# CVEs published 2021-08-03

111 CVEs were published on August 3, 2021: 3 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-32813](https://cve.now/CVE-2021-32813.md): Drop Headers via Malicious Connection Header (CVSS 4.8, traefik · github.com/traefik/traefik +1)
- [CVE-2021-34273](https://cve.now/CVE-2021-34273.md): A security flaw in the 'owned' function of a smart contract implementation for BTC2X (B2X), a tradeable Ethereum ERC20 token, allows attacke (no CVSS)
- [CVE-2021-34272](https://cve.now/CVE-2021-34272.md): A security flaw in the 'owned' function of a smart contract implementation for RobotCoin (RBTC), a tradeable Ethereum ERC20 token, allows at (no CVSS)
- [CVE-2021-34270](https://cve.now/CVE-2021-34270.md): An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the own (no CVSS)
- [CVE-2021-33403](https://cve.now/CVE-2021-33403.md): An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner (no CVSS)
- [CVE-2020-19305](https://cve.now/CVE-2020-19305.md): An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is delete (no CVSS)
- [CVE-2020-19304](https://cve.now/CVE-2020-19304.md): An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and acces (no CVSS)
- [CVE-2020-19303](https://cve.now/CVE-2020-19303.md): An arbitrary file upload vulnerability in /fileupload.php of hdcms 5.7 allows attackers to execute arbitrary code via a crafted file. (no CVSS)
- [CVE-2020-19302](https://cve.now/CVE-2020-19302.md): An arbitrary file upload vulnerability in the avatar upload function of vaeThink v1.0.1 allows attackers to open a webshell via changing upl (no CVSS)
- [CVE-2020-19301](https://cve.now/CVE-2020-19301.md): A vulnerability in the vae\_admin\_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in (no CVSS)
- [CVE-2021-38084](https://cve.now/CVE-2021-38084.md): An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. (no CVSS)
- [CVE-2021-33335](https://cve.now/CVE-2021-33335.md): Privilege escalation vulnerability in Liferay Portal 7.0.3 through 7.3.4, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 9 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33332](https://cve.now/CVE-2021-33332.md): Cross-site scripting (XSS) vulnerability in the Portlet Configuration module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 befo (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33334](https://cve.now/CVE-2021-33334.md): The Dynamic Data Mapping module in Liferay Portal 7.0.0 through 7.3.2, and Liferay DXP 7.0 before fix pack 94, 7.1 before fix pack 19, and 7 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33333](https://cve.now/CVE-2021-33333.md): The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19 and 7.2 befor (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33331](https://cve.now/CVE-2021-33331.md): Open redirect vulnerability in the Notifications module in Liferay Portal 7.0.0 through 7.3.1, and Liferay DXP 7.0 before fix pack 94, 7.1 b (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-30589](https://cve.now/CVE-2021-30589.md): Insufficient validation of untrusted input in Sharing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to bypass navigation (no CVSS, Google Chrome)
- [CVE-2021-30588](https://cve.now/CVE-2021-30588.md): Type confusion in V8 in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30587](https://cve.now/CVE-2021-30587.md): Inappropriate implementation in Compositing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially spoof the conte (no CVSS, Google Chrome)
- [CVE-2021-30586](https://cve.now/CVE-2021-30586.md): Use after free in dialog box handling in Windows in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install (no CVSS, Google Chrome)
- [CVE-2021-30585](https://cve.now/CVE-2021-30585.md): Use after free in sensor handling in Google Chrome on Windows prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap c (no CVSS, Google Chrome)
- [CVE-2021-30584](https://cve.now/CVE-2021-30584.md): Incorrect security UI in Downloads in Google Chrome on Android prior to 92.0.4515.107 allowed a remote attacker to perform domain spoofing v (no CVSS, Google Chrome)
- [CVE-2021-30583](https://cve.now/CVE-2021-30583.md): Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92.0.4515.107 allowed a remote attacker to leak cr (no CVSS, Google Chrome)
- [CVE-2021-30582](https://cve.now/CVE-2021-30582.md): Inappropriate implementation in Animation in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2021-30581](https://cve.now/CVE-2021-30581.md): Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30580](https://cve.now/CVE-2021-30580.md): Insufficient policy enforcement in Android intents in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to insta (no CVSS, Google Chrome)
- [CVE-2021-30579](https://cve.now/CVE-2021-30579.md): Use after free in UI framework in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-30578](https://cve.now/CVE-2021-30578.md): Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a cr (no CVSS, Google Chrome)
- [CVE-2021-30577](https://cve.now/CVE-2021-30577.md): Insufficient policy enforcement in Installer in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform local privilege es (no CVSS, Google Chrome)
- [CVE-2021-30576](https://cve.now/CVE-2021-30576.md): Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-30575](https://cve.now/CVE-2021-30575.md): Out of bounds write in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process t (no CVSS, Google Chrome)
- [CVE-2021-30574](https://cve.now/CVE-2021-30574.md): Use after free in protocol handling in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-30573](https://cve.now/CVE-2021-30573.md): Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30572](https://cve.now/CVE-2021-30572.md): Use after free in Autofill in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-30571](https://cve.now/CVE-2021-30571.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to install a ma (no CVSS, Google Chrome)
- [CVE-2021-30569](https://cve.now/CVE-2021-30569.md): Use after free in sqlite in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2021-30568](https://cve.now/CVE-2021-30568.md): Heap buffer overflow in WebGL in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-30567](https://cve.now/CVE-2021-30567.md): Use after free in DevTools in Google Chrome prior to 92.0.4515.107 allowed an attacker who convinced a user to open DevTools to potentially (no CVSS, Google Chrome)
- [CVE-2021-30566](https://cve.now/CVE-2021-30566.md): Stack buffer overflow in Printing in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2021-30565](https://cve.now/CVE-2021-30565.md): Out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS prior to 92.0.4515.107 allowed an attacker who convinced a user to (no CVSS, Google Chrome)
- [CVE-2021-32804](https://cve.now/CVE-2021-32804.md): Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization (CVSS 8.2, npm node-tar · tar)
- [CVE-2021-32803](https://cve.now/CVE-2021-32803.md): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning (CVSS 8.2, npm node-tar · tar)
- [CVE-2021-33330](https://cve.now/CVE-2021-33330.md): Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected r (no CVSS, com.liferay.portal:release.portal.bom)
- [CVE-2021-33327](https://cve.now/CVE-2021-33327.md): The Portlet Configuration module in Liferay Portal 7.2.0 through 7.3.3, and Liferay DXP 7.0 fix pack pack 93 and 94, 7.1 fix pack 18, and 7. (no CVSS, com.liferay:com.liferay.portlet.configuration.web · com.lif…)
- [CVE-2021-33328](https://cve.now/CVE-2021-33328.md): Cross-site scripting (XSS) vulnerability in the Asset module's edit vocabulary page in Liferay Portal 7.0.0 through 7.3.4, and Liferay DXP 7 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33326](https://cve.now/CVE-2021-33326.md): Cross-site scripting (XSS) vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack (no CVSS, com.liferay:com.liferay.frontend.js.aui.web · com.liferay.p…)
- [CVE-2021-33325](https://cve.now/CVE-2021-33325.md): The Portal Workflow module in Liferay Portal 7.3.2 and earlier, and Liferay DXP 7.0 before fix pack 93, 7.1 before fix pack 19, and 7.2 befo (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33322](https://cve.now/CVE-2021-33322.md): In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password res (no CVSS, com.liferay.portal:com.liferay.portal.impl · com.liferay.po…)
- [CVE-2021-30564](https://cve.now/CVE-2021-30564.md): Heap buffer overflow in WebXR in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-30563](https://cve.now/CVE-2021-30563.md): Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-30562](https://cve.now/CVE-2021-30562.md): Use after free in WebSerial in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2021-30561](https://cve.now/CVE-2021-30561.md): Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30559](https://cve.now/CVE-2021-30559.md): Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-30541](https://cve.now/CVE-2021-30541.md): Use after free in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-33324](https://cve.now/CVE-2021-33324.md): The Layout module in Liferay Portal 7.1.0 through 7.3.1, and Liferay DXP 7.1 before fix pack 20, and 7.2 before fix pack 5, does not properl (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33323](https://cve.now/CVE-2021-33323.md): The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 7, au (no CVSS, com.liferay:com.liferay.dynamic.data.mapping.form.web · com…)
- [CVE-2021-36543](https://cve.now/CVE-2021-36543.md): Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x \<5.1.23 and v6.0.x \<6.0.16 allows a remot (no CVSS)
- [CVE-2021-33321](https://cve.now/CVE-2021-33321.md): Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user (no CVSS, com.liferay.portal:com.liferay.portal.impl · com.liferay.po…)
- [CVE-2021-36542](https://cve.now/CVE-2021-36542.md): Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x\<5.1.23 and v6.0.x \<6.0.16 allows a remote a (no CVSS)
- [CVE-2021-33320](https://cve.now/CVE-2021-33320.md): The Flags module in Liferay Portal 7.3.1 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20, and 7.2 before fix pac (no CVSS, com.liferay:com.liferay.flags.taglib · com.liferay.portal:r…)
- [CVE-2021-35343](https://cve.now/CVE-2021-35343.md): Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.Ajax.php in SeedDMS v5.1.x\<5.1.23 and v6.0.x\<6.0.16 allows a remote attacker t (no CVSS)
- [CVE-2021-36703](https://cve.now/CVE-2021-36703.md): The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerabi (no CVSS)
- [CVE-2021-36702](https://cve.now/CVE-2021-36702.md): The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (no CVSS)
- [CVE-2021-36701](https://cve.now/CVE-2021-36701.md): In htmly version 2.8.1, is vulnerable to an Arbitrary File Deletion on the local host when delete backup files. (no CVSS)
- [CVE-2021-32018](https://cve.now/CVE-2021-32018.md): An issue was discovered in JUMP AMS 3.6.0.04.009-2487. (CVSS 8.5)
- [CVE-2021-32016](https://cve.now/CVE-2021-32016.md): An issue was discovered in JUMP AMS 3.6.0.04.009-2487. (CVSS 9.9)
- [CVE-2021-36623](https://cve.now/CVE-2021-36623.md): Arbitrary File Upload in Sourcecodester Phone Shop Sales Management System 1.0 enables RCE. (no CVSS)
- [CVE-2021-36654](https://cve.now/CVE-2021-36654.md): CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. (no CVSS)
- [CVE-2021-36622](https://cve.now/CVE-2021-36622.md): Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. (no CVSS)
- [CVE-2019-14453](https://cve.now/CVE-2019-14453.md): An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. (no CVSS)
- [CVE-2021-22423](https://cve.now/CVE-2021-22423.md): A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22420](https://cve.now/CVE-2021-22420.md): A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22418](https://cve.now/CVE-2021-22418.md): A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22419](https://cve.now/CVE-2021-22419.md): A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22425](https://cve.now/CVE-2021-22425.md): A component of the HarmonyOS has a Double Free vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22416](https://cve.now/CVE-2021-22416.md): A component of the HarmonyOS has a Data Processing Errors vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22421](https://cve.now/CVE-2021-22421.md): A component of the HarmonyOS has a Improper Privilege Management vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22424](https://cve.now/CVE-2021-22424.md): A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22417](https://cve.now/CVE-2021-22417.md): A component of the HarmonyOS has a Data Processing Errors vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22422](https://cve.now/CVE-2021-22422.md): A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-27942](https://cve.now/CVE-2021-27942.md): Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs allow a threat actor to execute arbitrary code from a USB drive via the Smart Cast (no CVSS)
- [CVE-2021-32814](https://cve.now/CVE-2021-32814.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Skytable (CVSS 8.8, skytable)
- [CVE-2021-31504](https://cve.now/CVE-2021-31504.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (p (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-31503](https://cve.now/CVE-2021-31503.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop Build 16.6.3.84 (p (CVSS 7.8, OpenText Brava! Desktop)
- [CVE-2021-32017](https://cve.now/CVE-2021-32017.md): An issue was discovered in JUMP AMS 3.6.0.04.009-2487. (CVSS 9.9)
- [CVE-2021-33486](https://cve.now/CVE-2021-33486.md): All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exc (no CVSS)
- [CVE-2021-36763](https://cve.now/CVE-2021-36763.md): In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties. (no CVSS)
- [CVE-2021-33485](https://cve.now/CVE-2021-33485.md): CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. (CVSS 9.8)
- [CVE-2021-37558](https://cve.now/CVE-2021-37558.md): A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attacker (no CVSS)
- [CVE-2021-37557](https://cve.now/CVE-2021-37557.md): A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri (no CVSS)
- [CVE-2021-37556](https://cve.now/CVE-2021-37556.md): A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-pri (no CVSS)
- [CVE-2021-21581](https://cve.now/CVE-2021-21581.md): Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a cross-site scripting vulnerability. (CVSS 6.5, Integrated Dell Remote Access Controller)
- [CVE-2021-21580](https://cve.now/CVE-2021-21580.md): Dell EMC iDRAC8 versions prior to 2.80.80.80 & Dell EMC iDRAC9 versions prior to 5.00.00.00 contain a Content spoofing / Text injection, whe (CVSS 4.3, Integrated Dell Remote Access Controller)
- [CVE-2021-21579](https://cve.now/CVE-2021-21579.md): Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21578](https://cve.now/CVE-2021-21578.md): Dell EMC iDRAC9 versions prior to 4.40.40.00 contain an open redirect vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21577](https://cve.now/CVE-2021-21577.md): Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21576](https://cve.now/CVE-2021-21576.md): Dell EMC iDRAC9 versions prior to 4.40.40.00 contain a DOM-based cross-site scripting vulnerability. (CVSS 6.1, Integrated Dell Remote Access Controller)
- [CVE-2021-31630](https://cve.now/CVE-2021-31630.md): Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on (no CVSS)
- [CVE-2021-27953](https://cve.now/CVE-2021-27953.md): A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. (no CVSS)
- [CVE-2021-27952](https://cve.now/CVE-2021-27952.md): Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. (no CVSS)
- [CVE-2021-27954](https://cve.now/CVE-2021-27954.md): A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wirel (no CVSS)
- [CVE-2021-32772](https://cve.now/CVE-2021-32772.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in helper\_entries (CVSS 8.8, MrChuckomo poddycast)
- [CVE-2021-36156](https://cve.now/CVE-2021-36156.md): An issue was discovered in Grafana Loki through 2.2.1. (no CVSS, github.com/grafana/loki)
- [CVE-2021-36157](https://cve.now/CVE-2021-36157.md): An issue was discovered in Grafana Cortex through 1.9.0. (no CVSS, github.com/cortexproject/cortex)
- [CVE-2021-36159](https://cve.now/CVE-2021-36159.md): libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. (no CVSS)
- [CVE-2021-22400](https://cve.now/CVE-2021-22400.md): Some Huawei Smartphones has an insufficient input validation vulnerability due to the lack of parameter validation. (no CVSS, OxfordS-AN00A)
- [CVE-2021-37833](https://cve.now/CVE-2021-37833.md): A reflected cross-site scripting (XSS) vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows fo (no CVSS)
- [CVE-2021-37832](https://cve.now/CVE-2021-37832.md): A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. (no CVSS)
- [CVE-2021-35265](https://cve.now/CVE-2021-35265.md): A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/\* allows remote attackers to inject arbitra (no CVSS)
- [CVE-2021-26085](https://cve.now/CVE-2021-26085.md): Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File (CVSS 5.3, KEV, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2021-30560](https://cve.now/CVE-2021-30560.md): Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome · nokogiri)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.