CVEs published August 6, 2021
52 CVEs were published on August 6, 2021: 1 critical, 0 high.
- Published
- 52
- Critical
- 1
- High
- 0
- Medium
- 2
- Low
- 0
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Fortinet FortiAnalyzer, FortiManager
- 2
- Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R…
- 2
- NetApp Cloud Manager
- 2
- Dream Security Co. MagicLine4NX.exe
- 1
- Huawei HarmonyOS
- 1
- intelliants/subrion
- 1
- keystone
- 1
- MELSEC iQ-R series CPU modules R08/16/32/120SFCPU; R08/16/3…
- 1
- org.jeecgframework.boot:jeecg-boot-parent
- 1
Critical 1
Medium, low and unrated 51
- CVE-2020-28088An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2020-28087A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database infor
- CVE-2020-21358A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users.
- CVE-2020-21357A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary w
- CVE-2020-21356An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is
- CVE-2020-21353A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web s
- CVE-2021-38157LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter.
- CVE-2021-35312A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7.
- CVE-2020-18694Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the comp
- CVE-2020-18693Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Titl
- CVE-2021-36795A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1
- CVE-2021-20598Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all verMELSEC iQ-R series CPU modules R08/16/32/120SFCPU; R08/16/3…
- CVE-2021-36455SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \lib\packages\comments\comments.php.
- CVE-2021-36454Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\backups.php, 2) block
- CVE-2021-26999NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails.NetApp Cloud Manager
- CVE-2021-26998NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users.NetApp Cloud Manager
- CVE-2021-38136Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snap_file parameter in the /it-IT/splun
- CVE-2021-38137Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to pe
- CVE-2021-37554In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions.
- CVE-2021-37553In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used.
- CVE-2021-37551In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.
- CVE-2021-37552In JetBrains YouTrack before 2021.2.17925, stored XSS was possible.
- CVE-2021-37550In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.
- CVE-2020-22330Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.intelliants/subrion
- CVE-2021-37549In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.
- CVE-2021-37548In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.
- CVE-2021-37547In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.
- CVE-2021-37546In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.
- CVE-2021-37545In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.
- CVE-2021-37544In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.
- CVE-2021-37542In JetBrains TeamCity before 2020.2.3, XSS was possible.
- CVE-2021-37543In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.
- CVE-2021-37541In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.
- CVE-2021-37540In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.
- CVE-2021-36708In ProLink PRC2402M V1.0.18 and older, the set_sys_init function in the login.cgi binary allows an attacker to reset the password to the adm
- CVE-2021-36707In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff c
- CVE-2021-36209In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset.
- CVE-2021-36706In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD cont
- CVE-2021-36705In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contain
- CVE-2021-36351SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear para
- CVE-2021-22295A component of the HarmonyOS has a permission bypass vulnerability.Huawei HarmonyOS
- CVE-2021-37381Southsoft GMIS 5.0 is vulnerable to CSRF attacks.
- CVE-2021-38152index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS.
- CVE-2021-38151index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS.
- CVE-2021-38149index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.
- CVE-2021-37388A buffer overflow in D-Link DIR-615 C2 3.03WW.
- CVE-2021-32587An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 andFortinet FortiAnalyzer, FortiManager
- CVE-2021-32597Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and beFortinet FortiAnalyzer, FortiManager
- CVE-2021-20594Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R…
- CVE-2021-20597Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R…
- CVE-2021-38155OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclokeystone