# CVEs published 2021-08-10

96 CVEs were published on August 10, 2021: 1 critical, 9 high. Days are UTC.

- [CVE-2021-38532](https://cve.now/CVE-2021-38532.md): NETGEAR WAC104 devices before 1.0.4.15 are affected by incorrect configuration of security settings. (CVSS 6.8)
- [CVE-2021-38533](https://cve.now/CVE-2021-38533.md): NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS. (CVSS 5.4)
- [CVE-2021-38534](https://cve.now/CVE-2021-38534.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.1)
- [CVE-2021-38535](https://cve.now/CVE-2021-38535.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.3)
- [CVE-2021-38536](https://cve.now/CVE-2021-38536.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.3)
- [CVE-2021-38537](https://cve.now/CVE-2021-38537.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 4.2)
- [CVE-2021-38538](https://cve.now/CVE-2021-38538.md): Certain NETGEAR devices are affected by stored XSS. (CVSS 6.3)
- [CVE-2021-38539](https://cve.now/CVE-2021-38539.md): Certain NETGEAR devices are affected by privilege escalation. (CVSS 6.3)
- [CVE-2021-32122](https://cve.now/CVE-2021-32122.md): Certain NETGEAR devices are affected by CSRF. (CVSS 9.8)
- [CVE-2021-38514](https://cve.now/CVE-2021-38514.md): Certain NETGEAR devices are affected by authentication bypass. (CVSS 2.4)
- [CVE-2021-20032](https://cve.now/CVE-2021-20032.md): SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which pot (no CVSS, SonicWall Analytics On-Prem)
- [CVE-2021-29400](https://cve.now/CVE-2021-29400.md): A cross-site request forgery (CSRF) vulnerability in the My SMTP Contact v1.1.1 plugin for GetSimple CMS allows remote attackers to change t (no CVSS)
- [CVE-2021-38511](https://cve.now/CVE-2021-38511.md): An issue was discovered in the tar crate before 0.4.36 for Rust. (no CVSS, tar)
- [CVE-2021-38512](https://cve.now/CVE-2021-38512.md): An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. (no CVSS, actix-http)
- [CVE-2021-38490](https://cve.now/CVE-2021-38490.md): Altova MobileTogether Server before 7.3 SP1 allows XML exponential entity expansion, a different vulnerability than CVE-2021-37425. (no CVSS)
- [CVE-2020-21930](https://cve.now/CVE-2020-21930.md): A stored cross site scripting (XSS) vulnerability in the web\_attr\_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitr (no CVSS)
- [CVE-2020-21929](https://cve.now/CVE-2020-21929.md): A stored cross site scripting (XSS) vulnerability in the web\_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arb (no CVSS)
- [CVE-2021-37425](https://cve.now/CVE-2021-37425.md): Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or rea (no CVSS)
- [CVE-2020-21678](https://cve.now/CVE-2020-21678.md): A global buffer overflow in the genmp\_writefontmacro\_latex component in genmp.c of fig2dev 3.2.7b allows attackers to cause a denial of serv (no CVSS)
- [CVE-2020-21677](https://cve.now/CVE-2020-21677.md): A heap-based buffer overflow in the sixel\_encoder\_output\_without\_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a d (no CVSS)
- [CVE-2020-21675](https://cve.now/CVE-2020-21675.md): A stack-based buffer overflow in the genptk\_text component in genptk.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) (no CVSS)
- [CVE-2020-21680](https://cve.now/CVE-2020-21680.md): A stack-based buffer overflow in the put\_arrow() component in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (D (no CVSS)
- [CVE-2020-21681](https://cve.now/CVE-2020-21681.md): A global buffer overflow in the set\_color component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via con (no CVSS)
- [CVE-2020-21682](https://cve.now/CVE-2020-21682.md): A global buffer overflow in the set\_fill component in genge.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via conv (no CVSS)
- [CVE-2020-21683](https://cve.now/CVE-2020-21683.md): A global buffer overflow in the shade\_or\_tint\_name\_after\_declare\_color in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial (no CVSS)
- [CVE-2020-21684](https://cve.now/CVE-2020-21684.md): A global buffer overflow in the put\_font in genpict2e.c of fig2dev 3.2.7b allows attackers to cause a denial of service (DOS) via converting (no CVSS)
- [CVE-2020-21688](https://cve.now/CVE-2020-21688.md): A heap-use-after-free in the av\_freep function in libavutil/mem.c of FFmpeg 4.2 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2020-21697](https://cve.now/CVE-2020-21697.md): A heap-use-after-free in the mpeg\_mux\_write\_packet function in libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of service (DOS) (no CVSS)
- [CVE-2021-29296](https://cve.now/CVE-2021-29296.md): Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. (no CVSS)
- [CVE-2021-29295](https://cve.now/CVE-2021-29295.md): Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via (no CVSS)
- [CVE-2021-29294](https://cve.now/CVE-2021-29294.md): Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK\_1.01, which could let a remove malicious user cause a denial of service (no CVSS)
- [CVE-2021-33708](https://cve.now/CVE-2021-33708.md): Due to insufficient input validation in Kyma, authenticated users can pass a Header of their choice and escalate privileges. (CVSS 7.6, SAP SE Kyma)
- [CVE-2021-28846](https://cve.now/CVE-2021-28846.md): A Format String vulnerablity exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, wh (no CVSS)
- [CVE-2021-28845](https://cve.now/CVE-2021-28845.md): Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1 (no CVSS)
- [CVE-2021-21601](https://cve.now/CVE-2021-21601.md): Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CIS (CVSS 8.8, Dell Data Protection Search)
- [CVE-2021-21600](https://cve.now/CVE-2021-21600.md): Dell EMC NetWorker, 19.4 or older, contain an uncontrolled resource consumption flaw in its API service. (CVSS 6.5, Dell NetWorker)
- [CVE-2021-21598](https://cve.now/CVE-2021-21598.md): Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability. (CVSS 3.9, Dell Wyse ThinOS)
- [CVE-2021-21597](https://cve.now/CVE-2021-21597.md): Dell Wyse ThinOS, version 9.0, contains a Sensitive Information Disclosure Vulnerability. (CVSS 7.2, Dell Wyse ThinOS)
- [CVE-2021-21567](https://cve.now/CVE-2021-21567.md): Dell PowerScale OneFS 9.1.0.x contains an improper privilege management vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2021-37389](https://cve.now/CVE-2021-37389.md): Chamilo 1.11.14 allows stored XSS via main/install/index.php and main/install/ajax.php through the port parameter. (no CVSS)
- [CVE-2021-37390](https://cve.now/CVE-2021-37390.md): A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature). (no CVSS)
- [CVE-2021-37391](https://cve.now/CVE-2021-37391.md): A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/socia (no CVSS)
- [CVE-2021-38386](https://cve.now/CVE-2021-38386.md): In Contiki 3.0, a buffer overflow in the Telnet service allows remote attackers to cause a denial of service because the ls command is misha (no CVSS)
- [CVE-2021-38387](https://cve.now/CVE-2021-38387.md): In Contiki 3.0, a Telnet server that silently quits (before disconnection with clients) leads to connected clients entering an infinite loop (no CVSS)
- [CVE-2021-28844](https://cve.now/CVE-2021-28844.md): Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1 (no CVSS)
- [CVE-2021-28843](https://cve.now/CVE-2021-28843.md): Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1 (no CVSS)
- [CVE-2021-28842](https://cve.now/CVE-2021-28842.md): Null Pointer Deference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.1 (no CVSS)
- [CVE-2021-28841](https://cve.now/CVE-2021-28841.md): Null Pointer Dereference vulnerability in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, (no CVSS)
- [CVE-2021-38140](https://cve.now/CVE-2021-38140.md): The set\_user extension module before 2.0.1 for PostgreSQL allows a potential privilege escalation using RESET SESSION AUTHORIZATION after se (no CVSS)
- [CVE-2021-38384](https://cve.now/CVE-2021-38384.md): Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implem (no CVSS, serverless-offline)
- [CVE-2021-28840](https://cve.now/CVE-2021-28840.md): Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, (no CVSS)
- [CVE-2021-28839](https://cve.now/CVE-2021-28839.md): Null Pointer Dereference vulnerability exists in D-Link DAP-2310 2.07.RC031, DAP-2330 1.07.RC028, DAP-2360 2.07.RC043, DAP-2553 3.06.RC027, (no CVSS)
- [CVE-2021-28838](https://cve.now/CVE-2021-28838.md): Null pointer dereference vulnerability in D-Link DAP-2310 2,10RC039, DAP-2330 1.10RC036 BETA, DAP-2360 2.10RC055, DAP-2553 3.10rc039 BETA, D (no CVSS)
- [CVE-2021-38380](https://cve.now/CVE-2021-38380.md): Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. (no CVSS)
- [CVE-2021-38381](https://cve.now/CVE-2021-38381.md): Live555 through 1.08 does not handle MPEG-1 or 2 files properly. (no CVSS)
- [CVE-2021-38382](https://cve.now/CVE-2021-38382.md): Live555 through 1.08 does not handle Matroska and Ogg files properly. (no CVSS)
- [CVE-2021-38383](https://cve.now/CVE-2021-38383.md): OwnTone (aka owntone-server) through 28.1 has a use-after-free in net\_bind() in misc.c. (no CVSS)
- [CVE-2021-32768](https://cve.now/CVE-2021-32768.md): Cross-Site Scripting via Rich-Text Content (CVSS 6.1, TYPO3.CMS · typo3/cms-core +1)
- [CVE-2021-3692](https://cve.now/CVE-2021-3692.md): Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (CVSS 8.1, yiisoft/yii2 · yiisoft/yii2-dev)
- [CVE-2020-25082](https://cve.now/CVE-2020-25082.md): An attacker with physical access to Nuvoton Trusted Platform Module (NPCT75x 7.2.x before 7.2.2.0) could extract an Elliptic Curve Cryptogra (CVSS 3.8)
- [CVE-2021-37365](https://cve.now/CVE-2021-37365.md): CTparental before 4.45.03 is vulnerable to cross-site scripting (XSS) in the CTparental admin panel. (no CVSS)
- [CVE-2021-37366](https://cve.now/CVE-2021-37366.md): CTparental before 4.45.03 is vulnerable to cross-site request forgery (CSRF) in the CTparental admin panel. (no CVSS)
- [CVE-2021-37367](https://cve.now/CVE-2021-37367.md): CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. (no CVSS)
- [CVE-2020-23172](https://cve.now/CVE-2020-23172.md): A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to (no CVSS)
- [CVE-2020-23171](https://cve.now/CVE-2020-23171.md): A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file (no CVSS)
- [CVE-2021-38373](https://cve.now/CVE-2021-38373.md): In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored (and cleartext messages are sent) unless "Server requires authent (no CVSS)
- [CVE-2021-38372](https://cve.now/CVE-2021-38372.md): In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before ST (no CVSS)
- [CVE-2021-33706](https://cve.now/CVE-2021-33706.md): Due to improper input validation in InfraBox, logs can be modified by an authenticated user. (CVSS 4.3, SAP SE InfraBox)
- [CVE-2021-33702](https://cve.now/CVE-2021-33702.md): Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode rep (CVSS 8.3, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2021-33703](https://cve.now/CVE-2021-33703.md): Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. (CVSS 8.3, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2021-33707](https://cve.now/CVE-2021-33707.md): SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL st (CVSS 6.1, SAP SE SAP NetWeaver)
- [CVE-2021-33699](https://cve.now/CVE-2021-33699.md): Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifes (CVSS 7.6, SAP SE SAP Fiori Client Native Mobile for Android)
- [CVE-2021-38371](https://cve.now/CVE-2021-38371.md): The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. (no CVSS)
- [CVE-2021-36601](https://cve.now/CVE-2021-36601.md): GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: (no CVSS)
- [CVE-2021-32943](https://cve.now/CVE-2021-32943.md): The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the W (no CVSS, WebAccess/SCADA)
- [CVE-2021-22676](https://cve.now/CVE-2021-22676.md): UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScr (no CVSS, WebAccess/SCADA)
- [CVE-2021-22674](https://cve.now/CVE-2021-22674.md): The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and dire (no CVSS, WebAccess/SCADA)
- [CVE-2021-37152](https://cve.now/CVE-2021-37152.md): Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. (no CVSS)
- [CVE-2021-38365](https://cve.now/CVE-2021-38365.md): Winner (aka ToneWinner) desktop speakers through 2021-08-09 allow remote attackers to recover speech signals from the power-indicator LED vi (no CVSS)
- [CVE-2021-29739](https://cve.now/CVE-2021-29739.md): IBM Planning Analytics Local 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser (CVSS 2.7, IBM Planning Analytics Local)
- [CVE-2021-22385](https://cve.now/CVE-2021-22385.md): A component of the Huawei smartphone has a External Control of System or Configuration Setting vulnerability. (no CVSS, EMUI;Magic UI;HarmonyOS)
- [CVE-2021-22386](https://cve.now/CVE-2021-22386.md): A component of the Huawei smartphone has a Double Free vulnerability. (no CVSS, EMUI;Magic UI;HarmonyOS)
- [CVE-2021-31655](https://cve.now/CVE-2021-31655.md): Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. (no CVSS)
- [CVE-2021-37180](https://cve.now/CVE-2021-37180.md): A vulnerability has been identified in Solid Edge SE2021 (All Versions \< SE2021MP7). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-37179](https://cve.now/CVE-2021-37179.md): A vulnerability has been identified in Solid Edge SE2021 (All Versions \< SE2021MP7). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-37172](https://cve.now/CVE-2021-37172.md): A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. (no CVSS, Siemens SIMATIC S7-1200 CPU family)
- [CVE-2021-37178](https://cve.now/CVE-2021-37178.md): A vulnerability has been identified in Solid Edge SE2021 (All Versions \< SE2021MP7). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-33738](https://cve.now/CVE-2021-33738.md): A vulnerability has been identified in JT2Go (All versions \< V13.2.0.2), Teamcenter Visualization (All versions \< V13.2.0.2). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2021-33721](https://cve.now/CVE-2021-33721.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33717](https://cve.now/CVE-2021-33717.md): A vulnerability has been identified in JT2Go (All versions \< V13.2.0.1), Teamcenter Visualization (All versions \< V13.2.0.1). (no CVSS, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2021-25659](https://cve.now/CVE-2021-25659.md): A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All versions \< V6.0 SP9 Up (no CVSS, Siemens Automation License Manager)
- [CVE-2020-28397](https://cve.now/CVE-2020-28397.md): A vulnerability has been identified in SIMATIC Drive Controller family (All versions \< V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP (no CVSS, Siemens SIMATIC Drive Controller family · Siemens SIMATI… +5)
- [CVE-2021-3689](https://cve.now/CVE-2021-3689.md): Use of Predictable Algorithm in Random Number Generator in yiisoft/yii2 (CVSS 8.1, yiisoft/yii2 · yiisoft/yii2-dev)
- [CVE-2021-21501](https://cve.now/CVE-2021-21501.md): ServiceComb ServiceCenter Directory Traversal (no CVSS, Apache Software Foundation Apache ServiceComb · github.com/…)
- [CVE-2020-21676](https://cve.now/CVE-2020-21676.md): A stack-based buffer overflow in the genpstrx\_text() component in genpstricks.c of fig2dev 3.2.7b allows attackers to cause a denial of serv (no CVSS)
- [CVE-2021-38370](https://cve.now/CVE-2021-38370.md): In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.