CVEs published August 3, 2021
111 CVEs were published on August 3, 2021: 3 critical, 9 high. 2 are now in CISA KEV.
- Published
- 111
- Critical
- 3
- High
- 9
- Medium
- 8
- Low
- 0
- Unrated
- 91
- Now in CISA KEV
- 2
- Fix available
- 59
Most affected products
- Google Chrome
- 30
- Huawei HarmonyOS
- 10
- com.liferay.portal:release.portal.bom · com.liferay.portal:…
- 8
- Integrated Dell Remote Access Controller
- 6
- com.liferay.portal:com.liferay.portal.impl · com.liferay.po…
- 2
- npm node-tar · tar
- 2
- OpenText Brava! Desktop
- 2
- Atlassian Confluence Server · Atlassian Confluence Data Cen…
- 1
- com.liferay:com.liferay.dynamic.data.mapping.form.web · com…
- 1
- com.liferay:com.liferay.flags.taglib · com.liferay.portal:r…
- 1
Critical 3
High 9
- CVE-2021-32804Arbitrary File Creation/Overwrite due to insufficient absolute path sanitizationnpm node-tar · tar
- CVE-2021-32803Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoningnpm node-tar · tar
- CVE-2021-30563Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-32018An issue was discovered in JUMP AMS 3.6.0.04.009-2487.
- CVE-2021-32814Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytableskytable
- CVE-2021-31504This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pOpenText Brava! Desktop
- CVE-2021-31503This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (pOpenText Brava! Desktop
- CVE-2021-32772Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper_entriesMrChuckomo poddycast
- CVE-2021-30560Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome · nokogiri
Medium, low and unrated 99
- CVE-2021-32813Drop Headers via Malicious Connection Headertraefik · github.com/traefik/traefik +1
- CVE-2021-34273A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 token, allows attacke
- CVE-2021-34272A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum ERC20 token, allows at
- CVE-2021-34270An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the own
- CVE-2021-33403An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner
- CVE-2020-19305An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is delete
- CVE-2020-19304An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and acces
- CVE-2020-19303An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file.
- CVE-2020-19302An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing upl
- CVE-2020-19301A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in
- CVE-2021-38084An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5.
- CVE-2021-33335Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33332Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 befocom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33334The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33333The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 beforcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33331Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 bcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-30589Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2021-30588Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-30587Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the conteGoogle Chrome
- CVE-2021-30586Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to installGoogle Chrome
- CVE-2021-30585Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap cGoogle Chrome
- CVE-2021-30584Incorrect security UI in Downloads in Google Chrome on Android prior to 92.0.4515.107 allowed a remote attacker to perform domain spoofing vGoogle Chrome
- CVE-2021-30583Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak crGoogle Chrome
- CVE-2021-30582Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2021-30581Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30580Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to instaGoogle Chrome
- CVE-2021-30579Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2021-30578Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crGoogle Chrome
- CVE-2021-30577Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege esGoogle Chrome
- CVE-2021-30576Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2021-30575Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2021-30574Use after free in protocol handling in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-30573Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2021-30572Use after free in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-30571Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2021-30569Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2021-30568Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-30567Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially Google Chrome
- CVE-2021-30566Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2021-30565Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to Google Chrome
- CVE-2021-33330Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected rcom.liferay.portal:release.portal.bom
- CVE-2021-33327The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7.com.liferay:com.liferay.portlet.configuration.web · com.lif…
- CVE-2021-33328Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7com.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33326Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack com.liferay:com.liferay.frontend.js.aui.web · com.liferay.p…
- CVE-2021-33325The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 befocom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33322In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password rescom.liferay.portal:com.liferay.portal.impl · com.liferay.po…
- CVE-2021-30564Heap buffer overflow in WebXR in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-30562Use after free in WebSerial in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2021-30561Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-30559Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-30541Use after free in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2021-33324The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properlcom.liferay.portal:release.portal.bom · com.liferay.portal:…
- CVE-2021-33323The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, aucom.liferay:com.liferay.dynamic.data.mapping.form.web · com…
- CVE-2021-36543Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remot
- CVE-2021-33321Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user com.liferay.portal:com.liferay.portal.impl · com.liferay.po…
- CVE-2021-36542Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote a
- CVE-2021-33320The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix paccom.liferay:com.liferay.flags.taglib · com.liferay.portal:r…
- CVE-2021-35343Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x<5.1.23 and v6.0.x<6.0.16 allows a remote attacker t
- CVE-2021-36703The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabi
- CVE-2021-36702The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting
- CVE-2021-36701In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files.
- CVE-2021-36623Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE.
- CVE-2021-36654CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme.
- CVE-2021-36622Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload.
- CVE-2019-14453An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0.
- CVE-2021-22423A component of the HarmonyOS has a Out-of-bounds Write Vulnerability.Huawei HarmonyOS
- CVE-2021-22420A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability.Huawei HarmonyOS
- CVE-2021-22418A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability.Huawei HarmonyOS
- CVE-2021-22419A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability.Huawei HarmonyOS
- CVE-2021-22425A component of the HarmonyOS has a Double Free vulnerability.Huawei HarmonyOS
- CVE-2021-22416A component of the HarmonyOS has a Data Processing Errors vulnerability.Huawei HarmonyOS
- CVE-2021-22421A component of the HarmonyOS has a Improper Privilege Management vulnerability.Huawei HarmonyOS
- CVE-2021-22424A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability.Huawei HarmonyOS
- CVE-2021-22417A component of the HarmonyOS has a Data Processing Errors vulnerability.Huawei HarmonyOS
- CVE-2021-22422A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability.Huawei HarmonyOS
- CVE-2021-27942Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs allow a threat actor to execute arbitrary code from a USB drive via the Smart Cast
- CVE-2021-33486All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exc
- CVE-2021-36763In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
- CVE-2021-37558A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attacker
- CVE-2021-37557A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri
- CVE-2021-37556A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri
- CVE-2021-21581Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21580Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, wheIntegrated Dell Remote Access Controller
- CVE-2021-21579Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21578Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21577Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21576Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-31630Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on
- CVE-2021-27953A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process.
- CVE-2021-27952Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device.
- CVE-2021-27954A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wirel
- CVE-2021-36156An issue was discovered in Grafana Loki through 2.2.1.github.com/grafana/loki
- CVE-2021-36157An issue was discovered in Grafana Cortex through 1.9.0.github.com/cortexproject/cortex
- CVE-2021-36159libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols.
- CVE-2021-22400Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation.OxfordS-AN00A
- CVE-2021-37833A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows fo
- CVE-2021-37832A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database.
- CVE-2021-35265A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitra
- CVE-2021-26085Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Atlassian Confluence Server · Atlassian Confluence Data Cen…