CVEs published August 9, 2021
68 CVEs were published on August 9, 2021: 4 critical, 7 high.
- Published
- 68
- Critical
- 4
- High
- 7
- Medium
- 20
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- exiv2
- 11
- Larvata Digital Technology Co. FLYGO
- 5
- Dell OpenManage Enterprise
- 4
- Workreap
- 3
- Very Good Plugins WP Fusion Lite
- 2
- Astra Pro Addon
- 1
- Dell Alienware Command Center
- 1
- Dell dbutil
- 1
- discourse
- 1
- dolibarr · dolibarr/dolibarr
- 1
Critical 4
- CVE-2021-21596Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a remDell OpenManage Enterprise
- CVE-2021-21585Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools.Dell OpenManage Enterprise
- CVE-2021-21564Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability.Dell OpenManage Enterprise
- CVE-2021-32798Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookjupyter notebook · notebook
High 7
- CVE-2021-36277Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature VuDell Alienware Command Center
- CVE-2021-36276Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of privDell dbutil
- CVE-2021-21584Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability.Dell OpenManage Enterprise
- CVE-2021-32797JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>jupyterlab · notebook
- CVE-2021-37634LeafKit allows XSS with untrusted user inputvapor leaf-kit
- CVE-2021-37633XSS via d-popover and d-html-popover attributediscourse
- CVE-2021-37214Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3Larvata Digital Technology Co. FLYGO
Medium, low and unrated 57
- CVE-2020-23151rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is
- CVE-2020-23150A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET
- CVE-2020-23149The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitiv
- CVE-2020-23148The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensiti
- CVE-2021-38311In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service.
- CVE-2020-24742An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attac
- CVE-2021-3830523andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file.yamale
- CVE-2018-17861A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the
- CVE-2018-17865A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath p
- CVE-2018-17862A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_
- CVE-2014-9320SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and consequently gain SYSTEM
- CVE-2015-7731SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP S
- CVE-2015-2074The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a f
- CVE-2015-2073The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full
- CVE-2013-4718Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before
- CVE-2013-4717Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x be
- CVE-2013-6276QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files.
- CVE-2021-25954Improper Access Control in “Dolibarr”dolibarr · dolibarr/dolibarr
- CVE-2021-29714IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation.IBM Content Navigator
- CVE-2021-20349IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM Workload Scheduler
- CVE-2021-21740There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product.ZXHN H2640
- CVE-2021-33256A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unaut
- CVE-2021-37573A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) <=1.115 allows an
- CVE-2021-36798A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3.
- CVE-2021-37788A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a de
- CVE-2021-22910A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which couldRocket.Chat server
- CVE-2021-34660WP Fusion Lite <= 3.37.18 Reflected Cross-Site ScriptingVery Good Plugins WP Fusion Lite
- CVE-2021-34661WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data DeletionVery Good Plugins WP Fusion Lite
- CVE-2021-38290A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/librar
- CVE-2021-24522ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widgetUser Registration, User Profile, Login & Membership – Profi…
- CVE-2021-24520Stock in & out <= 1.0.4 - Authenticated SQL InjectionStock in & out
- CVE-2021-24521Side Menu Lite < 2.2.1 - Authenticated SQL InjectionSide Menu Lite – add sticky fixed buttons
- CVE-2021-24509Page View Counts < 2.4.9 - Contributor+ Stored XSSPage View Count
- CVE-2021-24507Astra Pro Addon < 3.5.2 - Unauthenticated SQL InjectionAstra Pro Addon
- CVE-2021-24505Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)Forms
- CVE-2021-24502WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)Maps Plugin using Google Maps for WordPress – WP Google Map
- CVE-2021-24501Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax ActionsWorkreap
- CVE-2021-24500Workreap theme < 2.2.2 - Multiple CSRF + IDOR VulnerabilitiesWorkreap
- CVE-2021-24495Marmoset Viewer < 1.9.3 - Reflected Cross Site ScriptingMarmoset Viewer
- CVE-2021-24467Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSSLeaflet Map
- CVE-2021-24304Newsmag < 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS)Newsmag
- CVE-2021-37215Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4Larvata Digital Technology Co. FLYGO
- CVE-2021-37213Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2Larvata Digital Technology Co. FLYGO
- CVE-2021-37212Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1Larvata Digital Technology Co. FLYGO
- CVE-2021-37211Larvata Digital Technology Co. Ltd. FLYGO - Stored XSSLarvata Digital Technology Co. FLYGO
- CVE-2021-24499Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code ExecutionWorkreap
- CVE-2021-32815Denial of service due to assertion failure in crwimage_int.cppexiv2
- CVE-2021-34334Denial of service due to integer overflow in loop counterexiv2
- CVE-2021-34335Denial of service due to FPE in Exiv2::Internal::resolveLens0xffffexiv2
- CVE-2021-37615Null pointer dereference in Exiv2::Internal::resolveLens0x319exiv2
- CVE-2021-37616Null pointer dereference in Exiv2::Internal::resolveLens0x8ffexiv2
- CVE-2021-37618Out-of-bounds read in Exiv2::Jp2Image::printStructureexiv2
- CVE-2021-37619Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Headerexiv2
- CVE-2021-37620Out-of-bounds read in XmpTextValue::read()exiv2
- CVE-2021-37621Denial of service due to infinite loop in Image::printIFDStructureexiv2
- CVE-2021-37622Denial of service due to infinite loop in JpegBase::printStructure (#1)exiv2
- CVE-2021-37623Denial of service due to infinite loop in JpegBase::printStructure (#2)exiv2