CVEs published August 5, 2021
91 CVEs were published on August 5, 2021: 2 critical, 18 high.
- Published
- 91
- Critical
- 2
- High
- 18
- Medium
- 10
- Low
- 3
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Mozilla Firefox
- 6
- https://github.com/curl/curl
- 5
- Foxit
- 3
- IOBit
- 3
- Citrix ADC, Citrix Gateway
- 2
- Fortinet FortiAnalyzer, FortiManager
- 2
- GitLab
- 2
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 2
- Samsung Mobile Devices
- 2
- Samsung Mobile Smart Things
- 2
Critical 2
- CVE-2021-22234An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 befGitLab
- CVE-2021-21805An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).Advantech
High 18
- CVE-2021-32003Configuration service port remains open 10 minutes after reboot even when already provisionedSecomea SiteManager
- CVE-2020-7863Raonwiz RAON K Upload Arbitrary Command Execution VulnerabilityRaonwiz RAON K Upload
- CVE-2021-26605unidocs ezPDFReader arbitrary command execution vulnerabilityunidocs ezPDFReader
- CVE-2021-34639WordPress Download Manager <= 3.1.24 Authenticated Arbitrary File UploadW3 Eden WordPress Download Manager
- CVE-2021-37632Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacketSuperMartijn642sConfigLib
- CVE-2021-34633Youtube Feeder <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site ScriptingYoutube Feeder
- CVE-2021-34634Nifty Newsletters <= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site ScriptingSolaPlugins Nifty Newsletters
- CVE-2021-21893A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893.Foxit
- CVE-2021-21831A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598.Foxit
- CVE-2021-21870A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651.Foxit
- CVE-2021-21863A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development SysCODESYS
- CVE-2021-37859Reflected XSS in OAuth FlowMattermost
- CVE-2021-34631NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site ScriptingNewsPlugin
- CVE-2021-22241An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0.GitLab
- CVE-2021-23849Cross Site Request Forgery (CSRF) vulnerability in web based management interfaceBosch CPP Firmware
- CVE-2021-37625Incorrect Check of Function Return Value in Skytableskytable
- CVE-2021-32603A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, Fortinet FortiAnalyzer, FortiManager
- CVE-2021-22926libcurl-using applications can ask for a specific client certificate to be used in a transfer.https://github.com/curl/curl
Medium, low and unrated 71
- CVE-2020-22392Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.intelliants/subrion
- CVE-2021-3655A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1.kernel · :linux_kernel:
- CVE-2021-3642A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer mawildfly-elytron · org.wildfly.security:wildfly-elytron
- CVE-2021-20592Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model comGOT2000 series GT27 model; GT25 model; GT23 model; GT SoftG…
- CVE-2021-28216BootPerformanceTable pointer is read from an NVRAM variable in PEI.TianoCore EDK II
- CVE-2021-22517A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector.Data Protector
- CVE-2021-26586A potential security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline InfrastructureHPE Edgeline Infrastructure Management Software
- CVE-2021-35325A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial o
- CVE-2021-35327A vulnerability in TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to start the Telnet service, then login with the de
- CVE-2021-35326A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows attackers to download the configuration file via sendin
- CVE-2021-35324A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication
- CVE-2021-20116A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4.TCExam
- CVE-2021-20115A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3.TCExam
- CVE-2021-37156Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the int
- CVE-2021-32002SiteManager troubleshooter allows access without authentication from local networkSecomea SiteManager
- CVE-2021-1630XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime FMulesoft
- CVE-2021-3566Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read_probe' function assigned to it.ffmpeg
- CVE-2021-34638WordPress Download Manager <= 3.1.24 Authenticated Directory TraversalW3 Eden WordPress Download Manager
- CVE-2021-22924libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errhttps://github.com/curl/curl
- CVE-2021-22920A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)Citrix ADC, Citrix Gateway
- CVE-2021-22919A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway)Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP
- CVE-2021-22927A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow aCitrix ADC, Citrix Gateway
- CVE-2021-22928A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eitCitrix Virtual Apps and Desktops
- CVE-2021-21785An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220.IOBit
- CVE-2021-21792An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reIObit
- CVE-2021-21791An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reIOBit
- CVE-2021-21790An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O reIOBit
- CVE-2021-3679A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace rkernel
- CVE-2021-3682A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2.QEMU
- CVE-2021-21738ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities.<ZXIPTV>
- CVE-2021-21739A ZTE's product of the transport network access layer has a security vulnerability.<ZXCTN 6120H>
- CVE-2021-29969If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completionMozilla Thunderbird
- CVE-2021-29970A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29971If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port Mozilla Firefox
- CVE-2021-29972A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library.Mozilla Firefox
- CVE-2021-29973Password autofill was enabled without user interaction on insecure websites on Firefox for Android.Mozilla Firefox
- CVE-2021-29974When network partitioning was enabled, e.g.Mozilla Firefox
- CVE-2021-29975Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overlMozilla Firefox
- CVE-2021-29976Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29977Mozilla developers reported memory safety bugs present in Firefox 89.Mozilla Firefox
- CVE-2021-29978Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit.Mozilla VPN
- CVE-2021-25448Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview.Samsung Mobile Smart Touch Call
- CVE-2021-25447Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion Samsung Mobile Smart Things
- CVE-2021-25446Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loaSamsung Mobile Smart Things
- CVE-2021-25445Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in SamsuSamsung Mobile Samsung Internet
- CVE-2021-25444An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process.Samsung Mobile Devices
- CVE-2021-25443A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker.Samsung Mobile Devices
- CVE-2021-33597Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows, Mac and L…
- CVE-2021-34371Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSesorg.neo4j:neo4j
- CVE-2021-37614In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow
- CVE-2021-33596Fake Apple login prompt in F-Secure SAFE browser for iOSF-Secure Mobile Security
- CVE-2021-22240Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap beGitLab EE
- CVE-2021-32577Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions.
- CVE-2021-32581Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653
- CVE-2021-32578Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2).
- CVE-2021-36584An issue was discovered in GPAC 1.0.1.
- CVE-2021-35307An issue was discovered in Bento4 through v1.6.0-636.
- CVE-2021-35306An issue was discovered in Bento4 through v1.6.0-636.
- CVE-2021-32576Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2).
- CVE-2021-32580Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.
- CVE-2021-32579Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated att
- CVE-2020-22732CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..
- CVE-2021-38138OneNav beta 0.9.12 allows XSS via the Add Link feature.
- CVE-2021-37605In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Mes
- CVE-2021-37604In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters bein
- CVE-2021-38095The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an a
- CVE-2021-32598An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUIFortinet FortiAnalyzer, FortiManager
- CVE-2021-22922When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML https://github.com/curl/curl
- CVE-2021-22923When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, https://github.com/curl/curl
- CVE-2021-22925curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl.https://github.com/curl/curl
- CVE-2021-3580A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext.nettle