# CVEs published 2021-08-09

68 CVEs were published on August 9, 2021: 4 critical, 7 high. Days are UTC.

- [CVE-2020-23151](https://cve.now/CVE-2020-23151.md): rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is (no CVSS)
- [CVE-2020-23150](https://cve.now/CVE-2020-23150.md): A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET (no CVSS)
- [CVE-2020-23149](https://cve.now/CVE-2020-23149.md): The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitiv (no CVSS)
- [CVE-2020-23148](https://cve.now/CVE-2020-23148.md): The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensiti (no CVSS)
- [CVE-2021-38311](https://cve.now/CVE-2021-38311.md): In Contiki 3.0, potential nonterminating acknowledgment loops exist in the Telnet service. (no CVSS)
- [CVE-2020-24742](https://cve.now/CVE-2020-24742.md): An issue has been fixed in Qt versions 5.14.0 where QPluginLoader attempts to load plugins relative to the working directory, allowing attac (no CVSS)
- [CVE-2021-36277](https://cve.now/CVE-2021-36277.md): Dell Command | Update, Dell Update, and Alienware Update versions before 4.3 contains an Improper Verification of Cryptographic Signature Vu (CVSS 7.8, Dell Alienware Command Center)
- [CVE-2021-36276](https://cve.now/CVE-2021-36276.md): Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains an insufficient access control vulnerability which may lead to escalation of priv (CVSS 8.8, Dell dbutil)
- [CVE-2021-21596](https://cve.now/CVE-2021-21596.md): Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00, contain a rem (CVSS 9.6, Dell OpenManage Enterprise)
- [CVE-2021-21585](https://cve.now/CVE-2021-21585.md): Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. (CVSS 9.1, Dell OpenManage Enterprise)
- [CVE-2021-21584](https://cve.now/CVE-2021-21584.md): Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. (CVSS 7.7, Dell OpenManage Enterprise)
- [CVE-2021-21564](https://cve.now/CVE-2021-21564.md): Dell OpenManage Enterprise versions prior to 3.6.1 contain an improper authentication vulnerability. (CVSS 9.8, Dell OpenManage Enterprise)
- [CVE-2021-32798](https://cve.now/CVE-2021-32798.md): Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook (CVSS 10.0, jupyter notebook · notebook)
- [CVE-2021-38305](https://cve.now/CVE-2021-38305.md): 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. (no CVSS, yamale)
- [CVE-2021-32797](https://cve.now/CVE-2021-32797.md): JupyterLab: XSS due to lack of sanitization of the action attribute of an html \<form\> (CVSS 7.4, jupyterlab · notebook)
- [CVE-2021-37634](https://cve.now/CVE-2021-37634.md): LeafKit allows XSS with untrusted user input (CVSS 7.4, vapor leaf-kit)
- [CVE-2021-37633](https://cve.now/CVE-2021-37633.md): XSS via d-popover and d-html-popover attribute (CVSS 7.4, discourse)
- [CVE-2018-17861](https://cve.now/CVE-2018-17861.md): A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the (no CVSS)
- [CVE-2018-17865](https://cve.now/CVE-2018-17865.md): A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath p (no CVSS)
- [CVE-2018-17862](https://cve.now/CVE-2018-17862.md): A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys\_ (no CVSS)
- [CVE-2014-9320](https://cve.now/CVE-2014-9320.md): SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI\_PLATFORM\_SEARCH\_SERVER\_LOGON\_TOKEN token and consequently gain SYSTEM (no CVSS)
- [CVE-2015-7731](https://cve.now/CVE-2015-7731.md): SAP Mobile Platform 3.0 SP05 ClientHub allows attackers to obtain the keystream and other sensitive information via the DataVault, aka SAP S (no CVSS)
- [CVE-2015-2074](https://cve.now/CVE-2015-2074.md): The File Repository Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to write to arbitrary files via a f (no CVSS)
- [CVE-2015-2073](https://cve.now/CVE-2015-2073.md): The File RepositoRy Server (FRS) CORBA listener in SAP BussinessObjects Edge 4.0 allows remote attackers to read arbitrary files via a full (no CVSS)
- [CVE-2013-4718](https://cve.now/CVE-2013-4718.md): Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before (no CVSS)
- [CVE-2013-4717](https://cve.now/CVE-2013-4717.md): Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x be (no CVSS)
- [CVE-2013-6276](https://cve.now/CVE-2013-6276.md): QNAP F\_VioCard 2312 and F\_VioGate 2308 have hardcoded entries in authorized\_keys files. (no CVSS)
- [CVE-2021-25954](https://cve.now/CVE-2021-25954.md): Improper Access Control in “Dolibarr” (CVSS 4.3, dolibarr · dolibarr/dolibarr)
- [CVE-2021-29714](https://cve.now/CVE-2021-29714.md): IBM Content Navigator 3.0.CD could allow a malicious user to cause a denial of service due to improper input validation. (CVSS 6.5, IBM Content Navigator)
- [CVE-2021-20349](https://cve.now/CVE-2021-20349.md): IBM Tivoli Workload Scheduler 9.4 and 9.5 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. (CVSS 5.9, IBM Workload Scheduler)
- [CVE-2021-21740](https://cve.now/CVE-2021-21740.md): There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. (no CVSS, ZXHN H2640)
- [CVE-2021-33256](https://cve.now/CVE-2021-33256.md): A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unaut (no CVSS)
- [CVE-2021-37573](https://cve.now/CVE-2021-37573.md): A reflected cross-site scripting (XSS) vulnerability in the web server TTiny Java Web Server and Servlet Container (TJWS) \<=1.115 allows an (no CVSS)
- [CVE-2021-36798](https://cve.now/CVE-2021-36798.md): A Denial-of-Service (DoS) vulnerability was discovered in Team Server in HelpSystems Cobalt Strike 4.2 and 4.3. (no CVSS)
- [CVE-2021-37788](https://cve.now/CVE-2021-37788.md): A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a de (no CVSS)
- [CVE-2021-22910](https://cve.now/CVE-2021-22910.md): A sanitization vulnerability exists in Rocket.Chat server versions \<3.13.2, \<3.12.4, \<3.11.4 that allowed queries to an endpoint which could (no CVSS, Rocket.Chat server)
- [CVE-2021-34660](https://cve.now/CVE-2021-34660.md): WP Fusion Lite \<= 3.37.18 Reflected Cross-Site Scripting (CVSS 6.1, Very Good Plugins WP Fusion Lite)
- [CVE-2021-34661](https://cve.now/CVE-2021-34661.md): WP Fusion Lite \<= 3.37.18 Cross-Site Request Forgery to Data Deletion (CVSS 6.1, Very Good Plugins WP Fusion Lite)
- [CVE-2021-38290](https://cve.now/CVE-2021-38290.md): A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel\_constants.php and fuel/modules/fuel/librar (no CVSS)
- [CVE-2021-24522](https://cve.now/CVE-2021-24522.md): ProfilePress \< 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget (no CVSS, User Registration, User Profile, Login & Membership – Profi…)
- [CVE-2021-24520](https://cve.now/CVE-2021-24520.md): Stock in & out \<= 1.0.4 - Authenticated SQL Injection (no CVSS, Stock in & out)
- [CVE-2021-24521](https://cve.now/CVE-2021-24521.md): Side Menu Lite \< 2.2.1 - Authenticated SQL Injection (no CVSS, Side Menu Lite – add sticky fixed buttons)
- [CVE-2021-24509](https://cve.now/CVE-2021-24509.md): Page View Counts \< 2.4.9 - Contributor+ Stored XSS (no CVSS, Page View Count)
- [CVE-2021-24507](https://cve.now/CVE-2021-24507.md): Astra Pro Addon \< 3.5.2 - Unauthenticated SQL Injection (no CVSS, Astra Pro Addon)
- [CVE-2021-24505](https://cve.now/CVE-2021-24505.md): Forms \< 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Forms)
- [CVE-2021-24502](https://cve.now/CVE-2021-24502.md): WP Google Map \< 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Maps Plugin using Google Maps for WordPress – WP Google Map)
- [CVE-2021-24501](https://cve.now/CVE-2021-24501.md): Workreap theme \< 2.2.2 - Missing Authorization Checks in Ajax Actions (no CVSS, Workreap)
- [CVE-2021-24500](https://cve.now/CVE-2021-24500.md): Workreap theme \< 2.2.2 - Multiple CSRF + IDOR Vulnerabilities (no CVSS, Workreap)
- [CVE-2021-24495](https://cve.now/CVE-2021-24495.md): Marmoset Viewer \< 1.9.3 - Reflected Cross Site Scripting (no CVSS, Marmoset Viewer)
- [CVE-2021-24467](https://cve.now/CVE-2021-24467.md): Leaflet Map \< 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS (no CVSS, Leaflet Map)
- [CVE-2021-24304](https://cve.now/CVE-2021-24304.md): Newsmag \< 5.0 - Unauthenticated Reflected Cross-site Scripting (XSS) (no CVSS, Newsmag)
- [CVE-2021-37215](https://cve.now/CVE-2021-37215.md): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-4 (CVSS 4.3, Larvata Digital Technology Co. FLYGO)
- [CVE-2021-37214](https://cve.now/CVE-2021-37214.md): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3 (CVSS 8.8, Larvata Digital Technology Co. FLYGO)
- [CVE-2021-37213](https://cve.now/CVE-2021-37213.md): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-2 (CVSS 4.3, Larvata Digital Technology Co. FLYGO)
- [CVE-2021-37212](https://cve.now/CVE-2021-37212.md): Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-1 (CVSS 5.4, Larvata Digital Technology Co. FLYGO)
- [CVE-2021-37211](https://cve.now/CVE-2021-37211.md): Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS (CVSS 5.4, Larvata Digital Technology Co. FLYGO)
- [CVE-2021-24499](https://cve.now/CVE-2021-24499.md): Workreap theme \< 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution (no CVSS, Workreap)
- [CVE-2021-32815](https://cve.now/CVE-2021-32815.md): Denial of service due to assertion failure in crwimage\_int.cpp (CVSS 5.5, exiv2)
- [CVE-2021-34334](https://cve.now/CVE-2021-34334.md): Denial of service due to integer overflow in loop counter (CVSS 5.5, exiv2)
- [CVE-2021-34335](https://cve.now/CVE-2021-34335.md): Denial of service due to FPE in Exiv2::Internal::resolveLens0xffff (CVSS 4.7, exiv2)
- [CVE-2021-37615](https://cve.now/CVE-2021-37615.md): Null pointer dereference in Exiv2::Internal::resolveLens0x319 (CVSS 4.7, exiv2)
- [CVE-2021-37616](https://cve.now/CVE-2021-37616.md): Null pointer dereference in Exiv2::Internal::resolveLens0x8ff (CVSS 5.5, exiv2)
- [CVE-2021-37618](https://cve.now/CVE-2021-37618.md): Out-of-bounds read in Exiv2::Jp2Image::printStructure (CVSS 4.7, exiv2)
- [CVE-2021-37619](https://cve.now/CVE-2021-37619.md): Out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header (CVSS 4.7, exiv2)
- [CVE-2021-37620](https://cve.now/CVE-2021-37620.md): Out-of-bounds read in XmpTextValue::read() (CVSS 4.7, exiv2)
- [CVE-2021-37621](https://cve.now/CVE-2021-37621.md): Denial of service due to infinite loop in Image::printIFDStructure (CVSS 5.5, exiv2)
- [CVE-2021-37622](https://cve.now/CVE-2021-37622.md): Denial of service due to infinite loop in JpegBase::printStructure (#1) (CVSS 5.5, exiv2)
- [CVE-2021-37623](https://cve.now/CVE-2021-37623.md): Denial of service due to infinite loop in JpegBase::printStructure (#2) (CVSS 5.5, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.