# CVEs published 2021-08-04

84 CVEs were published on August 4, 2021: 4 critical, 35 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-3539](https://cve.now/CVE-2021-3539.md): EspoCRM Avatar Persistent XSS (CVSS 6.3, EspoCRM)
- [CVE-2021-36805](https://cve.now/CVE-2021-36805.md): Akaunting Invoice Footer Persistent XSS (CVSS 5.2, Akaunting)
- [CVE-2021-36804](https://cve.now/CVE-2021-36804.md): Akaunting Password Reset Relay (CVSS 5.4, Akaunting · akaunting/akaunting)
- [CVE-2021-36803](https://cve.now/CVE-2021-36803.md): Akaunting Avatar Persistent XSS (CVSS 6.3, Akaunting)
- [CVE-2021-36802](https://cve.now/CVE-2021-36802.md): Akaunting DoS via User-Controlled 'locale' Variable (CVSS 6.5, Akaunting)
- [CVE-2021-36801](https://cve.now/CVE-2021-36801.md): Akaunting Authentication Bypass in Company Selection (CVSS 8.1, Akaunting)
- [CVE-2021-36800](https://cve.now/CVE-2021-36800.md): Akaunting OS Command Injection in 'Money.php' (CVSS 8.7, Akaunting)
- [CVE-2021-31869](https://cve.now/CVE-2021-31869.md): Pimcore AdminBundle 'specificID' SQL Injection (CVSS 6.5, Pimcore AdminBundle)
- [CVE-2021-31867](https://cve.now/CVE-2021-31867.md): Pimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL Injection (CVSS 6.5, Pimcore Customer Data Framework)
- [CVE-2021-38114](https://cve.now/CVE-2021-38114.md): libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init\_vlc function, a similar issue to CVE-2013-0868. (no CVSS)
- [CVE-2020-24829](https://cve.now/CVE-2020-24829.md): An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. (no CVSS)
- [CVE-2020-22352](https://cve.now/CVE-2020-22352.md): The gf\_dash\_segmenter\_probe\_input function in GPAC v0.8 allows attackers to cause a denial of service (NULL pointer dereference) via a craft (no CVSS)
- [CVE-2021-20028](https://cve.now/CVE-2021-20028.md): Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, s (CVSS 9.8, KEV, SonicWall SRA/SMA100)
- [CVE-2021-38113](https://cve.now/CVE-2021-38113.md): In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the (no CVSS)
- [CVE-2021-32465](https://cve.now/CVE-2021-32465.md): An incorrect permission preservation vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a remote (no CVSS, Trend Micro Apex One · Trend Micro OfficeScan)
- [CVE-2021-32464](https://cve.now/CVE-2021-32464.md): An incorrect permission assignment privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-22124](https://cve.now/CVE-2021-22124.md): An uncontrolled resource consumption (denial of service) vulnerability in the login modules of FortiSandbox 3.2.0 through 3.2.2, 3.1.0 throu (CVSS 7.5, Fortinet FortiSandbox, FortiAuthenticator)
- [CVE-2021-24014](https://cve.now/CVE-2021-24014.md): Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an (CVSS 5.4, Fortinet FortiSandbox)
- [CVE-2021-26096](https://cve.now/CVE-2021-26096.md): Multiple instances of heap-based buffer overflow in the command shell of FortiSandbox before 4.0.0 may allow an authenticated attacker to ma (CVSS 6.4, Fortinet FortiSandbox)
- [CVE-2021-32793](https://cve.now/CVE-2021-32793.md): Stored XSS Vulnerability in the Pi-hole Webinterface (CVSS 5.7, pi-hole AdminLTE)
- [CVE-2021-32706](https://cve.now/CVE-2021-32706.md): (Authenticated) Remote Code Execution Possible in Web Interface 5.5 (CVSS 7.6, pi-hole AdminLTE)
- [CVE-2021-34707](https://cve.now/CVE-2021-34707.md): Cisco Evolved Programmable Network Manager Sensitive Information Disclosure Vulnerability (CVSS 6.5, Cisco Evolved Programmable Network Manager)
- [CVE-2021-1610](https://cve.now/CVE-2021-1610.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities (CVSS 9.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1609](https://cve.now/CVE-2021-1609.md): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Web Management Vulnerabilities (CVSS 9.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1602](https://cve.now/CVE-2021-1602.md): Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability (CVSS 8.2, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-1593](https://cve.now/CVE-2021-1593.md): Cisco Packet Tracer for Windows DLL Injection Vulnerability (CVSS 7.3, Cisco Packet Tracer)
- [CVE-2021-1522](https://cve.now/CVE-2021-1522.md): Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass (CVSS 4.3, Cisco Connected Mobile Experiences)
- [CVE-2021-1572](https://cve.now/CVE-2021-1572.md): ConfD CLI Secure Shell Server Privilege Escalation Vulnerability (CVSS 7.8, Cisco ConfD)
- [CVE-2021-26097](https://cve.now/CVE-2021-26097.md): An improper neutralization of special elements used in an OS Command vulnerability in FortiSandbox 3.2.0 through 3.2.2, 3.1.0 through 3.1.4, (CVSS 8.8, Fortinet FortiSandbox)
- [CVE-2021-32596](https://cve.now/CVE-2021-32596.md): A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an (CVSS 6.0, Fortinet FortiPortal)
- [CVE-2020-29011](https://cve.now/CVE-2020-29011.md): Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 (CVSS 8.8, Fortinet FortiSandbox)
- [CVE-2021-34853](https://cve.now/CVE-2021-34853.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34852](https://cve.now/CVE-2021-34852.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34851](https://cve.now/CVE-2021-34851.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34850](https://cve.now/CVE-2021-34850.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34849](https://cve.now/CVE-2021-34849.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34848](https://cve.now/CVE-2021-34848.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34847](https://cve.now/CVE-2021-34847.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34846](https://cve.now/CVE-2021-34846.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34845](https://cve.now/CVE-2021-34845.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34844](https://cve.now/CVE-2021-34844.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34843](https://cve.now/CVE-2021-34843.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34842](https://cve.now/CVE-2021-34842.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34841](https://cve.now/CVE-2021-34841.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34840](https://cve.now/CVE-2021-34840.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34839](https://cve.now/CVE-2021-34839.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34838](https://cve.now/CVE-2021-34838.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34837](https://cve.now/CVE-2021-34837.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34836](https://cve.now/CVE-2021-34836.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34835](https://cve.now/CVE-2021-34835.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34834](https://cve.now/CVE-2021-34834.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34833](https://cve.now/CVE-2021-34833.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34832](https://cve.now/CVE-2021-34832.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. (CVSS 7.8, Foxit PDF Reader)
- [CVE-2021-34831](https://cve.now/CVE-2021-34831.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. (CVSS 7.8, Foxit Reader)
- [CVE-2021-36168](https://cve.now/CVE-2021-36168.md): A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Fortinet FortiPortal 6.x before 6.0.5, FortiPortal 5.3.x (CVSS 6.5, Fortinet FortiPortal)
- [CVE-2021-24010](https://cve.now/CVE-2021-24010.md): Improper limitation of a pathname to a restricted directory vulnerabilities in FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may (CVSS 8.1, Fortinet FortiSandbox)
- [CVE-2021-24018](https://cve.now/CVE-2021-24018.md): A buffer underwrite vulnerability in the firmware verification routine of FortiOS before 7.0.1 may allow an attacker located in the adjacent (CVSS 4.3, Fortinet FortiOS)
- [CVE-2020-24827](https://cve.now/CVE-2020-24827.md): A vulnerability in the dwarf::cursor::skip\_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segm (no CVSS)
- [CVE-2020-24826](https://cve.now/CVE-2020-24826.md): A vulnerability in the elf::section::as\_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segme (no CVSS)
- [CVE-2020-24825](https://cve.now/CVE-2020-24825.md): A vulnerability in the line\_table::line\_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmen (no CVSS)
- [CVE-2020-24824](https://cve.now/CVE-2020-24824.md): A global buffer overflow issue in the dwarf::line\_table::line\_table function of Libelfin v0.3 allows attackers to cause a denial of service (no CVSS)
- [CVE-2020-24823](https://cve.now/CVE-2020-24823.md): A vulnerability in the dwarf::to\_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation (no CVSS)
- [CVE-2020-24822](https://cve.now/CVE-2020-24822.md): A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentat (no CVSS)
- [CVE-2020-24821](https://cve.now/CVE-2020-24821.md): A vulnerability in the dwarf::cursor::skip\_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segm (no CVSS)
- [CVE-2021-29765](https://cve.now/CVE-2021-29765.md): IBM PowerVM Hypervisor FW940 and FW950 could allow an attacker to obtain sensitive information if they gain service access to the FSP. (CVSS 5.9, IBM PowerVM Hypervisor)
- [CVE-2020-4707](https://cve.now/CVE-2020-4707.md): IBM API Connect 5.0.0.0 through 5.0.8.11 is vulnerable to cross-site scripting. (CVSS 5.4, IBM API Connect)
- [CVE-2021-36764](https://cve.now/CVE-2021-36764.md): In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. (no CVSS)
- [CVE-2021-32590](https://cve.now/CVE-2021-32590.md): Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiPortal 6.0.0 through 6.0.4, 5.3.0 throug (CVSS 9.9, Fortinet FortiPortal)
- [CVE-2021-32594](https://cve.now/CVE-2021-32594.md): An unrestricted file upload vulnerability in the web interface of FortiPortal 6.0.0 through 6.0.4, 5.3.0 through 5.3.5, 5.2.0 through 5.2.5, (CVSS 5.4, Fortinet FortiPortal)
- [CVE-2021-36765](https://cve.now/CVE-2021-36765.md): In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherN (no CVSS)
- [CVE-2021-35463](https://cve.now/CVE-2021-35463.md): Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary w (no CVSS, com.liferay.portal:release.portal.bom · com.liferay:com.lif…)
- [CVE-2021-26098](https://cve.now/CVE-2021-26098.md): An instance of small space of random values in the RPC API of FortiSandbox before 4.0.0 may allow an attacker in possession of a few informa (CVSS 5.3, Fortinet FortiSandbox)
- [CVE-2021-33337](https://cve.now/CVE-2021-33337.md): Cross-site scripting (XSS) vulnerability in the Document Library module's add document menu in Liferay Portal 7.3.0 through 7.3.4, and Lifer (no CVSS, com.liferay:com.liferay.document.library.web · com.liferay.…)
- [CVE-2021-3678](https://cve.now/CVE-2021-3678.md): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc (CVSS 7.5, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-33338](https://cve.now/CVE-2021-33338.md): The Layout module in Liferay Portal 7.1.0 through 7.3.2, and Liferay DXP 7.1 before fix pack 19, and 7.2 before fix pack 6, exposes the CSRF (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-33336](https://cve.now/CVE-2021-33336.md): Cross-site scripting (XSS) vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-3680](https://cve.now/CVE-2021-3680.md): Missing Cryptographic Step in star7th/showdoc (CVSS 5.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-33339](https://cve.now/CVE-2021-33339.md): Cross-site scripting (XSS) vulnerability in the Fragment module in Liferay Portal 7.2.1 through 7.3.4, and Liferay DXP 7.2 before fix pack 9 (no CVSS, com.liferay.portal:release.portal.bom · com.liferay.portal:…)
- [CVE-2021-35397](https://cve.now/CVE-2021-35397.md): A path traversal vulnerability in the static router for Drogon from 1.0.0-beta14 to 1.6.0 could allow an unauthenticated, remote attacker to (no CVSS)
- [CVE-2021-36483](https://cve.now/CVE-2021-36483.md): DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. (no CVSS)
- [CVE-2021-37231](https://cve.now/CVE-2021-37231.md): A stack-buffer-overflow occurs in Atomicparsley 20210124.204813.840499f through APar\_readX() in src/util.cpp while parsing a crafted mp4 fil (no CVSS)
- [CVE-2021-37232](https://cve.now/CVE-2021-37232.md): A stack overflow vulnerability occurs in Atomicparsley 20210124.204813.840499f through APar\_read64() in src/util.cpp due to the lack of buff (no CVSS)
- [CVE-2021-38111](https://cve.now/CVE-2021-38111.md): The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic I (CVSS 8.8)
- [CVE-2021-38115](https://cve.now/CVE-2021-38115.md): read\_header\_tga in gd\_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.