CVEs published August 10, 2021
96 CVEs were published on August 10, 2021: 1 critical, 9 high.
- Published
- 96
- Critical
- 1
- High
- 9
- Medium
- 12
- Low
- 4
- Unrated
- 70
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Siemens Solid Edge SE2021
- 3
- WebAccess/SCADA
- 3
- Dell Wyse ThinOS
- 2
- EMUI;Magic UI;HarmonyOS
- 2
- SAP SE SAP NetWeaver Enterprise Portal
- 2
- Siemens JT2Go · Siemens Teamcenter Visualization
- 2
- yiisoft/yii2 · yiisoft/yii2-dev
- 2
- actix-http
- 1
- Apache Software Foundation Apache ServiceComb · github.com/…
- 1
- Dell Data Protection Search
- 1
Critical 1
High 9
- CVE-2021-33708Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges.SAP SE Kyma
- CVE-2021-21601Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CISDell Data Protection Search
- CVE-2021-21597Dell Wyse ThinOS, version 9.0, contains a Sensitive Information Disclosure Vulnerability.Dell Wyse ThinOS
- CVE-2021-21567Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2021-3692Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2yiisoft/yii2 · yiisoft/yii2-dev
- CVE-2021-33702Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode repSAP SE SAP NetWeaver Enterprise Portal
- CVE-2021-33703Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters.SAP SE SAP NetWeaver Enterprise Portal
- CVE-2021-33699Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifesSAP SE SAP Fiori Client Native Mobile for Android
- CVE-2021-3689Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2yiisoft/yii2 · yiisoft/yii2-dev
Medium, low and unrated 86
- CVE-2021-38532NETGEAR WAC104 devices before 1.0.4.15 are affected by incorrect configuration of security settings.
- CVE-2021-38533NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS.
- CVE-2021-38534Certain NETGEAR devices are affected by stored XSS.
- CVE-2021-38535Certain NETGEAR devices are affected by stored XSS.
- CVE-2021-38536Certain NETGEAR devices are affected by stored XSS.
- CVE-2021-38537Certain NETGEAR devices are affected by stored XSS.
- CVE-2021-38538Certain NETGEAR devices are affected by stored XSS.
- CVE-2021-38539Certain NETGEAR devices are affected by privilege escalation.
- CVE-2021-38514Certain NETGEAR devices are affected by authentication bypass.
- CVE-2021-20032SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potSonicWall Analytics On-Prem
- CVE-2021-29400A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change t
- CVE-2021-38511An issue was discovered in the tar crate before 0.4.36 for Rust.tar
- CVE-2021-38512An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust.actix-http
- CVE-2021-38490Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425.
- CVE-2020-21930A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitr
- CVE-2020-21929A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arb
- CVE-2021-37425Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or rea
- CVE-2020-21678A global buffer overflow in the genmp_writefontmacro_latex component in genmp.c of fig2dev 3.2.7b allows attackers to cause a denial of serv
- CVE-2020-21677A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a d
- CVE-2020-21675A stack-based buffer overflow in the genptk_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS)
- CVE-2020-21680A stack-based buffer overflow in the put_arrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (D
- CVE-2020-21681A global buffer overflow in the set_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via con
- CVE-2020-21682A global buffer overflow in the set_fill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via conv
- CVE-2020-21683A global buffer overflow in the shade_or_tint_name_after_declare_color in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial
- CVE-2020-21684A global buffer overflow in the put_font in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting
- CVE-2020-21688A heap-use-after-free in the av_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code.
- CVE-2020-21697A heap-use-after-free in the mpeg_mux_write_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS)
- CVE-2021-29296Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service.
- CVE-2021-29295Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via
- CVE-2021-29294Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service
- CVE-2021-28846A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, wh
- CVE-2021-28845Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1
- CVE-2021-21600Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service.Dell NetWorker
- CVE-2021-21598Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability.Dell Wyse ThinOS
- CVE-2021-37389Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter.
- CVE-2021-37390A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).
- CVE-2021-37391A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/socia
- CVE-2021-38386In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is misha
- CVE-2021-38387In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop
- CVE-2021-28844Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1
- CVE-2021-28843Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1
- CVE-2021-28842Null Pointer Deference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.1
- CVE-2021-28841Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03,
- CVE-2021-38140The set_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after se
- CVE-2021-38384Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implemserverless-offline
- CVE-2021-28840Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027,
- CVE-2021-28839Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027,
- CVE-2021-28838Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, D
- CVE-2021-38380Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read.
- CVE-2021-38381Live555 through 1.08 does not handle MPEG-1 or 2 files properly.
- CVE-2021-38382Live555 through 1.08 does not handle Matroska and Ogg files properly.
- CVE-2021-38383OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.
- CVE-2021-32768Cross-Site Scripting via Rich-Text ContentTYPO3.CMS · typo3/cms-core +1
- CVE-2020-25082An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptogra
- CVE-2021-37365CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel.
- CVE-2021-37366CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel.
- CVE-2021-37367CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel.
- CVE-2020-23172A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to
- CVE-2020-23171A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file
- CVE-2021-38373In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authent
- CVE-2021-38372In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before ST
- CVE-2021-33706Due to improper input validation in InfraBox, logs can be modified by an authenticated user.SAP SE InfraBox
- CVE-2021-33707SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stSAP SE SAP NetWeaver
- CVE-2021-38371The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
- CVE-2021-36601GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL:
- CVE-2021-32943The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WWebAccess/SCADA
- CVE-2021-22676UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScrWebAccess/SCADA
- CVE-2021-22674The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and direWebAccess/SCADA
- CVE-2021-37152Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0.
- CVE-2021-38365Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED vi
- CVE-2021-29739IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browserIBM Planning Analytics Local
- CVE-2021-22385A component of the Huawei smartphone has a External Control of System or Configuration Setting vulnerability.EMUI;Magic UI;HarmonyOS
- CVE-2021-22386A component of the Huawei smartphone has a Double Free vulnerability.EMUI;Magic UI;HarmonyOS
- CVE-2021-31655Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter.
- CVE-2021-37180A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7).Siemens Solid Edge SE2021
- CVE-2021-37179A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7).Siemens Solid Edge SE2021
- CVE-2021-37172A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl.Siemens SIMATIC S7-1200 CPU family
- CVE-2021-37178A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7).Siemens Solid Edge SE2021
- CVE-2021-33738A vulnerability has been identified in JT2Go (All versions < V13.2.0.2), Teamcenter Visualization (All versions < V13.2.0.2).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-33721A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2).Siemens SINEC NMS
- CVE-2021-33717A vulnerability has been identified in JT2Go (All versions < V13.2.0.1), Teamcenter Visualization (All versions < V13.2.0.1).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-25659A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions < V6.0 SP9 UpSiemens Automation License Manager
- CVE-2020-28397A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP Siemens SIMATIC Drive Controller family · Siemens SIMATI… +5
- CVE-2021-21501ServiceComb ServiceCenter Directory TraversalApache Software Foundation Apache ServiceComb · github.com/…
- CVE-2020-21676A stack-based buffer overflow in the genpstrx_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of serv
- CVE-2021-38370In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS.