# CVEs published 2021-08-06

52 CVEs were published on August 6, 2021: 1 critical, 0 high. Days are UTC.

- [CVE-2020-28088](https://cve.now/CVE-2020-28088.md): An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code. (no CVSS, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2020-28087](https://cve.now/CVE-2020-28087.md): A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database infor (no CVSS)
- [CVE-2020-21358](https://cve.now/CVE-2020-21358.md): A cross site request forgery (CSRF) in Wage-CMS 1.5.x-dev allows attackers to arbitrarily add users. (no CVSS)
- [CVE-2020-21357](https://cve.now/CVE-2020-21357.md): A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary w (no CVSS)
- [CVE-2020-21356](https://cve.now/CVE-2020-21356.md): An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads to physical path disclosure of the host when 'name = "file" is (no CVSS)
- [CVE-2020-21353](https://cve.now/CVE-2020-21353.md): A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web s (no CVSS)
- [CVE-2021-38157](https://cve.now/CVE-2021-38157.md): LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. (no CVSS)
- [CVE-2021-35312](https://cve.now/CVE-2021-35312.md): A vulnerability was found in CIR 2000 / Gestionale Amica Prodigy v1.7. (no CVSS)
- [CVE-2020-18694](https://cve.now/CVE-2020-18694.md): Cross Site Request Forgery (CSRF) in IgnitedCMS v1.0 allows remote attackers to obtain sensitive information and gain privilege via the comp (no CVSS)
- [CVE-2020-18693](https://cve.now/CVE-2020-18693.md): Cross Site Scripting (XSS) in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Titl (no CVSS)
- [CVE-2021-36795](https://cve.now/CVE-2021-36795.md): A permission issue in the Cohesity Linux agent may allow privilege escalation in version 6.5.1b to 6.5.1d-hotfix10, 6.6.0a to 6.6.0b-hotfix1 (no CVSS)
- [CVE-2021-20598](https://cve.now/CVE-2021-20598.md): Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all ver (no CVSS, MELSEC iQ-R series CPU modules R08/16/32/120SFCPU; R08/16/3…)
- [CVE-2021-36455](https://cve.now/CVE-2021-36455.md): SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via the quicksearch parameter in \\lib\\packages\\comments\\comments.php. (no CVSS)
- [CVE-2021-36454](https://cve.now/CVE-2021-36454.md): Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backups\\backups.php, 2) block (no CVSS)
- [CVE-2021-26999](https://cve.now/CVE-2021-26999.md): NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. (no CVSS, NetApp Cloud Manager)
- [CVE-2021-26998](https://cve.now/CVE-2021-26998.md): NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. (no CVSS, NetApp Cloud Manager)
- [CVE-2021-26606](https://cve.now/CVE-2021-26606.md): DreamSecurity MagicLine Buffer Overflow Vulnerability (CVSS 9.8, Dream Security Co. MagicLine4NX.exe)
- [CVE-2021-38136](https://cve.now/CVE-2021-38136.md): Corero SecureWatch Managed Services 9.7.2.0020 is affected by a Path Traversal vulnerability via the snap\_file parameter in the /it-IT/splun (no CVSS)
- [CVE-2021-38137](https://cve.now/CVE-2021-38137.md): Corero SecureWatch Managed Services 9.7.2.0020 does not correctly check swa-monitor and cns-monitor user’s privileges, allowing a user to pe (no CVSS)
- [CVE-2021-37554](https://cve.now/CVE-2021-37554.md): In JetBrains YouTrack before 2021.3.21051, a user could see boards without having corresponding permissions. (no CVSS)
- [CVE-2021-37553](https://cve.now/CVE-2021-37553.md): In JetBrains YouTrack before 2021.2.16363, an insecure PRNG was used. (no CVSS)
- [CVE-2021-37551](https://cve.now/CVE-2021-37551.md): In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256. (no CVSS)
- [CVE-2021-37552](https://cve.now/CVE-2021-37552.md): In JetBrains YouTrack before 2021.2.17925, stored XSS was possible. (no CVSS)
- [CVE-2021-37550](https://cve.now/CVE-2021-37550.md): In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used. (no CVSS)
- [CVE-2020-22330](https://cve.now/CVE-2020-22330.md): Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page. (no CVSS, intelliants/subrion)
- [CVE-2021-37549](https://cve.now/CVE-2021-37549.md): In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient. (no CVSS)
- [CVE-2021-37548](https://cve.now/CVE-2021-37548.md): In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS. (no CVSS)
- [CVE-2021-37547](https://cve.now/CVE-2021-37547.md): In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made. (no CVSS)
- [CVE-2021-37546](https://cve.now/CVE-2021-37546.md): In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used. (no CVSS)
- [CVE-2021-37545](https://cve.now/CVE-2021-37545.md): In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made. (no CVSS)
- [CVE-2021-37544](https://cve.now/CVE-2021-37544.md): In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. (no CVSS)
- [CVE-2021-37542](https://cve.now/CVE-2021-37542.md): In JetBrains TeamCity before 2020.2.3, XSS was possible. (no CVSS)
- [CVE-2021-37543](https://cve.now/CVE-2021-37543.md): In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects. (no CVSS)
- [CVE-2021-37541](https://cve.now/CVE-2021-37541.md): In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible. (no CVSS)
- [CVE-2021-37540](https://cve.now/CVE-2021-37540.md): In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used. (no CVSS)
- [CVE-2021-36708](https://cve.now/CVE-2021-36708.md): In ProLink PRC2402M V1.0.18 and older, the set\_sys\_init function in the login.cgi binary allows an attacker to reset the password to the adm (no CVSS)
- [CVE-2021-36707](https://cve.now/CVE-2021-36707.md): In ProLink PRC2402M V1.0.18 and older, the set\_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff c (no CVSS)
- [CVE-2021-36209](https://cve.now/CVE-2021-36209.md): In JetBrains Hub before 2021.1.13389, account takeover was possible during password reset. (no CVSS)
- [CVE-2021-36706](https://cve.now/CVE-2021-36706.md): In ProLink PRC2402M V1.0.18 and older, the set\_sys\_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD cont (no CVSS)
- [CVE-2021-36705](https://cve.now/CVE-2021-36705.md): In ProLink PRC2402M V1.0.18 and older, the set\_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contain (no CVSS)
- [CVE-2021-36351](https://cve.now/CVE-2021-36351.md): SQL Injection Vulnerability in Care2x Open Source Hospital Information Management 2.7 Alpha via the (1) pday, (2) pmonth, and (3) pyear para (no CVSS)
- [CVE-2021-22295](https://cve.now/CVE-2021-22295.md): A component of the HarmonyOS has a permission bypass vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37381](https://cve.now/CVE-2021-37381.md): Southsoft GMIS 5.0 is vulnerable to CSRF attacks. (no CVSS)
- [CVE-2021-38152](https://cve.now/CVE-2021-38152.md): index.php/appointment/insert\_patient\_add\_appointment in Chikitsa Patient Management System 2.0.0 allows XSS. (no CVSS)
- [CVE-2021-38151](https://cve.now/CVE-2021-38151.md): index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS. (no CVSS)
- [CVE-2021-38149](https://cve.now/CVE-2021-38149.md): index.php/admin/add\_user in Chikitsa Patient Management System 2.0.0 allows XSS. (no CVSS)
- [CVE-2021-37388](https://cve.now/CVE-2021-37388.md): A buffer overflow in D-Link DIR-615 C2 3.03WW. (no CVSS)
- [CVE-2021-32587](https://cve.now/CVE-2021-32587.md): An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and (CVSS 4.3, Fortinet FortiAnalyzer, FortiManager)
- [CVE-2021-32597](https://cve.now/CVE-2021-32597.md): Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and be (CVSS 4.6, Fortinet FortiAnalyzer, FortiManager)
- [CVE-2021-20594](https://cve.now/CVE-2021-20594.md): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16 (no CVSS, Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R…)
- [CVE-2021-20597](https://cve.now/CVE-2021-20597.md): Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware (no CVSS, Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R…)
- [CVE-2021-38155](https://cve.now/CVE-2021-38155.md): OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclo (no CVSS, keystone)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.