# CVEs published 2021-08-02

122 CVEs were published on August 2, 2021: 3 critical, 13 high. Days are UTC.

- [CVE-2021-21565](https://cve.now/CVE-2021-21565.md): Dell PowerScale OneFS versions 9.1.0.3 and earlier contain a denial of service vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2021-21563](https://cve.now/CVE-2021-21563.md): Dell EMC PowerScale OneFS versions 8.1.2-9.1.0.x contain an Improper Check for Unusual or Exceptional Conditions in its auditing component.T (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2021-21562](https://cve.now/CVE-2021-21562.md): Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2021-21553](https://cve.now/CVE-2021-21553.md): Dell PowerScale OneFS versions 8.1.0-9.1.0 contain an Incorrect User Management vulnerability.under some specific conditions, this can allow (CVSS 7.3, Dell PowerScale OneFS)
- [CVE-2021-37916](https://cve.now/CVE-2021-37916.md): Joplin before 2.0.9 allows XSS via button and form in the note body. (no CVSS, joplin)
- [CVE-2021-37914](https://cve.now/CVE-2021-37914.md): In Argo Workflows through 3.1.3, if EXPRESSION\_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when running (no CVSS, github.com/argoproj/argo-workflows/v3 · github.com/argop… +1)
- [CVE-2021-32812](https://cve.now/CVE-2021-32812.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') and Improper Encoding or Escaping of Output in frontend/server/server.js (CVSS 4.6, TekMonksGitHub monkshu)
- [CVE-2021-32787](https://cve.now/CVE-2021-32787.md): Low risk information disclosure in Sourcegraph (CVSS 3.1, sourcegraph)
- [CVE-2021-32811](https://cve.now/CVE-2021-32811.md): Remote Code Execution via Script (Python) objects under Python 3 (CVSS 7.5, zopefoundation Zope · zope +1)
- [CVE-2021-29979](https://cve.now/CVE-2021-29979.md): Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instan (no CVSS, Mozilla Hubs Cloud)
- [CVE-2021-27503](https://cve.now/CVE-2021-27503.md): Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior t (no CVSS, Ypsomed mylife Cloud, mylife Mobile Application)
- [CVE-2021-27499](https://cve.now/CVE-2021-27499.md): Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior t (no CVSS, Ypsomed mylife Cloud, mylife Mobile Application)
- [CVE-2021-27943](https://cve.now/CVE-2021-27943.md): The pairing procedure used by the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs and mobile application is vulnerable to a brute- (no CVSS)
- [CVE-2021-34632](https://cve.now/CVE-2021-34632.md): SEO Backlinks \<= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, SEO Backlinks)
- [CVE-2021-34635](https://cve.now/CVE-2021-34635.md): Poll Maker \<= 3.2.8 - Reflected Cross-Site Scripting (CVSS 6.1, AYS Pro Extensions Poll Maker)
- [CVE-2021-34628](https://cve.now/CVE-2021-34628.md): Admin Custom Login \<= 3.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, Weblizar Admin Custom Login)
- [CVE-2021-34637](https://cve.now/CVE-2021-34637.md): Post Index \<= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, iTux Post Index)
- [CVE-2021-32019](https://cve.now/CVE-2021-32019.md): There is missing input validation of host names displayed in OpenWrt before 19.07.8. (no CVSS)
- [CVE-2021-21866](https://cve.now/CVE-2021-21866.md): A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODES (CVSS 8.8, CODESYS)
- [CVE-2021-21865](https://cve.now/CVE-2021-21865.md): A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS (CVSS 8.8, CODESYS)
- [CVE-2021-21864](https://cve.now/CVE-2021-21864.md): A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CO (CVSS 7.8, CODESYS)
- [CVE-2021-37848](https://cve.now/CVE-2021-37848.md): common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. (no CVSS)
- [CVE-2021-37847](https://cve.now/CVE-2021-37847.md): crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. (no CVSS)
- [CVE-2021-35450](https://cve.now/CVE-2021-35450.md): A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template (no CVSS)
- [CVE-2021-33198](https://cve.now/CVE-2021-33198.md): In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText meth (no CVSS, stdlib)
- [CVE-2021-33197](https://cve.now/CVE-2021-33197.md): In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an a (no CVSS, stdlib)
- [CVE-2021-33195](https://cve.now/CVE-2021-33195.md): Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return va (no CVSS, stdlib)
- [CVE-2021-37843](https://cve.now/CVE-2021-37843.md): The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known (i.e. (CVSS 9.8)
- [CVE-2021-32810](https://cve.now/CVE-2021-32810.md): Data race in crossbeam-deque (CVSS 9.8, crossbeam-rs crossbeam · crossbeam-deque)
- [CVE-2021-32806](https://cve.now/CVE-2021-32806.md): URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal (CVSS 6.5, plone Products.isurlinportal · products-isurlinportal)
- [CVE-2021-3673](https://cve.now/CVE-2021-3673.md): A vulnerability was found in Radare2 in version 5.3.1. (no CVSS, radare2)
- [CVE-2021-22447](https://cve.now/CVE-2021-22447.md): There is an Improper Check for Unusual or Exceptional Conditions Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerab (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22446](https://cve.now/CVE-2021-22446.md): There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22445](https://cve.now/CVE-2021-22445.md): There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to rese (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22444](https://cve.now/CVE-2021-22444.md): There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause code injection. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22443](https://cve.now/CVE-2021-22443.md): There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random address acc (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22442](https://cve.now/CVE-2021-22442.md): There is an Improper Validation of Integrity Check Value Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability ma (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22438](https://cve.now/CVE-2021-22438.md): There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22435](https://cve.now/CVE-2021-22435.md): There is a Configuration Defect Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrit (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22428](https://cve.now/CVE-2021-22428.md): There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication b (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22427](https://cve.now/CVE-2021-22427.md): There is a Heap-based Buffer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentic (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22415](https://cve.now/CVE-2021-22415.md): There is an Incorrect Calculation of Buffer Size Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22414](https://cve.now/CVE-2021-22414.md): There is a Memory Buffer Errors Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to res (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22413](https://cve.now/CVE-2021-22413.md): There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to reset. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22412](https://cve.now/CVE-2021-22412.md): There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause random kernel addres (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22392](https://cve.now/CVE-2021-22392.md): There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause verification b (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22391](https://cve.now/CVE-2021-22391.md): There is an Incorrect Calculation of Buffer Size in Huawei Smartphone.Successful exploitation of this vulnerability may cause the system to (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22390](https://cve.now/CVE-2021-22390.md): There is a Memory Buffer Improper Operation Limit Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22389](https://cve.now/CVE-2021-22389.md): There is a Permission Control Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22388](https://cve.now/CVE-2021-22388.md): There is an Integer Overflow Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause certain codes to be (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22387](https://cve.now/CVE-2021-22387.md): There is an Improper Control of Dynamically Managing Code Resources Vulnerability in Huawei Smartphone.Successful exploitation of this vulne (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22384](https://cve.now/CVE-2021-22384.md): There is an Information Disclosure Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authenticati (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22379](https://cve.now/CVE-2021-22379.md): There is an Integer Underflow (Wrap or Wraparound) Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may caus (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22381](https://cve.now/CVE-2021-22381.md): There is an Input Verification Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause an infinite loop i (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-29697](https://cve.now/CVE-2021-29697.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to ob (CVSS 4.9, IBM Cloud Pak for Security)
- [CVE-2021-29696](https://cve.now/CVE-2021-29696.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could allow a remote authenticated attacker to ex (CVSS 8.0, IBM Cloud Pak for Security)
- [CVE-2021-20541](https://cve.now/CVE-2021-20541.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth (CVSS 3.7, IBM Cloud Pak for Security)
- [CVE-2021-20540](https://cve.now/CVE-2021-20540.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth (CVSS 2.7, IBM Cloud Pak for Security)
- [CVE-2021-20539](https://cve.now/CVE-2021-20539.md): IBM Cloud Pak for Security (CP4S) 1.5.0.0, 1.5.1.0, 1.6.0.0, 1.6.1.0, 1.7.0.0, and 1.7.1.0 could disclose sensitive information to an unauth (CVSS 5.3, IBM Cloud Pak for Security)
- [CVE-2021-22397](https://cve.now/CVE-2021-22397.md): There is a privilege escalation vulnerability in Huawei ManageOne 8.0.0. (no CVSS, ManageOne)
- [CVE-2021-22398](https://cve.now/CVE-2021-22398.md): There is a logic error vulnerability in several smartphones. (no CVSS, Hulk-AL00C;Jennifer-AN00C;Jenny-AL10B;OxfordPL-AN10B)
- [CVE-2021-22396](https://cve.now/CVE-2021-22396.md): There is a privilege escalation vulnerability in some Huawei products. (no CVSS, eCNS280\_TD;eSE620X vESS)
- [CVE-2021-29757](https://cve.now/CVE-2021-29757.md): IBM QRadar User Behavior Analytics 4.1.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and (CVSS 4.3, IBM QRadar User Behavior Analytics)
- [CVE-2021-22552](https://cve.now/CVE-2021-22552.md): Memory overread secure enclave in Asylo 0.6.2 (CVSS 5.3, Google Asylo)
- [CVE-2021-29741](https://cve.now/CVE-2021-29741.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges. (CVSS 8.4, IBM VIOS · IBM AIX)
- [CVE-2021-37840](https://cve.now/CVE-2021-37840.md): aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webs (no CVSS)
- [CVE-2021-20332](https://cve.now/CVE-2021-20332.md): MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application (CVSS 4.2, MongoDB Rust Driver · mongodb)
- [CVE-2021-37162](https://cve.now/CVE-2021-37162.md): A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be (no CVSS)
- [CVE-2021-37164](https://cve.now/CVE-2021-37164.md): A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be (no CVSS)
- [CVE-2021-37163](https://cve.now/CVE-2021-37163.md): An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus operated by released versions of software be (no CVSS)
- [CVE-2021-37167](https://cve.now/CVE-2021-37167.md): An insecure permissions issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softw (no CVSS)
- [CVE-2021-37166](https://cve.now/CVE-2021-37166.md): A buffer overflow issue leading to denial of service was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by rel (no CVSS)
- [CVE-2021-37160](https://cve.now/CVE-2021-37160.md): A firmware validation issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of softwar (no CVSS)
- [CVE-2021-37161](https://cve.now/CVE-2021-37161.md): A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel, operated by released (no CVSS)
- [CVE-2021-37216](https://cve.now/CVE-2021-37216.md): QSAN Storage Manager - Reflected Cross-Site Scripting (CVSS 6.1, QSAN Storage Manager XN8008T · QSAN Storage Manager XN8024R)
- [CVE-2021-37165](https://cve.now/CVE-2021-37165.md): A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software be (no CVSS)
- [CVE-2021-24504](https://cve.now/CVE-2021-24504.md): WP LMS \<= 1.1.2 - Stored Cross-Site Scripting (XSS) (no CVSS, WP LMS – Best WordPress LMS Plugin)
- [CVE-2021-24503](https://cve.now/CVE-2021-24503.md): Popular Brand SVG Icons - Simple Icons \< 2.7.8 - Contributor+ Stored XSS (no CVSS, Popular Brand Icons – Simple Icons)
- [CVE-2021-24498](https://cve.now/CVE-2021-24498.md): Calendar Event Multi View \< 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Calendar Event Multi View)
- [CVE-2021-24496](https://cve.now/CVE-2021-24496.md): Community Event \< 1.4.8 - Reflected Cross-Site Scripting (XSS) (no CVSS, Community Events)
- [CVE-2021-24492](https://cve.now/CVE-2021-24492.md): Handsome Testimonials & Reviews \< 2.1.1 - Authenticated (Subscriber+) SQL Injection (no CVSS, Handsome Testimonials & Reviews)
- [CVE-2021-24488](https://cve.now/CVE-2021-24488.md): Post Grid \< 2.1.8 - Reflected Cross-Site Scripting (XSS) (no CVSS, Post Grid)
- [CVE-2021-24484](https://cve.now/CVE-2021-24484.md): Secure Copy Content Protection and Content Locking \< 2.6.7 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Secure Copy Content Protection and Content Locking)
- [CVE-2021-24483](https://cve.now/CVE-2021-24483.md): Poll Maker \< 3.2.1 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Poll Maker)
- [CVE-2021-24481](https://cve.now/CVE-2021-24481.md): Any Hostname \<= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Any Hostname)
- [CVE-2021-24480](https://cve.now/CVE-2021-24480.md): Event Geek \<= 2.5.2 - Stored Cross-site Scripting (XSS) (no CVSS, Event Geek)
- [CVE-2021-24479](https://cve.now/CVE-2021-24479.md): DrawBlog \<= 0.90 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, DrawBlog)
- [CVE-2021-24478](https://cve.now/CVE-2021-24478.md): Bookshelf \<= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Bookshelf)
- [CVE-2021-24477](https://cve.now/CVE-2021-24477.md): Migrate Users \<= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, Migrate Users)
- [CVE-2021-24476](https://cve.now/CVE-2021-24476.md): Steam Group Viewer \<= 2.1 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Steam Group Viewer)
- [CVE-2021-24474](https://cve.now/CVE-2021-24474.md): Awesome Weather Widget \<= 3.0.2 - Reflected Cross-site Scripting (XSS) (no CVSS, Awesome Weather Widget)
- [CVE-2021-24473](https://cve.now/CVE-2021-24473.md): User Profile Picture \< 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR (no CVSS, User Profile Picture)
- [CVE-2021-24472](https://cve.now/CVE-2021-24472.md): Onair2 \< 3.9.9.2 & KenthaRadio \< 2.0.2 - Unauthenticated RFI and SSRF (no CVSS, QantumThemes QT KenthaRadio · QantumThemes OnAir2)
- [CVE-2021-24470](https://cve.now/CVE-2021-24470.md): Yada Wiki \< 3.4.1 - Contributor+ Stored XSS (no CVSS, Yada Wiki)
- [CVE-2021-24468](https://cve.now/CVE-2021-24468.md): Leaflet Map \< 3.0.0 - Contributor+ Stored XSS (no CVSS, Leaflet Map)
- [CVE-2021-24464](https://cve.now/CVE-2021-24464.md): YouTube Embed, Playlist and Popup \< 2.3.9 - Contributor+ Stored XSS (no CVSS, YouTube Embed, Playlist and Popup by WpDevArt)
- [CVE-2021-24463](https://cve.now/CVE-2021-24463.md): Image Slider by Ays - Responsive Slider and Carousel \< 2.5.0 - Authenticated Blind SQL Injection (no CVSS, Ays Pro Image Slider by Ays- Responsive Slider and Carousel)
- [CVE-2021-24462](https://cve.now/CVE-2021-24462.md): Photo Gallery by Ays - Responsive Image Gallery \< 4.4.4 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Photo Gallery by Ays – Responsive Image Gallery)
- [CVE-2021-24461](https://cve.now/CVE-2021-24461.md): FAQ Builder \< 1.3.6 - Authenticated Blind SQL Injections (no CVSS, Ays Pro FAQ Builder AYS)
- [CVE-2021-24460](https://cve.now/CVE-2021-24460.md): Popup Like box - Page Plugin \< 3.5.3 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Popup Like box – Page Plugin)
- [CVE-2021-24459](https://cve.now/CVE-2021-24459.md): Survey Maker \< 1.5.6 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Survey Maker)
- [CVE-2021-24457](https://cve.now/CVE-2021-24457.md): Portfolio Responsive Gallery \< 1.1.8 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Portfolio Responsive Gallery)
- [CVE-2021-24458](https://cve.now/CVE-2021-24458.md): Popup box \< 2.3.4 - Authenticated Blind SQL Injections (no CVSS, Ays Pro Popup box)
- [CVE-2021-24456](https://cve.now/CVE-2021-24456.md): Quiz Maker \< 6.2.0.9 - Multiple Authenticated Blind SQL Injections (no CVSS, Ays Pro Quiz Maker)
- [CVE-2021-24455](https://cve.now/CVE-2021-24455.md): Tutor LMS \< 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24450](https://cve.now/CVE-2021-24450.md): ProfilePress \< 3.1.8 - Authenticated Stored XSS (no CVSS, User Registration, User Profiles, Login & Membership – Prof…)
- [CVE-2021-24448](https://cve.now/CVE-2021-24448.md): Profile Builder \< 3.4.8 - Authenticated Stored XSS (no CVSS, User Registration & User Profile – Profile Builder)
- [CVE-2021-24443](https://cve.now/CVE-2021-24443.md): Youzify \< 1.0.7 - Stored Cross-Site Scripting via Biography (no CVSS, Youzify – BuddyPress Community, User Profile, Social Networ…)
- [CVE-2021-24430](https://cve.now/CVE-2021-24430.md): Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE (no CVSS, Speed Booster Pack ⚡ PageSpeed Optimization Suite)
- [CVE-2021-24428](https://cve.now/CVE-2021-24428.md): RSS for Yandex Turbo \<= 1.30 - Authenticated Stored XSS (no CVSS, RSS for Yandex Turbo)
- [CVE-2021-24425](https://cve.now/CVE-2021-24425.md): myStickymenu \< 2.5.2 - Authenticated Stored XSS (no CVSS, Floating Notification Bar, Sticky Menu on Scroll, and Stick…)
- [CVE-2021-24371](https://cve.now/CVE-2021-24371.md): RSVPMaker \< 8.7.3 - Authenticated (admin+) SSRF (no CVSS, RSVPMaker)
- [CVE-2021-34575](https://cve.now/CVE-2021-34575.md): Information Exposure in mymbCONNECT24, mbCONNECT24 \<= 2.8.0 (CVSS 7.5, MB connect line mymbCONNECT24 · MB connect line mbCONNECT24)
- [CVE-2021-34574](https://cve.now/CVE-2021-34574.md): Password policy evasion in products of MB connect line and Helmholz (CVSS 4.3, MB connect line mymbCONNECT24 · MB connect line mbCONNEC… +2)
- [CVE-2021-33527](https://cve.now/CVE-2021-33527.md): OS Command Injection in mbDIALUP \<= 3.9R0.0 (CVSS 9.8, MB connect line mbDIALUP)
- [CVE-2021-33526](https://cve.now/CVE-2021-33526.md): Privilege escalation in mbDIALUP \<= 3.9R0.0 (CVSS 7.8, MB connect line mbDIALUP)
- [CVE-2021-3351](https://cve.now/CVE-2021-3351.md): OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page. (no CVSS)
- [CVE-2021-34556](https://cve.now/CVE-2021-34556.md): In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store (no CVSS, :linux\_kernel:)
- [CVE-2021-35477](https://cve.now/CVE-2021-35477.md): In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store (no CVSS)
- [CVE-2017-18113](https://cve.now/CVE-2017-18113.md): The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a sy (CVSS 8.8, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-24444](https://cve.now/CVE-2021-24444.md): TaxoPress \< 3.0.7.2 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, TaxoPress – Create and Manage Taxonomies, Tags, Categories)
- [CVE-2021-33196](https://cve.now/CVE-2021-33196.md): In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenRea (no CVSS, stdlib)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.