# CVEs published 2021-08-05

91 CVEs were published on August 5, 2021: 2 critical, 18 high. Days are UTC.

- [CVE-2020-22392](https://cve.now/CVE-2020-22392.md): Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file. (no CVSS, intelliants/subrion)
- [CVE-2021-3655](https://cve.now/CVE-2021-3655.md): A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1. (no CVSS, kernel · :linux\_kernel:)
- [CVE-2021-3642](https://cve.now/CVE-2021-3642.md): A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer ma (no CVSS, wildfly-elytron · org.wildfly.security:wildfly-elytron)
- [CVE-2021-20592](https://cve.now/CVE-2021-20592.md): Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39.010, GT25 model com (no CVSS, GOT2000 series GT27 model; GT25 model; GT23 model; GT SoftG…)
- [CVE-2021-28216](https://cve.now/CVE-2021-28216.md): BootPerformanceTable pointer is read from an NVRAM variable in PEI. (no CVSS, TianoCore EDK II)
- [CVE-2021-22517](https://cve.now/CVE-2021-22517.md): A potential unauthorized privilege escalation vulnerability has been identified in Micro Focus Data Protector. (no CVSS, Data Protector)
- [CVE-2021-26586](https://cve.now/CVE-2021-26586.md): A potential security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure (no CVSS, HPE Edgeline Infrastructure Management Software)
- [CVE-2021-35325](https://cve.now/CVE-2021-35325.md): A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R\_Firmware v4.1.5cu.470\_B20200911 allows attackers to cause a denial o (no CVSS)
- [CVE-2021-35327](https://cve.now/CVE-2021-35327.md): A vulnerability in TOTOLINK A720R A720R\_Firmware v4.1.5cu.470\_B20200911 allows attackers to start the Telnet service, then login with the de (no CVSS)
- [CVE-2021-35326](https://cve.now/CVE-2021-35326.md): A vulnerability in TOTOLINK A720R router with firmware v4.1.5cu.470\_B20200911 allows attackers to download the configuration file via sendin (no CVSS)
- [CVE-2021-35324](https://cve.now/CVE-2021-35324.md): A vulnerability in the Form\_Login function of TOTOLINK A720R A720R\_Firmware V4.1.5cu.470\_B20200911 allows attackers to bypass authentication (no CVSS)
- [CVE-2021-20116](https://cve.now/CVE-2021-20116.md): A reflected cross-site scripting vulnerability exists in TCExam \<= 14.8.4. (no CVSS, TCExam)
- [CVE-2021-20115](https://cve.now/CVE-2021-20115.md): A reflected cross-site scripting vulnerability exists in TCExam \<= 14.8.3. (no CVSS, TCExam)
- [CVE-2021-37156](https://cve.now/CVE-2021-37156.md): Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the int (no CVSS)
- [CVE-2021-32003](https://cve.now/CVE-2021-32003.md): Configuration service port remains open 10 minutes after reboot even when already provisioned (CVSS 8.0, Secomea SiteManager)
- [CVE-2021-32002](https://cve.now/CVE-2021-32002.md): SiteManager troubleshooter allows access without authentication from local network (CVSS 4.3, Secomea SiteManager)
- [CVE-2021-22234](https://cve.now/CVE-2021-22234.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.11 before 13.11.7, all versions starting from 13.12 bef (CVSS 9.6, GitLab)
- [CVE-2021-1630](https://cve.now/CVE-2021-1630.md): XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub, GovCloud, Runtime F (no CVSS, Mulesoft)
- [CVE-2020-7863](https://cve.now/CVE-2020-7863.md): Raonwiz RAON K Upload Arbitrary Command Execution Vulnerability (CVSS 8.8, Raonwiz RAON K Upload)
- [CVE-2021-26605](https://cve.now/CVE-2021-26605.md): unidocs ezPDFReader arbitrary command execution vulnerability (CVSS 7.5, unidocs ezPDFReader)
- [CVE-2021-3566](https://cve.now/CVE-2021-3566.md): Prior to ffmpeg version 4.3, the tty demuxer did not have a 'read\_probe' function assigned to it. (no CVSS, ffmpeg)
- [CVE-2021-34638](https://cve.now/CVE-2021-34638.md): WordPress Download Manager \<= 3.1.24 Authenticated Directory Traversal (CVSS 6.5, W3 Eden WordPress Download Manager)
- [CVE-2021-34639](https://cve.now/CVE-2021-34639.md): WordPress Download Manager \<= 3.1.24 Authenticated Arbitrary File Upload (CVSS 7.5, W3 Eden WordPress Download Manager)
- [CVE-2021-22924](https://cve.now/CVE-2021-22924.md): libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to err (CVSS 3.7, https://github.com/curl/curl)
- [CVE-2021-22920](https://cve.now/CVE-2021-22920.md): A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway) (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2021-22919](https://cve.now/CVE-2021-22919.md): A vulnerability has been discovered in Citrix ADC (formerly known as NetScaler ADC) and Citrix Gateway (formerly known as NetScaler Gateway) (no CVSS, Citrix ADC, Citrix Gateway, Citrix SD-WAN WANOP)
- [CVE-2021-22927](https://cve.now/CVE-2021-22927.md): A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow a (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2021-22928](https://cve.now/CVE-2021-22928.md): A vulnerability has been identified in Citrix Virtual Apps and Desktops that could, if exploited, allow a user of a Windows VDA that has eit (no CVSS, Citrix Virtual Apps and Desktops)
- [CVE-2021-37632](https://cve.now/CVE-2021-37632.md): Deserialization of Untrusted Data in com.supermartijn642.configlib.ConfigSyncPacket (CVSS 8.1, SuperMartijn642sConfigLib)
- [CVE-2021-34633](https://cve.now/CVE-2021-34633.md): Youtube Feeder \<= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, Youtube Feeder)
- [CVE-2021-34634](https://cve.now/CVE-2021-34634.md): Nifty Newsletters \<= 4.0.23 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, SolaPlugins Nifty Newsletters)
- [CVE-2021-21893](https://cve.now/CVE-2021-21893.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.0.0.49893. (CVSS 8.8, Foxit)
- [CVE-2021-21831](https://cve.now/CVE-2021-21831.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.3.37598. (CVSS 8.8, Foxit)
- [CVE-2021-21870](https://cve.now/CVE-2021-21870.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 10.1.4.37651. (CVSS 8.8, Foxit)
- [CVE-2021-21785](https://cve.now/CVE-2021-21785.md): An information disclosure vulnerability exists in the IOCTL 0x9c40a148 handling of IOBit Advanced SystemCare Ultimate 14.2.0.220. (CVSS 6.5, IOBit)
- [CVE-2021-21792](https://cve.now/CVE-2021-21792.md): An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O re (CVSS 6.5, IObit)
- [CVE-2021-21791](https://cve.now/CVE-2021-21791.md): An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O re (CVSS 6.5, IOBit)
- [CVE-2021-21790](https://cve.now/CVE-2021-21790.md): An information disclosure vulnerability exists in the the way IOBit Advanced SystemCare Ultimate 14.2.0.220 driver handles Privileged I/O re (CVSS 6.5, IOBit)
- [CVE-2021-21805](https://cve.now/CVE-2021-21805.md): An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). (CVSS 9.8, Advantech)
- [CVE-2021-21863](https://cve.now/CVE-2021-21863.md): A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development Sys (CVSS 8.8, CODESYS)
- [CVE-2021-3679](https://cve.now/CVE-2021-3679.md): A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace r (no CVSS, kernel)
- [CVE-2021-3682](https://cve.now/CVE-2021-3682.md): A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. (no CVSS, QEMU)
- [CVE-2021-21738](https://cve.now/CVE-2021-21738.md): ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. (no CVSS, \<ZXIPTV\>)
- [CVE-2021-21739](https://cve.now/CVE-2021-21739.md): A ZTE's product of the transport network access layer has a security vulnerability. (no CVSS, \<ZXCTN 6120H\>)
- [CVE-2021-29969](https://cve.now/CVE-2021-29969.md): If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses prior to the completion (no CVSS, Mozilla Thunderbird)
- [CVE-2021-29970](https://cve.now/CVE-2021-29970.md): A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29971](https://cve.now/CVE-2021-29971.md): If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespective of scheme or port (no CVSS, Mozilla Firefox)
- [CVE-2021-29972](https://cve.now/CVE-2021-29972.md): A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. (no CVSS, Mozilla Firefox)
- [CVE-2021-29973](https://cve.now/CVE-2021-29973.md): Password autofill was enabled without user interaction on insecure websites on Firefox for Android. (no CVSS, Mozilla Firefox)
- [CVE-2021-29974](https://cve.now/CVE-2021-29974.md): When network partitioning was enabled, e.g. (no CVSS, Mozilla Firefox)
- [CVE-2021-29975](https://cve.now/CVE-2021-29975.md): Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or formatting, could be overl (no CVSS, Mozilla Firefox)
- [CVE-2021-29976](https://cve.now/CVE-2021-29976.md): Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29977](https://cve.now/CVE-2021-29977.md): Mozilla developers reported memory safety bugs present in Firefox 89. (no CVSS, Mozilla Firefox)
- [CVE-2021-29978](https://cve.now/CVE-2021-29978.md): Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. (no CVSS, Mozilla VPN)
- [CVE-2021-25448](https://cve.now/CVE-2021-25448.md): Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in webview. (no CVSS, Samsung Mobile Smart Touch Call)
- [CVE-2021-25447](https://cve.now/CVE-2021-25447.md): Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause local file inclusion (no CVSS, Samsung Mobile Smart Things)
- [CVE-2021-25446](https://cve.now/CVE-2021-25446.md): Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause arbitrary webpage loa (no CVSS, Samsung Mobile Smart Things)
- [CVE-2021-25445](https://cve.now/CVE-2021-25445.md): Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access internal files in Samsu (no CVSS, Samsung Mobile Samsung Internet)
- [CVE-2021-25444](https://cve.now/CVE-2021-25444.md): An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileged process. (no CVSS, Samsung Mobile Devices)
- [CVE-2021-25443](https://cve.now/CVE-2021-25443.md): A use after free vulnerability in conn\_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker. (no CVSS, Samsung Mobile Devices)
- [CVE-2021-37859](https://cve.now/CVE-2021-37859.md): Reflected XSS in OAuth Flow (CVSS 7.1, Mattermost)
- [CVE-2021-33597](https://cve.now/CVE-2021-33597.md): Denial-of-Service (DoS) Vulnerability (CVSS 3.5, F-Secure endpoint protection products on Windows, Mac and L…)
- [CVE-2021-34631](https://cve.now/CVE-2021-34631.md): NewsPlugin \<= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, NewsPlugin)
- [CVE-2021-34371](https://cve.now/CVE-2021-34371.md): Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSes (no CVSS, org.neo4j:neo4j)
- [CVE-2021-37614](https://cve.now/CVE-2021-37614.md): In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web application could allow (no CVSS)
- [CVE-2021-22241](https://cve.now/CVE-2021-22241.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. (CVSS 8.7, GitLab)
- [CVE-2021-33596](https://cve.now/CVE-2021-33596.md): Fake Apple login prompt in F-Secure SAFE browser for iOS (CVSS 3.5, F-Secure Mobile Security)
- [CVE-2021-22240](https://cve.now/CVE-2021-22240.md): Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap be (CVSS 4.2, GitLab EE)
- [CVE-2021-23849](https://cve.now/CVE-2021-23849.md): Cross Site Request Forgery (CSRF) vulnerability in web based management interface (CVSS 7.5, Bosch CPP Firmware)
- [CVE-2021-32577](https://cve.now/CVE-2021-32577.md): Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. (no CVSS)
- [CVE-2021-32581](https://cve.now/CVE-2021-32581.md): Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653 (no CVSS)
- [CVE-2021-32578](https://cve.now/CVE-2021-32578.md): Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 2 of 2). (no CVSS)
- [CVE-2021-36584](https://cve.now/CVE-2021-36584.md): An issue was discovered in GPAC 1.0.1. (no CVSS)
- [CVE-2021-35307](https://cve.now/CVE-2021-35307.md): An issue was discovered in Bento4 through v1.6.0-636. (no CVSS)
- [CVE-2021-35306](https://cve.now/CVE-2021-35306.md): An issue was discovered in Bento4 through v1.6.0-636. (no CVSS)
- [CVE-2021-32576](https://cve.now/CVE-2021-32576.md): Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handling (issue 1 of 2). (no CVSS)
- [CVE-2021-32580](https://cve.now/CVE-2021-32580.md): Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. (no CVSS)
- [CVE-2021-32579](https://cve.now/CVE-2021-32579.md): Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an unauthenticated att (no CVSS)
- [CVE-2021-37625](https://cve.now/CVE-2021-37625.md): Incorrect Check of Function Return Value in Skytable (CVSS 7.5, skytable)
- [CVE-2020-22732](https://cve.now/CVE-2020-22732.md): CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions \> Fie Picker.. (no CVSS)
- [CVE-2021-38138](https://cve.now/CVE-2021-38138.md): OneNav beta 0.9.12 allows XSS via the Add Link feature. (no CVSS)
- [CVE-2021-37605](https://cve.now/CVE-2021-37605.md): In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only two out of four Mes (no CVSS)
- [CVE-2021-37604](https://cve.now/CVE-2021-37604.md): In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of frame counters bein (no CVSS)
- [CVE-2021-38095](https://cve.now/CVE-2021-38095.md): The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as demonstrated by an a (no CVSS)
- [CVE-2021-32603](https://cve.now/CVE-2021-32603.md): A server-side request forgery (SSRF) (CWE-918) vulnerability in FortiManager and FortiAnalyser GUI 7.0.0, 6.4.5 and below, 6.2.7 and below, (CVSS 8.8, Fortinet FortiAnalyzer, FortiManager)
- [CVE-2021-32598](https://cve.now/CVE-2021-32598.md): An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI (CVSS 4.3, Fortinet FortiAnalyzer, FortiManager)
- [CVE-2021-22922](https://cve.now/CVE-2021-22922.md): When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML (CVSS 6.5, https://github.com/curl/curl)
- [CVE-2021-22923](https://cve.now/CVE-2021-22923.md): When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, (no CVSS, https://github.com/curl/curl)
- [CVE-2021-22925](https://cve.now/CVE-2021-22925.md): curl supports the \`-t\` command line option, known as \`CURLOPT\_TELNETOPTIONS\`in libcurl. (CVSS 5.3, https://github.com/curl/curl)
- [CVE-2021-22926](https://cve.now/CVE-2021-22926.md): libcurl-using applications can ask for a specific client certificate to be used in a transfer. (CVSS 7.5, https://github.com/curl/curl)
- [CVE-2021-3580](https://cve.now/CVE-2021-3580.md): A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. (no CVSS, nettle)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.