CVEs published August 13, 2021
63 CVEs were published on August 13, 2021: 2 critical, 7 high. 1 is now in CISA KEV.
- Published
- 63
- Critical
- 2
- High
- 7
- Medium
- 4
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- AT&T
- 6
- discourse
- 2
- github.com/hashicorp/vault
- 2
- kernel
- 2
- miniorange/miniorange-saml
- 2
- Commerce
- 1
- EchoLife HG8045Q
- 1
- ecodev/newsletter
- 1
- IBM QRadar SIEM
- 1
- in2code/femanager
- 1
Critical 2
High 7
- CVE-2021-21815A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs' Xmill 0.7.AT&T
- CVE-2021-21813Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line.AT&T
- CVE-2021-21814Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line.AT&T
- CVE-2021-21812A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs’ Xmill 0.7.AT&T
- CVE-2021-21829A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T LabAT&T
- CVE-2021-21830A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7.AT&T
- CVE-2021-34398NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DCNVIDIA Data Center GPU Manager
Medium, low and unrated 54
- CVE-2020-21066An issue was discovered in Bento4 v1.5.1.0.
- CVE-2021-38302The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection.ecodev/newsletter
- CVE-2021-34823The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server.
- CVE-2021-38623The deferred_image_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API becawebcoast/deferred-image-processing
- CVE-2021-36793The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclolms/routes
- CVE-2021-36787The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.in2code/femanager
- CVE-2021-36786The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keyminiorange/miniorange-saml
- CVE-2021-36785The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.miniorange/miniorange-saml
- CVE-2021-36788The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.yoast-seo-for-typo3/yoast_seo
- CVE-2020-18759An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100.
- CVE-2020-18758An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code.
- CVE-2020-18756An arbitrary memory access vulnerability in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to read
- CVE-2020-18757An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted pa
- CVE-2020-18753An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a c
- CVE-2020-18754An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100.
- CVE-2021-36792The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications.
- CVE-2021-36791The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data.
- CVE-2021-36790The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.
- CVE-2021-36789The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection.
- CVE-2021-37028There is a command injection vulnerability in the HG8045Q product.EchoLife HG8045Q
- CVE-2021-29880IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenantIBM QRadar SIEM
- CVE-2021-38553HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage featgithub.com/hashicorp/vault
- CVE-2021-38554HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser.github.com/hashicorp/vault
- CVE-2021-1104The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead toRISCV.org Machine Trap Base Address (MTVEC) Register
- CVE-2021-32069The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation
- CVE-2021-37586The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to
- CVE-2021-3352The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unau
- CVE-2021-32072The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensit
- CVE-2021-32071The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access co
- CVE-2021-32070The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecu
- CVE-2021-32068The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by
- CVE-2021-32067The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an H
- CVE-2021-27402The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injec
- CVE-2021-27401The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing
- CVE-2021-37703Information exposure in Discoursediscourse
- CVE-2021-37693Re-use of email tokens in Discoursediscourse
- CVE-2021-38619openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-sit
- CVE-2021-38621The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file own
- CVE-2021-38583openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pag
- CVE-2021-3635A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7.kernel
- CVE-2021-27741" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"Commerce
- CVE-2021-31399On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack.
- CVE-2021-37343A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE unde
- CVE-2021-37344Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used
- CVE-2021-37345Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for s
- CVE-2021-37346Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements
- CVE-2021-37347Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it rec
- CVE-2021-37348Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php.
- CVE-2021-37349Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the databas
- CVE-2021-37350Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.
- CVE-2021-37351Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a craf
- CVE-2021-37352An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing.
- CVE-2021-37353Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table_population.php.
- CVE-2021-3573A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR orkernel