# CVEs published 2021-08-13

63 CVEs were published on August 13, 2021: 2 critical, 7 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-21815](https://cve.now/CVE-2021-21815.md): A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs' Xmill 0.7. (CVSS 7.8, AT&T)
- [CVE-2021-21813](https://cve.now/CVE-2021-21813.md): Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. (CVSS 7.8, AT&T)
- [CVE-2021-21814](https://cve.now/CVE-2021-21814.md): Within the function HandleFileArg the argument filepattern is under control of the user who passes it in from the command line. (CVSS 7.8, AT&T)
- [CVE-2021-21812](https://cve.now/CVE-2021-21812.md): A stack-based buffer overflow vulnerability exists in the command-line-parsing HandleFileArg functionality of AT&T Labs’ Xmill 0.7. (CVSS 7.8, AT&T)
- [CVE-2020-21066](https://cve.now/CVE-2020-21066.md): An issue was discovered in Bento4 v1.5.1.0. (no CVSS)
- [CVE-2021-37705](https://cve.now/CVE-2021-37705.md): Improper Authorization and Origin Validation Error in OneFuzz (CVSS 10.0, microsoft onefuzz · onefuzz)
- [CVE-2021-21829](https://cve.now/CVE-2021-21829.md): A heap-based buffer overflow vulnerability exists in the XML Decompression EnumerationUncompressor::UncompressItem functionality of AT&T Lab (CVSS 8.1, AT&T)
- [CVE-2021-21830](https://cve.now/CVE-2021-21830.md): A heap-based buffer overflow vulnerability exists in the XML Decompression LabelDict::Load functionality of AT&T Labs’ Xmill 0.7. (CVSS 8.1, AT&T)
- [CVE-2021-38302](https://cve.now/CVE-2021-38302.md): The Newsletter extension through 4.0.0 for TYPO3 allows SQL Injection. (no CVSS, ecodev/newsletter)
- [CVE-2021-34823](https://cve.now/CVE-2021-34823.md): The ON24 ScreenShare (aka DesktopScreenShare.app) plugin before 2.0 for macOS allows remote file access via its built-in HTTP server. (no CVSS)
- [CVE-2021-38623](https://cve.now/CVE-2021-38623.md): The deferred\_image\_processing (aka Deferred image processing) extension before 1.0.2 for TYPO3 allows Denial of Service via the FAL API beca (no CVSS, webcoast/deferred-image-processing)
- [CVE-2021-36793](https://cve.now/CVE-2021-36793.md): The routes (aka Extbase Yaml Routes) extension before 2.1.1 for TYPO3, when CsrfTokenViewHelper is used, allows Sensitive Information Disclo (no CVSS, lms/routes)
- [CVE-2021-36787](https://cve.now/CVE-2021-36787.md): The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document. (no CVSS, in2code/femanager)
- [CVE-2021-36786](https://cve.now/CVE-2021-36786.md): The miniorange\_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private key (no CVSS, miniorange/miniorange-saml)
- [CVE-2021-36785](https://cve.now/CVE-2021-36785.md): The miniorange\_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS. (no CVSS, miniorange/miniorange-saml)
- [CVE-2021-36788](https://cve.now/CVE-2021-36788.md): The yoast\_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS. (no CVSS, yoast-seo-for-typo3/yoast\_seo)
- [CVE-2020-18759](https://cve.now/CVE-2020-18759.md): An information disclosure vulnerability exists in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100. (no CVSS)
- [CVE-2020-18758](https://cve.now/CVE-2020-18758.md): An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2020-18756](https://cve.now/CVE-2020-18756.md): An arbitrary memory access vulnerability in the EPA protocol of Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to read (no CVSS)
- [CVE-2020-18757](https://cve.now/CVE-2020-18757.md): An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to cause persistent denial of service (DOS) via a crafted pa (no CVSS)
- [CVE-2020-18753](https://cve.now/CVE-2020-18753.md): An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to gain access to the system and escalate privileges via a c (no CVSS)
- [CVE-2020-18754](https://cve.now/CVE-2020-18754.md): An information disclosure vulnerability exists within Dut Computer Control Engineering Co.'s PLC MAC1100. (no CVSS)
- [CVE-2021-36792](https://cve.now/CVE-2021-36792.md): The dated\_news (aka Dated News) extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications. (no CVSS)
- [CVE-2021-36791](https://cve.now/CVE-2021-36791.md): The dated\_news (aka Dated News) extension through 5.1.1 for TYPO3 allows Information Disclosure of application registration data. (no CVSS)
- [CVE-2021-36790](https://cve.now/CVE-2021-36790.md): The dated\_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS. (no CVSS)
- [CVE-2021-36789](https://cve.now/CVE-2021-36789.md): The dated\_news (aka Dated News) extension through 5.1.1 for TYPO3 allows SQL Injection. (no CVSS)
- [CVE-2021-36380](https://cve.now/CVE-2021-36380.md): Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDia (CVSS 9.8, KEV)
- [CVE-2021-37028](https://cve.now/CVE-2021-37028.md): There is a command injection vulnerability in the HG8045Q product. (no CVSS, EchoLife HG8045Q)
- [CVE-2021-29880](https://cve.now/CVE-2021-29880.md): IBM QRadar SIEM 7.4.3 GA - 7.4.3 Fix Pack 1 when using domains or multi-tenancy could be vulnerable to information disclosure between tenant (CVSS 5.3, IBM QRadar SIEM)
- [CVE-2021-38553](https://cve.now/CVE-2021-38553.md): HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feat (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-38554](https://cve.now/CVE-2021-38554.md): HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-34398](https://cve.now/CVE-2021-34398.md): NVIDIA DCGM, all versions prior to 2.2.9, contains a vulnerability in the DIAG module where any user can inject shared libraries into the DC (CVSS 7.8, NVIDIA Data Center GPU Manager)
- [CVE-2021-1104](https://cve.now/CVE-2021-1104.md): The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to (no CVSS, RISCV.org Machine Trap Base Address (MTVEC) Register)
- [CVE-2021-32069](https://cve.now/CVE-2021-32069.md): The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation (no CVSS)
- [CVE-2021-37586](https://cve.now/CVE-2021-37586.md): The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to (no CVSS)
- [CVE-2021-3352](https://cve.now/CVE-2021-3352.md): The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unau (no CVSS)
- [CVE-2021-32072](https://cve.now/CVE-2021-32072.md): The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensit (no CVSS)
- [CVE-2021-32071](https://cve.now/CVE-2021-32071.md): The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access co (no CVSS)
- [CVE-2021-32070](https://cve.now/CVE-2021-32070.md): The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecu (no CVSS)
- [CVE-2021-32068](https://cve.now/CVE-2021-32068.md): The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by (no CVSS)
- [CVE-2021-32067](https://cve.now/CVE-2021-32067.md): The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an H (no CVSS)
- [CVE-2021-27402](https://cve.now/CVE-2021-27402.md): The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injec (no CVSS)
- [CVE-2021-27401](https://cve.now/CVE-2021-27401.md): The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing (no CVSS)
- [CVE-2021-37703](https://cve.now/CVE-2021-37703.md): Information exposure in Discourse (CVSS 4.3, discourse)
- [CVE-2021-37693](https://cve.now/CVE-2021-37693.md): Re-use of email tokens in Discourse (CVSS 5.3, discourse)
- [CVE-2021-38619](https://cve.now/CVE-2021-38619.md): openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-sit (no CVSS)
- [CVE-2021-38621](https://cve.now/CVE-2021-38621.md): The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file own (no CVSS)
- [CVE-2021-38583](https://cve.now/CVE-2021-38583.md): openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pag (no CVSS)
- [CVE-2021-3635](https://cve.now/CVE-2021-3635.md): A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. (no CVSS, kernel)
- [CVE-2021-27741](https://cve.now/CVE-2021-27741.md): " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection" (no CVSS, Commerce)
- [CVE-2021-31399](https://cve.now/CVE-2021-31399.md): On 2N Access Unit 2.0 2.31.0.40.5 devices, an attacker can pose as the web relay for a man-in-the-middle attack. (CVSS 4.6)
- [CVE-2021-37343](https://cve.now/CVE-2021-37343.md): A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE unde (no CVSS)
- [CVE-2021-37344](https://cve.now/CVE-2021-37344.md): Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used (no CVSS)
- [CVE-2021-37345](https://cve.now/CVE-2021-37345.md): Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because xi-sys.cfg is being imported from the var directory for s (no CVSS)
- [CVE-2021-37346](https://cve.now/CVE-2021-37346.md): Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements (no CVSS)
- [CVE-2021-37347](https://cve.now/CVE-2021-37347.md): Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because getprofile.sh does not validate the directory name it rec (no CVSS)
- [CVE-2021-37348](https://cve.now/CVE-2021-37348.md): Nagios XI before version 5.8.5 is vulnerable to local file inclusion through improper limitation of a pathname in index.php. (no CVSS)
- [CVE-2021-37349](https://cve.now/CVE-2021-37349.md): Nagios XI before version 5.8.5 is vulnerable to local privilege escalation because cleaner.php does not sanitise input read from the databas (no CVSS)
- [CVE-2021-37350](https://cve.now/CVE-2021-37350.md): Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. (no CVSS)
- [CVE-2021-37351](https://cve.now/CVE-2021-37351.md): Nagios XI before version 5.8.5 is vulnerable to insecure permissions and allows unauthenticated users to access guarded pages through a craf (no CVSS)
- [CVE-2021-37352](https://cve.now/CVE-2021-37352.md): An open redirect vulnerability exists in Nagios XI before version 5.8.5 that could lead to spoofing. (no CVSS)
- [CVE-2021-37353](https://cve.now/CVE-2021-37353.md): Nagios XI Docker Wizard before version 1.1.3 is vulnerable to SSRF due to improper sanitation in table\_population.php. (no CVSS)
- [CVE-2021-3573](https://cve.now/CVE-2021-3573.md): A use-after-free in function hci\_sock\_bound\_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR or (no CVSS, kernel)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.