# CVEs published 2021-08-07

12 CVEs were published on August 7, 2021: 0 critical, 1 high. Days are UTC.

- [CVE-2021-38173](https://cve.now/CVE-2021-38173.md): Btrbk before 0.31.2 allows command execution because of the mishandling of remote hosts filtering SSH commands using ssh\_filter\_btrbk.sh in (no CVSS)
- [CVE-2021-38168](https://cve.now/CVE-2021-38168.md): Roxy-WI through 5.2.2.0 allows authenticated SQL injection via select\_servers. (no CVSS)
- [CVE-2021-38169](https://cve.now/CVE-2021-38169.md): Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api\_funct.py. (no CVSS)
- [CVE-2021-38167](https://cve.now/CVE-2021-38167.md): Roxy-WI through 5.2.2.0 allows SQL Injection via check\_login. (no CVSS)
- [CVE-2021-38166](https://cve.now/CVE-2021-38166.md): In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are plac (no CVSS, :linux\_kernel:)
- [CVE-2021-38165](https://cve.now/CVE-2021-38165.md): Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which allows remote attackers to discover cleartext credentials because th (no CVSS)
- [CVE-2021-29923](https://cve.now/CVE-2021-29923.md): Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) all (no CVSS)
- [CVE-2021-38159](https://cve.now/CVE-2021-38159.md): In certain Progress MOVEit Transfer versions before 2021.0.4 (aka 13.0.4), SQL injection in the MOVEit Transfer web application could allow (no CVSS)
- [CVE-2021-38160](https://cve.now/CVE-2021-38160.md): In drivers/char/virtio\_console.c in the Linux kernel before 5.13.4, data corruption or loss can be triggered by an untrusted device that sup (no CVSS)
- [CVE-2021-38148](https://cve.now/CVE-2021-38148.md): Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs. (no CVSS, obsidian)
- [CVE-2021-29922](https://cve.now/CVE-2021-29922.md): library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address (no CVSS)
- [CVE-2021-38185](https://cve.now/CVE-2021-38185.md): GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds\_fgetstr integer overf (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.