CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText methstdlib
- CVE-2021-33197In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an astdlib
- CVE-2021-33195Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return vastdlib
- CVE-2021-32806URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportalplone Products.isurlinportal · products-isurlinportal
- CVE-2021-3673A vulnerability was found in Radare2 in version 5.3.1.radare2
- CVE-2021-22447There is an Improper Check for Unusual or Exceptional Conditions Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerabHuawei EMUI · Huawei Magic UI
- CVE-2021-22446There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to Huawei EMUI · Huawei Magic UI
- CVE-2021-22445There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reseHuawei EMUI · Huawei Magic UI
- CVE-2021-22444There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection.Huawei EMUI · Huawei Magic UI
- CVE-2021-22443There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random address accHuawei EMUI · Huawei Magic UI
- CVE-2021-22442There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability maHuawei EMUI · Huawei Magic UI
- CVE-2021-22438There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may causeHuawei EMUI · Huawei Magic UI
- CVE-2021-22435There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integritHuawei EMUI · Huawei Magic UI
- CVE-2021-22428There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bHuawei EMUI · Huawei Magic UI
- CVE-2021-22427There is a Heap-based Buffer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authenticHuawei EMUI · Huawei Magic UI
- CVE-2021-22415There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Huawei EMUI · Huawei Magic UI
- CVE-2021-22414There is a Memory Buffer Errors Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to resHuawei EMUI · Huawei Magic UI
- CVE-2021-22413There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset.Huawei EMUI · Huawei Magic UI
- CVE-2021-22412There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random kernel addresHuawei EMUI · Huawei Magic UI
- CVE-2021-22392There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification bHuawei EMUI · Huawei Magic UI
- CVE-2021-22391There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to Huawei EMUI · Huawei Magic UI
- CVE-2021-22390There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may causeHuawei EMUI · Huawei Magic UI
- CVE-2021-22389There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to beHuawei EMUI · Huawei Magic UI
- CVE-2021-22388There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be Huawei EMUI · Huawei Magic UI
- CVE-2021-22387There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulneHuawei EMUI · Huawei Magic UI
- CVE-2021-22384There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authenticatiHuawei EMUI · Huawei Magic UI
- CVE-2021-22379There is an Integer Underflow (Wrap or Wraparound) Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may causHuawei EMUI · Huawei Magic UI
- CVE-2021-22381There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop iHuawei EMUI · Huawei Magic UI
- CVE-2021-29697IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to obIBM Cloud Pak for Security
- CVE-2021-20541IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthIBM Cloud Pak for Security
- CVE-2021-20540IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthIBM Cloud Pak for Security
- CVE-2021-20539IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauthIBM Cloud Pak for Security
- CVE-2021-22397There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0.ManageOne
- CVE-2021-22398There is a logic error vulnerability in several smartphones.Hulk-AL00C;Jennifer-AN00C;Jenny-AL10B;OxfordPL-AN10B
- CVE-2021-22396There is a privilege escalation vulnerability in some Huawei products.eCNS280_TD;eSE620X vESS
- CVE-2021-29757IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and IBM QRadar User Behavior Analytics
- CVE-2021-22552Memory overread secure enclave in Asylo 0.6.2Google Asylo
- CVE-2021-37840aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webs
- CVE-2021-20332MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an applicationMongoDB Rust Driver · mongodb
- CVE-2021-37162A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be
- CVE-2021-37164A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be
- CVE-2021-37163An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software be
- CVE-2021-37167An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softw
- CVE-2021-37166A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by rel
- CVE-2021-37160A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar
- CVE-2021-37161A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released
- CVE-2021-37216QSAN Storage Manager - Reflected Cross-Site ScriptingQSAN Storage Manager XN8008T · QSAN Storage Manager XN8024R
- CVE-2021-37165A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be
- CVE-2021-24504WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)WP LMS – Best WordPress LMS Plugin
- CVE-2021-24503Popular Brand SVG Icons - Simple Icons < 2.7.8 - Contributor+ Stored XSSPopular Brand Icons – Simple Icons
- CVE-2021-24498Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)Calendar Event Multi View
- CVE-2021-24496Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)Community Events
- CVE-2021-24492Handsome Testimonials & Reviews < 2.1.1 - Authenticated (Subscriber+) SQL InjectionHandsome Testimonials & Reviews
- CVE-2021-24488Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)Post Grid
- CVE-2021-24484Secure Copy Content Protection and Content Locking < 2.6.7 - Authenticated Blind SQL InjectionsAys Pro Secure Copy Content Protection and Content Locking
- CVE-2021-24483Poll Maker < 3.2.1 - Authenticated Blind SQL InjectionsAys Pro Poll Maker
- CVE-2021-24481Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)Any Hostname
- CVE-2021-24480Event Geek <= 2.5.2 - Stored Cross-site Scripting (XSS)Event Geek
- CVE-2021-24479DrawBlog <= 0.90 - Authenticated Stored Cross-Site Scripting (XSS)DrawBlog
- CVE-2021-24478Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)Bookshelf
- CVE-2021-24477Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)Migrate Users
- CVE-2021-24476Steam Group Viewer <= 2.1 - Authenticated Stored Cross-Site Scripting (XSS)Steam Group Viewer
- CVE-2021-24474Awesome Weather Widget <= 3.0.2 - Reflected Cross-site Scripting (XSS)Awesome Weather Widget
- CVE-2021-24473User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDORUser Profile Picture
- CVE-2021-24472Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Unauthenticated RFI and SSRFQantumThemes QT KenthaRadio · QantumThemes OnAir2
- CVE-2021-24470Yada Wiki < 3.4.1 - Contributor+ Stored XSSYada Wiki
- CVE-2021-24468Leaflet Map < 3.0.0 - Contributor+ Stored XSSLeaflet Map
- CVE-2021-24464YouTube Embed, Playlist and Popup < 2.3.9 - Contributor+ Stored XSSYouTube Embed, Playlist and Popup by WpDevArt
- CVE-2021-24463Image Slider by Ays - Responsive Slider and Carousel < 2.5.0 - Authenticated Blind SQL InjectionAys Pro Image Slider by Ays- Responsive Slider and Carousel
- CVE-2021-24462Photo Gallery by Ays - Responsive Image Gallery < 4.4.4 - Authenticated Blind SQL InjectionsAys Pro Photo Gallery by Ays – Responsive Image Gallery
- CVE-2021-24461FAQ Builder < 1.3.6 - Authenticated Blind SQL InjectionsAys Pro FAQ Builder AYS
- CVE-2021-24460Popup Like box - Page Plugin < 3.5.3 - Authenticated Blind SQL InjectionsAys Pro Popup Like box – Page Plugin
- CVE-2021-24459Survey Maker < 1.5.6 - Authenticated Blind SQL InjectionsAys Pro Survey Maker
- CVE-2021-24457Portfolio Responsive Gallery < 1.1.8 - Authenticated Blind SQL InjectionsAys Pro Portfolio Responsive Gallery
- CVE-2021-24458Popup box < 2.3.4 - Authenticated Blind SQL InjectionsAys Pro Popup box
- CVE-2021-24456Quiz Maker < 6.2.0.9 - Multiple Authenticated Blind SQL InjectionsAys Pro Quiz Maker
- CVE-2021-24455Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)Tutor LMS – eLearning and online course solution
- CVE-2021-24450ProfilePress < 3.1.8 - Authenticated Stored XSSUser Registration, User Profiles, Login & Membership – Prof…
- CVE-2021-24448Profile Builder < 3.4.8 - Authenticated Stored XSSUser Registration & User Profile – Profile Builder
- CVE-2021-24443Youzify < 1.0.7 - Stored Cross-Site Scripting via BiographyYouzify – BuddyPress Community, User Profile, Social Networ…
- CVE-2021-24430Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCESpeed Booster Pack ⚡ PageSpeed Optimization Suite
- CVE-2021-24428RSS for Yandex Turbo <= 1.30 - Authenticated Stored XSSRSS for Yandex Turbo
- CVE-2021-24425myStickymenu < 2.5.2 - Authenticated Stored XSSFloating Notification Bar, Sticky Menu on Scroll, and Stick…
- CVE-2021-24371RSVPMaker < 8.7.3 - Authenticated (admin+) SSRFRSVPMaker
- CVE-2021-34574Password policy evasion in products of MB connect line and HelmholzMB connect line mymbCONNECT24 · MB connect line mbCONNEC… +2
- CVE-2021-3351OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.
- CVE-2021-34556In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store :linux_kernel:
- CVE-2021-35477In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store
- CVE-2021-24444TaxoPress < 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS)TaxoPress – Create and Manage Taxonomies, Tags, Categories
- CVE-2021-33196In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReastdlib