# CVEs published 2021-08-12

167 CVEs were published on August 12, 2021: 3 critical, 68 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2021-37690](https://cve.now/CVE-2021-37690.md): Use after free and segfault in shape inference functions in TensorFlow (CVSS 6.6, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37695](https://cve.now/CVE-2021-37695.md): Execution of JavaScript code using malformed HTML in ckeditor (CVSS 7.3, ckeditor4)
- [CVE-2021-37678](https://cve.now/CVE-2021-37678.md): Arbitrary code execution due to YAML deserialization (CVSS 9.3, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37692](https://cve.now/CVE-2021-37692.md): Segfault on strings tensors with mistmatched dimensions in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37669](https://cve.now/CVE-2021-37669.md): Crash in NMS ops caused by integer conversion to unsigned in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37673](https://cve.now/CVE-2021-37673.md): \`CHECK\`-fail in \`MapStage\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37663](https://cve.now/CVE-2021-37663.md): Incomplete validation in \`QuantizeV2\` in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37682](https://cve.now/CVE-2021-37682.md): Use of unitialized value in TensorFlow Lite (CVSS 4.4, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37674](https://cve.now/CVE-2021-37674.md): Incomplete validation in \`MaxPoolGrad\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37665](https://cve.now/CVE-2021-37665.md): Incomplete validation in MKL requantization in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37677](https://cve.now/CVE-2021-37677.md): Missing validation in shape inference for \`Dequantize\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37683](https://cve.now/CVE-2021-37683.md): Division by zero in TensorFlow Lite division operations (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37684](https://cve.now/CVE-2021-37684.md): Division by zero in TensorFlow Lite pooling operations (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37668](https://cve.now/CVE-2021-37668.md): Division by zero in TensorFlow Lite \`tf.raw\_ops.UnravelIndex\` (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37670](https://cve.now/CVE-2021-37670.md): Heap OOB in \`UpperBound\` and \`LowerBound\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37691](https://cve.now/CVE-2021-37691.md): Division by zero in LSH in TensorFlow Lite (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37679](https://cve.now/CVE-2021-37679.md): Heap OOB in nested \`tf.map\_fn\` with \`RaggedTensor\`s in TensorFlow (CVSS 7.1, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37672](https://cve.now/CVE-2021-37672.md): Heap OOB in \`SdcaOptimizerV2\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-38614](https://cve.now/CVE-2021-38614.md): Polipo through 1.1.1, when NDEBUG is used, allows a heap-based buffer overflow during parsing of a Range header. (CVSS 7.5)
- [CVE-2021-37687](https://cve.now/CVE-2021-37687.md): Heap OOB in TensorFlow Lite's \`Gather\*\` implementations (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37685](https://cve.now/CVE-2021-37685.md): Heap OOB in TensorFlow Lite (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-38603](https://cve.now/CVE-2021-38603.md): PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. (no CVSS)
- [CVE-2021-38602](https://cve.now/CVE-2021-38602.md): PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. (no CVSS)
- [CVE-2021-37681](https://cve.now/CVE-2021-37681.md): Null pointer exception in TensorFlow Lite (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37689](https://cve.now/CVE-2021-37689.md): Null pointer dereference in TensorFlow Lite MLIR optimizations (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37688](https://cve.now/CVE-2021-37688.md): Null pointer dereference in TensorFlow Lite (CVSS 7.8, tensorflow · tensorflow-gpu +1)
- [CVE-2021-28121](https://cve.now/CVE-2021-28121.md): Virtual Robots.txt before 1.10 does not block HTML tags in the robots.txt field. (no CVSS)
- [CVE-2021-28890](https://cve.now/CVE-2021-28890.md): J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to (no CVSS)
- [CVE-2021-37686](https://cve.now/CVE-2021-37686.md): Infinite loop in TensorFlow Lite (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-29377](https://cve.now/CVE-2021-29377.md): Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. (no CVSS)
- [CVE-2021-37680](https://cve.now/CVE-2021-37680.md): Division by zero in TFLite in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37675](https://cve.now/CVE-2021-37675.md): Division by 0 in most convolution operators in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37676](https://cve.now/CVE-2021-37676.md): Reference binding to nullptr in shape inference in TensorFlow (CVSS 7.8, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37671](https://cve.now/CVE-2021-37671.md): Reference binding to nullptr in map operations in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37666](https://cve.now/CVE-2021-37666.md): Reference binding to nullptr in \`RaggedTensorToVariant\` in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37667](https://cve.now/CVE-2021-37667.md): Reference binding to nullptr in unicode encoding in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-31556](https://cve.now/CVE-2021-31556.md): An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. (no CVSS)
- [CVE-2021-31698](https://cve.now/CVE-2021-31698.md): Quectel EG25-G devices through 202006130814 allow executing arbitrary code remotely by using an AT command to place shell metacharacters in (no CVSS)
- [CVE-2021-31731](https://cve.now/CVE-2021-31731.md): A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to inde (no CVSS)
- [CVE-2021-37648](https://cve.now/CVE-2021-37648.md): Incorrect validation of \`SaveV2\` inputs in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37652](https://cve.now/CVE-2021-37652.md): Use after free in boosted trees creation in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2020-36363](https://cve.now/CVE-2020-36363.md): Amazon AWS CloudFront TLSv1.2\_2019 allows TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 and TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, which some entiti (no CVSS)
- [CVE-2021-37646](https://cve.now/CVE-2021-37646.md): Bad alloc in \`StringNGrams\` caused by integer conversion in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2020-20990](https://cve.now/CVE-2020-20990.md): A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web s (no CVSS)
- [CVE-2020-20989](https://cve.now/CVE-2020-20989.md): A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs. (no CVSS)
- [CVE-2020-20988](https://cve.now/CVE-2020-20988.md): A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitra (no CVSS)
- [CVE-2021-37661](https://cve.now/CVE-2021-37661.md): Crash caused by integer conversion to unsigned in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37645](https://cve.now/CVE-2021-37645.md): Integer overflow due to conversion to unsigned in TensorFlow (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37651](https://cve.now/CVE-2021-37651.md): Heap buffer overflow in \`FractionalAvgPoolGrad\` in TensorFlow (CVSS 7.1, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37650](https://cve.now/CVE-2021-37650.md): Segfault and heap buffer overflow in \`{Experimental,}DatasetToTFRecord\` in TensorFlow (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37662](https://cve.now/CVE-2021-37662.md): Reference binding to nullptr in boosted trees in TensorFlow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-33056](https://cve.now/CVE-2021-33056.md): Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message. (no CVSS)
- [CVE-2021-37656](https://cve.now/CVE-2021-37656.md): Reference binding to nullptr in \`RaggedTensorToSparse\` in TensorFlow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37657](https://cve.now/CVE-2021-37657.md): Reference binding to nullptr in \`MatrixDiagV\*\` ops in TensorFlow (CVSS 7.1, tensorflow · tensorflow-gpu +1)
- [CVE-2021-37658](https://cve.now/CVE-2021-37658.md): Reference binding to nullptr in \`MatrixSetDiagV\*\` ops in TensorFlow (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-33199](https://cve.now/CVE-2021-33199.md): In Expression Engine before 6.0.3, addonIcon in Addons/file/mod.file.php relies on the untrusted input value of input-\>get('file') instead o (no CVSS)
- [CVE-2021-37700](https://cve.now/CVE-2021-37700.md): Clipboard-based DOM-XSS (CVSS 6.5, github paste-markdown · @github/paste-markdown)
- [CVE-2021-37599](https://cve.now/CVE-2021-37599.md): The exporter/Login.aspx login form in the Exporter in Nuance Winscribe Dictation 4.1.0.99 is vulnerable to SQL injection that allows a remot (no CVSS)
- [CVE-2021-37644](https://cve.now/CVE-2021-37644.md): \`std::abort\` raised from \`TensorListReserve\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37654](https://cve.now/CVE-2021-37654.md): Heap OOB and CHECK fail in \`ResourceGather\` in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37641](https://cve.now/CVE-2021-37641.md): Heap OOB in \`RaggedGather\` in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37635](https://cve.now/CVE-2021-37635.md): Heap out of bounds access in sparse reduction operations in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37664](https://cve.now/CVE-2021-37664.md): Heap OOB in boosted trees in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37659](https://cve.now/CVE-2021-37659.md): Out of bounds read via null pointer dereference in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37655](https://cve.now/CVE-2021-37655.md): Heap OOB in \`ResourceScatterUpdate\` in TensorFlow (CVSS 7.3, tensorflow · tensorflow-cpu +1)
- [CVE-2021-38366](https://cve.now/CVE-2021-38366.md): Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code ex (no CVSS)
- [CVE-2021-37704](https://cve.now/CVE-2021-37704.md): Exposed phpinfo() in PhpFastCache (CVSS 5.4, PHPSocialNetwork phpfastcache · phpfastcache/phpfastcache)
- [CVE-2020-18464](https://cve.now/CVE-2020-18464.md): Cross Site Request Forgery (CSRF) vulnerability in AikCms 2.0.0 in video\_list.php, which can let a malicious user delete movie information. (no CVSS)
- [CVE-2020-18463](https://cve.now/CVE-2020-18463.md): Cross Site Request Forgery (CSRF) vulnerability exists in v2.0.0 in video\_list.php, which can let a malicious user delete a video message. (no CVSS)
- [CVE-2020-18462](https://cve.now/CVE-2020-18462.md): File Upload vulnerabilty in AikCms v2.0.0 in poster\_edit.php because the background file management office does not verify the uploaded file (no CVSS)
- [CVE-2021-37637](https://cve.now/CVE-2021-37637.md): Null pointer dereference in \`CompressElement\` in TensorFlow (CVSS 7.7, tensorflow · tensorflow-gpu +1)
- [CVE-2020-18460](https://cve.now/CVE-2020-18460.md): Cross Site Request Forgery (CSRF) vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content. (no CVSS)
- [CVE-2021-36958](https://cve.now/CVE-2021-36958.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36950](https://cve.now/CVE-2021-36950.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 5.4, Microsoft Dynamics 365 (on-premises))
- [CVE-2021-36949](https://cve.now/CVE-2021-36949.md): Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability (CVSS 7.1, Microsoft Azure Active Directory Connect Provisioning Ag… +1)
- [CVE-2021-36948](https://cve.now/CVE-2021-36948.md): Windows Update Medic Service Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-36947](https://cve.now/CVE-2021-36947.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-36946](https://cve.now/CVE-2021-36946.md): Microsoft Dynamics Business Central Cross-site Scripting Vulnerability (CVSS 5.4, Microsoft Dynamics 365 Business Central Spring 2019 Upda… +2)
- [CVE-2021-36945](https://cve.now/CVE-2021-36945.md): Windows 10 Update Assistant Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows Update Assistant)
- [CVE-2021-36943](https://cve.now/CVE-2021-36943.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 4.0, Microsoft Azure CycleCloud)
- [CVE-2021-36942](https://cve.now/CVE-2021-36942.md): Windows LSA Spoofing Vulnerability (CVSS 7.5, KEV, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-36941](https://cve.now/CVE-2021-36941.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office 2019 f…)
- [CVE-2021-36940](https://cve.now/CVE-2021-36940.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server 2013 Service Pack… +1)
- [CVE-2021-36938](https://cve.now/CVE-2021-36938.md): Windows Cryptographic Primitives Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36937](https://cve.now/CVE-2021-36937.md): Windows Media MPEG-4 Video Decoder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36936](https://cve.now/CVE-2021-36936.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-36933](https://cve.now/CVE-2021-36933.md): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-36932](https://cve.now/CVE-2021-36932.md): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-36927](https://cve.now/CVE-2021-36927.md): Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36926](https://cve.now/CVE-2021-36926.md): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-34537](https://cve.now/CVE-2021-34537.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34536](https://cve.now/CVE-2021-34536.md): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34535](https://cve.now/CVE-2021-34535.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2021-34534](https://cve.now/CVE-2021-34534.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-34533](https://cve.now/CVE-2021-34533.md): Windows Graphics Component Font Parsing Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34532](https://cve.now/CVE-2021-34532.md): ASP.NET Core and Visual Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft ASP.NET Core · Microsoft Visual Studio +1)
- [CVE-2021-34530](https://cve.now/CVE-2021-34530.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34524](https://cve.now/CVE-2021-34524.md): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Dynamics 365 (on-premises))
- [CVE-2021-34487](https://cve.now/CVE-2021-34487.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-34486](https://cve.now/CVE-2021-34486.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-34485](https://cve.now/CVE-2021-34485.md): .NET Core and Visual Studio Information Disclosure Vulnerability (CVSS 5.0, Microsoft .NET · Microsoft Visual Studio +27)
- [CVE-2021-34484](https://cve.now/CVE-2021-34484.md): Windows User Profile Service Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-34483](https://cve.now/CVE-2021-34483.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-34480](https://cve.now/CVE-2021-34480.md): Scripting Engine Memory Corruption Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-34478](https://cve.now/CVE-2021-34478.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2021-34471](https://cve.now/CVE-2021-34471.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2021-33762](https://cve.now/CVE-2021-33762.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure CycleCloud)
- [CVE-2021-26433](https://cve.now/CVE-2021-26433.md): Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-26432](https://cve.now/CVE-2021-26432.md): Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2021-26431](https://cve.now/CVE-2021-26431.md): Windows Recovery Environment Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-26430](https://cve.now/CVE-2021-26430.md): Azure Sphere Denial of Service Vulnerability (CVSS 6.0, Microsoft Azure Sphere)
- [CVE-2021-26429](https://cve.now/CVE-2021-26429.md): Azure Sphere Elevation of Privilege Vulnerability (CVSS 7.7, Microsoft Azure Sphere)
- [CVE-2021-26428](https://cve.now/CVE-2021-26428.md): Azure Sphere Information Disclosure Vulnerability (CVSS 4.4, Microsoft Azure Sphere)
- [CVE-2021-26426](https://cve.now/CVE-2021-26426.md): Windows User Account Profile Picture Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2021-26425](https://cve.now/CVE-2021-26425.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-26424](https://cve.now/CVE-2021-26424.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 9.9, Microsoft Windows)
- [CVE-2021-26423](https://cve.now/CVE-2021-26423.md): .NET Core and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio +24)
- [CVE-2021-37649](https://cve.now/CVE-2021-37649.md): Null pointer dereference in \`UncompressElement\` in TensorFlow (CVSS 7.7, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37647](https://cve.now/CVE-2021-37647.md): Null pointer dereference in \`SparseTensorSliceDataset\` in TensorFlow (CVSS 7.7, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37643](https://cve.now/CVE-2021-37643.md): Null pointer dereference in \`MatrixDiagPartOp\` in TensorFlow (CVSS 7.7, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37639](https://cve.now/CVE-2021-37639.md): Null pointer dereference and heap OOB read in TensorFlow (CVSS 8.4, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37638](https://cve.now/CVE-2021-37638.md): Null pointer dereference in \`RaggedTensorToTensor\` in TensorFlow (CVSS 7.7, tensorflow · tensorflow-cpu +1)
- [CVE-2020-18458](https://cve.now/CVE-2020-18458.md): Cross Site Request Forgery (CSRF) vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd. (no CVSS)
- [CVE-2020-18457](https://cve.now/CVE-2020-18457.md): Cross Site Request Forgery (CSRF) vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html. (no CVSS)
- [CVE-2020-18456](https://cve.now/CVE-2020-18456.md): Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php. (no CVSS)
- [CVE-2020-18455](https://cve.now/CVE-2020-18455.md): Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php. (no CVSS)
- [CVE-2020-18454](https://cve.now/CVE-2020-18454.md): Cross Site Request Forgery (CSRF) vulnerability in bycms v1.3 via admin.php/systems/index/module\_id/70/group\_id/1.html. (no CVSS)
- [CVE-2021-37660](https://cve.now/CVE-2021-37660.md): Division by 0 in inplace operations in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37653](https://cve.now/CVE-2021-37653.md): Division by 0 in \`ResourceGather\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37642](https://cve.now/CVE-2021-37642.md): Division by 0 in \`ResourceScatterDiv\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-37640](https://cve.now/CVE-2021-37640.md): Integer division by 0 in sparse reshaping in TensorFlow (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-36982](https://cve.now/CVE-2021-36982.md): AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Inject (no CVSS)
- [CVE-2021-37636](https://cve.now/CVE-2021-37636.md): Floating point exception in \`SparseDenseCwiseDiv\` in TensorFlow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2020-18451](https://cve.now/CVE-2020-18451.md): Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php. (no CVSS)
- [CVE-2021-36921](https://cve.now/CVE-2021-36921.md): AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 has Improper Authenticat (no CVSS)
- [CVE-2020-18449](https://cve.now/CVE-2020-18449.md): Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php (no CVSS)
- [CVE-2021-32809](https://cve.now/CVE-2021-32809.md): Arbitrary HTML injection vulnerability in ckeditor (CVSS 4.6, ckeditor4)
- [CVE-2020-18446](https://cve.now/CVE-2020-18446.md): Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php. (no CVSS)
- [CVE-2020-18445](https://cve.now/CVE-2020-18445.md): Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php. (no CVSS)
- [CVE-2021-32808](https://cve.now/CVE-2021-32808.md): Cross-site scripting in ckeditor via abuse of undo functionality (CVSS 7.6, ckeditor4)
- [CVE-2021-20509](https://cve.now/CVE-2021-20509.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. (CVSS 7.0, IBM Maximo Asset Management)
- [CVE-2021-38606](https://cve.now/CVE-2021-38606.md): reNgine through 0.5 relies on a predictable directory name. (no CVSS)
- [CVE-2021-38604](https://cve.now/CVE-2021-38604.md): In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq\_notify.c mishandles certain NOTIFY\_REMOVED data, leading (CVSS 7.5)
- [CVE-2021-38599](https://cve.now/CVE-2021-38599.md): WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently igno (no CVSS, github.com/wal-g/wal-g)
- [CVE-2020-20981](https://cve.now/CVE-2020-20981.md): A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information. (no CVSS)
- [CVE-2020-20979](https://cve.now/CVE-2020-20979.md): An arbitrary file upload vulnerability in the move\_uploaded\_file() function of LJCMS v4.3 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2020-20977](https://cve.now/CVE-2020-20977.md): A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scr (no CVSS)
- [CVE-2020-20975](https://cve.now/CVE-2020-20975.md): In \\lib\\admin\\action\\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter. (no CVSS)
- [CVE-2021-20314](https://cve.now/CVE-2021-20314.md): Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code (no CVSS, libspf2)
- [CVE-2021-35955](https://cve.now/CVE-2021-35955.md): Contao \>=4.0.0 allows backend XSS via HTML attributes to an HTML field. (no CVSS, contao/core-bundle · contao/contao)
- [CVE-2021-27791](https://cve.now/CVE-2021-27791.md): The function that is used to parse the Authentication header in Brocade Fabric OS Web application service before Brocade Fabric OS v9.0.1a a (no CVSS, Brocade Fabric OS)
- [CVE-2021-27790](https://cve.now/CVE-2021-27790.md): The command ipfilter in Brocade Fabric OS before Brocade Fabric OS v.9.0.1a, v8.2.3, and v8.2.0\_CBN4, and v7.4.2h uses unsafe string functio (no CVSS, Brocade Fabric OS)
- [CVE-2021-38597](https://cve.now/CVE-2021-38597.md): wolfSSL before 4.8.1 incorrectly skips OCSP verification in certain situations of irrelevant response data that contains the NoCheck extensi (no CVSS)
- [CVE-2021-27794](https://cve.now/CVE-2021-27794.md): A vulnerability in the authentication mechanism of Brocade Fabric OS versions before Brocade Fabric OS v.9.0.1a, v8.2.3a and v7.4.2h could a (no CVSS, Brocade Fabric OS)
- [CVE-2021-27792](https://cve.now/CVE-2021-27792.md): The request handling functions in web management interface of Brocade Fabric OS versions before v9.0.1a, v8.2.3a, and v7.4.2h do not properl (no CVSS, Brocade Fabric OS)
- [CVE-2021-27793](https://cve.now/CVE-2021-27793.md): ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in B (no CVSS, Brocade Fabric OS)
- [CVE-2021-38087](https://cve.now/CVE-2021-38087.md): Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009. (no CVSS)
- [CVE-2021-38086](https://cve.now/CVE-2021-38086.md): Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalat (no CVSS)
- [CVE-2021-38088](https://cve.now/CVE-2021-38088.md): Acronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking. (no CVSS)
- [CVE-2021-37841](https://cve.now/CVE-2021-37841.md): Docker Desktop before 3.6.0 suffers from incorrect access control. (no CVSS)
- [CVE-2020-28165](https://cve.now/CVE-2020-28165.md): The EasyCorp ZenTao PMS 12.4.2 application suffers from an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2020-24576](https://cve.now/CVE-2020-24576.md): Netskope Client through 77 allows low-privileged users to elevate their privileges to NT AUTHORITY\\SYSTEM. (no CVSS)
- [CVE-2021-37222](https://cve.now/CVE-2021-37222.md): Parsers in the open source project RCDCAP before 1.0.5 allow remote attackers to execute arbitrary code or cause a denial of service (memory (no CVSS)
- [CVE-2021-38592](https://cve.now/CVE-2021-38592.md): Wasm3 0.5.0 has a heap-based buffer overflow in op\_Const64 (called from EvaluateExpression and m3\_LoadModule). (no CVSS)
- [CVE-2020-22403](https://cve.now/CVE-2020-22403.md): Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code (no CVSS, express-cart)
- [CVE-2021-38291](https://cve.now/CVE-2021-38291.md): FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c. (no CVSS)
- [CVE-2021-38593](https://cve.now/CVE-2021-38593.md): Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bounds write in QOutlineMapper::convertPath (called from QRasterPaintEngine::fill a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.