CVEs published August 12, 2021
167 CVEs were published on August 12, 2021: 3 critical, 68 high. 4 are now in CISA KEV.
- Published
- 167
- Critical
- 3
- High
- 68
- Medium
- 40
- Low
- 0
- Unrated
- 56
- Now in CISA KEV
- 4
- Fix available
- 111
Most affected products
- tensorflow · tensorflow-cpu +1
- 43
- Microsoft Windows
- 26
- tensorflow · tensorflow-gpu +1
- 15
- Brocade Fabric OS
- 5
- ckeditor4
- 3
- Microsoft Azure Sphere
- 3
- Microsoft Azure CycleCloud
- 2
- Microsoft Dynamics 365 (on-premises)
- 2
- contao/core-bundle · contao/contao
- 1
- express-cart
- 1
Critical 3
High 68
- CVE-2021-37695Execution of JavaScript code using malformed HTML in ckeditorckeditor4
- CVE-2021-37663Incomplete validation in `QuantizeV2` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37665Incomplete validation in MKL requantization in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37679Heap OOB in nested `tf.map_fn` with `RaggedTensor`s in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-38614Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header.
- CVE-2021-37681Null pointer exception in TensorFlow Litetensorflow · tensorflow-cpu +1
- CVE-2021-37689Null pointer dereference in TensorFlow Lite MLIR optimizationstensorflow · tensorflow-cpu +1
- CVE-2021-37688Null pointer dereference in TensorFlow Litetensorflow · tensorflow-gpu +1
- CVE-2021-37676Reference binding to nullptr in shape inference in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37671Reference binding to nullptr in map operations in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37666Reference binding to nullptr in `RaggedTensorToVariant` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37667Reference binding to nullptr in unicode encoding in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37648Incorrect validation of `SaveV2` inputs in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37652Use after free in boosted trees creation in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37651Heap buffer overflow in `FractionalAvgPoolGrad` in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37650Segfault and heap buffer overflow in `{Experimental,}DatasetToTFRecord` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37662Reference binding to nullptr in boosted trees in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37656Reference binding to nullptr in `RaggedTensorToSparse` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37657Reference binding to nullptr in `MatrixDiagV*` ops in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37658Reference binding to nullptr in `MatrixSetDiagV*` ops in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37654Heap OOB and CHECK fail in `ResourceGather` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37641Heap OOB in `RaggedGather` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37635Heap out of bounds access in sparse reduction operations in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37664Heap OOB in boosted trees in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37659Out of bounds read via null pointer dereference in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37655Heap OOB in `ResourceScatterUpdate` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37637Null pointer dereference in `CompressElement` in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-36958Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-36949Microsoft Azure Active Directory Connect Authentication Bypass VulnerabilityMicrosoft Azure Active Directory Connect Provisioning Ag… +1
- CVE-2021-36948Windows Update Medic Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36947Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-36945Windows 10 Update Assistant Elevation of Privilege VulnerabilityMicrosoft Windows Update Assistant
- CVE-2021-36942Windows LSA Spoofing VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-36941Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 2019 f…
- CVE-2021-36940Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server 2013 Service Pack… +1
- CVE-2021-36937Windows Media MPEG-4 Video Decoder Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-36936Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-36933Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36932Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36927Windows Digital TV Tuner device registration application Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36926Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-34537Windows Bluetooth Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34536Windows Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34535Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2021-34533Windows Graphics Component Font Parsing Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-34530Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-34524Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2021-34487Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34486Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34484Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34483Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-34478Microsoft Office Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2021-34471Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2021-33762Azure CycleCloud Elevation of Privilege VulnerabilityMicrosoft Azure CycleCloud
- CVE-2021-26433Windows Services for NFS ONCRPC XDR Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-26431Windows Recovery Environment Agent Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26429Azure Sphere Elevation of Privilege VulnerabilityMicrosoft Azure Sphere
- CVE-2021-26426Windows User Account Profile Picture Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26425Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26423.NET Core and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft Visual Studio +24
- CVE-2021-37649Null pointer dereference in `UncompressElement` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37647Null pointer dereference in `SparseTensorSliceDataset` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37643Null pointer dereference in `MatrixDiagPartOp` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37639Null pointer dereference and heap OOB read in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37638Null pointer dereference in `RaggedTensorToTensor` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-32808Cross-site scripting in ckeditor via abuse of undo functionalityckeditor4
- CVE-2021-20509IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection.IBM Maximo Asset Management
- CVE-2021-38604In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading
Medium, low and unrated 96
- CVE-2021-37690Use after free and segfault in shape inference functions in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37692Segfault on strings tensors with mistmatched dimensions in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37669Crash in NMS ops caused by integer conversion to unsigned in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37673`CHECK`-fail in `MapStage` in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37682Use of unitialized value in TensorFlow Litetensorflow · tensorflow-cpu +1
- CVE-2021-37674Incomplete validation in `MaxPoolGrad` in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37677Missing validation in shape inference for `Dequantize` in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-37683Division by zero in TensorFlow Lite division operationstensorflow · tensorflow-cpu +1
- CVE-2021-37684Division by zero in TensorFlow Lite pooling operationstensorflow · tensorflow-cpu +1
- CVE-2021-37668Division by zero in TensorFlow Lite `tf.raw_ops.UnravelIndex`tensorflow · tensorflow-gpu +1
- CVE-2021-37670Heap OOB in `UpperBound` and `LowerBound` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37691Division by zero in LSH in TensorFlow Litetensorflow · tensorflow-cpu +1
- CVE-2021-37672Heap OOB in `SdcaOptimizerV2` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37687Heap OOB in TensorFlow Lite's `Gather*` implementationstensorflow · tensorflow-cpu +1
- CVE-2021-37685Heap OOB in TensorFlow Litetensorflow · tensorflow-gpu +1
- CVE-2021-38603PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
- CVE-2021-38602PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
- CVE-2021-28121Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field.
- CVE-2021-28890J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to
- CVE-2021-37686Infinite loop in TensorFlow Litetensorflow · tensorflow-cpu +1
- CVE-2021-29377Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely.
- CVE-2021-37680Division by zero in TFLite in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37675Division by 0 in most convolution operators in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-31556An issue was discovered in the Oauth extension for MediaWiki through 1.35.2.
- CVE-2021-31698Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in
- CVE-2021-31731A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to inde
- CVE-2020-36363Amazon AWS CloudFront TLSv1.2_2019 allows TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, which some entiti
- CVE-2021-37646Bad alloc in `StringNGrams` caused by integer conversion in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2020-20990A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web s
- CVE-2020-20989A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
- CVE-2020-20988A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitra
- CVE-2021-37661Crash caused by integer conversion to unsigned in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37645Integer overflow due to conversion to unsigned in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-33056Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message.
- CVE-2021-33199In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input->get('file') instead o
- CVE-2021-37700Clipboard-based DOM-XSSgithub paste-markdown · @github/paste-markdown
- CVE-2021-37599The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remot
- CVE-2021-37644`std::abort` raised from `TensorListReserve` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-38366Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code ex
- CVE-2021-37704Exposed phpinfo() in PhpFastCachePHPSocialNetwork phpfastcache · phpfastcache/phpfastcache
- CVE-2020-18464Cross Site Request Forgery (CSRF) vulnerability in AikCms 2.0.0 in video_list.php, which can let a malicious user delete movie information.
- CVE-2020-18463Cross Site Request Forgery (CSRF) vulnerability exists in v2.0.0 in video_list.php, which can let a malicious user delete a video message.
- CVE-2020-18462File Upload vulnerabilty in AikCms v2.0.0 in poster_edit.php because the background file management office does not verify the uploaded file
- CVE-2020-18460Cross Site Request Forgery (CSRF) vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content.
- CVE-2021-36950Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2021-36946Microsoft Dynamics Business Central Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 Business Central Spring 2019 Upda… +2
- CVE-2021-36943Azure CycleCloud Elevation of Privilege VulnerabilityMicrosoft Azure CycleCloud
- CVE-2021-36938Windows Cryptographic Primitives Library Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-34534Windows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-34532ASP.NET Core and Visual Studio Information Disclosure VulnerabilityMicrosoft ASP.NET Core · Microsoft Visual Studio +1
- CVE-2021-34485.NET Core and Visual Studio Information Disclosure VulnerabilityMicrosoft .NET · Microsoft Visual Studio +27
- CVE-2021-34480Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2021-26430Azure Sphere Denial of Service VulnerabilityMicrosoft Azure Sphere
- CVE-2021-26428Azure Sphere Information Disclosure VulnerabilityMicrosoft Azure Sphere
- CVE-2020-18458Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd.
- CVE-2020-18457Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html.
- CVE-2020-18456Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php.
- CVE-2020-18455Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php.
- CVE-2020-18454Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module_id/70/group_id/1.html.
- CVE-2021-37660Division by 0 in inplace operations in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37653Division by 0 in `ResourceGather` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37642Division by 0 in `ResourceScatterDiv` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2021-37640Integer division by 0 in sparse reshaping in TensorFlowtensorflow · tensorflow-gpu +1
- CVE-2021-36982AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Inject
- CVE-2021-37636Floating point exception in `SparseDenseCwiseDiv` in TensorFlowtensorflow · tensorflow-cpu +1
- CVE-2020-18451Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.
- CVE-2021-36921AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authenticat
- CVE-2020-18449Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php
- CVE-2021-32809Arbitrary HTML injection vulnerability in ckeditorckeditor4
- CVE-2020-18446Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php.
- CVE-2020-18445Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php.
- CVE-2021-38606reNgine through 0.5 relies on a predictable directory name.
- CVE-2021-38599WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignogithub.com/wal-g/wal-g
- CVE-2020-20981A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
- CVE-2020-20979An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.
- CVE-2020-20977A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scr
- CVE-2020-20975In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
- CVE-2021-20314Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially codelibspf2
- CVE-2021-35955Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.contao/core-bundle · contao/contao
- CVE-2021-27791The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a aBrocade Fabric OS
- CVE-2021-27790The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0_CBN4, and v7.4.2h uses unsafe string functioBrocade Fabric OS
- CVE-2021-38597wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extensi
- CVE-2021-27794A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could aBrocade Fabric OS
- CVE-2021-27792The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properlBrocade Fabric OS
- CVE-2021-27793ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in BBrocade Fabric OS
- CVE-2021-38087Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.
- CVE-2021-38086Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalat
- CVE-2021-38088Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.
- CVE-2021-37841Docker Desktop before 3.6.0 suffers from incorrect access control.
- CVE-2020-28165The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability.
- CVE-2020-24576Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\SYSTEM.
- CVE-2021-37222Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory
- CVE-2021-38592Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (called from EvaluateExpression and m3_LoadModule).
- CVE-2020-22403Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code express-cart
- CVE-2021-38291FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.
- CVE-2021-38593Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill a