CVEs published August 16, 2021
106 CVEs were published on August 16, 2021: 2 critical, 12 high. 3 are now in CISA KEV.
- Published
- 106
- Critical
- 2
- High
- 12
- Medium
- 30
- Low
- 3
- Unrated
- 59
- Now in CISA KEV
- 3
- Fix available
- 23
Most affected products
- Dell PowerScale OneFS
- 10
- Pulse Connect Secure
- 6
- shopware platform · shopware/platform +1
- 4
- GPAC Project
- 3
- lin-cms
- 3
- NodeJS Node
- 3
- quokka
- 3
- bikeshed
- 2
- D-Link DSL-2750U
- 2
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- 2
Critical 2
- CVE-2021-35394Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary.
- CVE-2021-35395Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the
High 12
- CVE-2021-37711Authenticated server-side request forgery in file upload via URL.shopware platform · shopware/platform +1
- CVE-2021-37710Cross-Site Scripting via SVG media filesshopware platform · shopware/core +1
- CVE-2021-36281Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability.Dell PowerScale OneFS
- CVE-2021-36280Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability.Dell PowerScale OneFS
- CVE-2021-36279Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability.Dell PowerScale OneFS
- CVE-2021-36278Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files.Dell PowerScale OneFS
- CVE-2021-21594Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability.Dell PowerScale OneFS
- CVE-2021-37708Command injection in mail agent settingsshopware platform · shopware/platform +1
- CVE-2021-21861An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librGPAC Project
- CVE-2021-21860An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librGPAC Project
- CVE-2021-21859An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librGPAC Project
- CVE-2021-23422Arbitrary Code Injectionbikeshed
Medium, low and unrated 92
- CVE-2021-37709Insecure direct object reference of log files of the Import/Export featureshopware platform · shopware/platform +1
- CVE-2021-36282Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability.Dell PowerScale OneFS
- CVE-2021-21599Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability.Dell PowerScale OneFS
- CVE-2021-21595Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command.Dell PowerScale OneFS
- CVE-2021-21592Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition.Dell PowerScale OneFS
- CVE-2021-21568Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability.Dell PowerScale OneFS
- CVE-2021-32826Remote code execution in Proxyee-Downproxyee-down-org proxyee-down
- CVE-2021-32827Arbitrary code execution in MockServermock-server mockserver · org.mock-server:mockserver
- CVE-2021-38608Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges
- CVE-2021-32825ZipSlip vulnerability in bblfshdbblfshd
- CVE-2021-37707Manipulation of product reviews via APIshopware platform · shopware/platform +1
- CVE-2021-38315SP Project & Document Manager <= 4.25 Reflected Cross-Site ScriptingSmartyPants SP Project & Document Manager
- CVE-2021-34641SEOPress <= 5.0.0 – 5.0.3 Authenticated Stored Cross-Site ScriptingSEOPress
- CVE-2021-32822File disclosure in hbspillarjs hbs · hbs
- CVE-2021-22937A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously cPulse Connect Secure
- CVE-2021-22936A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authenticaPulse Connect Secure
- CVE-2021-22932An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file Citrix ShareFile Storage Zones Controller
- CVE-2021-22935A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitPulse Connect Secure
- CVE-2021-22934A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device Pulse Connect Secure
- CVE-2021-22938A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanitPulse Connect Secure
- CVE-2021-22933A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a mPulse Connect Secure
- CVE-2021-0114Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of priviIntel(R) Processors
- CVE-2021-34667Calendar_plugin <= 1.0 Reflected Cross-Site ScriptingCalendar_plugin
- CVE-2021-34666Add Sidebar <= 2.0.0 Reflected Cross-Site ScriptingAdd Sidebar
- CVE-2021-34665WP SEO Tags <= 2.2.7 Reflected Cross-Site ScriptingWP SEO Tags
- CVE-2021-34664Moova for WooCommerce <= 3.5 Reflected Cross-Site ScriptingMoova for WooCommerce
- CVE-2021-34659Plugmatter Pricing Table Lite <= 1.0.32 Reflected Cross-Site ScriptingPlugmatter Pricing Table Lite
- CVE-2021-34663jQuery Tagline Rotator <= 0.1.5 Reflected Cross-Site ScriptingjQuery Tagline Rotator
- CVE-2021-34658Simple Popup Newsletter <= 1.4.7 Reflected Cross-Site ScriptingSimple Popup Newsletter
- CVE-2021-34655WP Songbook <= 2.0.11 Reflected Cross-Site ScriptingWP Songbook
- CVE-2021-34657TypoFR <= 0.11 Reflected Cross-Site ScriptingTypoFR
- CVE-2021-346562Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting2Way VideoCalls and Random Chat - HTML5 Webcam Videochat
- CVE-2021-34651Scribble Maps <= 1.2 Reflected Cross-Site ScriptingScribble Maps
- CVE-2021-34654Custom Post Type Relations <= 1.0 Reflected Cross-Site ScriptingCustom Post Type Relations
- CVE-2021-34653WP Fountain <= 1.5.9 Reflected Cross-Site ScriptingWP Fountain
- CVE-2021-34649Simple Behance Portfolio <= 0.2 Reflected Cross-Site ScriptingSimple Behance Portfolio
- CVE-2021-34652Media Usage <= 0.0.4 Reflected Cross-Site ScriptingMedia Usage
- CVE-2021-34642Smart Email Alerts <= 1.0.10 Reflected Cross-Site ScriptingFollowistic Smart Email Alerts
- CVE-2021-34644Multiplayer Games <= 3.7 Reflected Cross-Site ScriptingMultiplayer Games
- CVE-2021-34643Skaut bazar <= 1.3.2 Reflected Cross-Site ScriptingSkaut Bazar
- CVE-2020-18705XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.quokka
- CVE-2020-18704Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widdjango-widgy
- CVE-2020-18703XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.quokka
- CVE-2020-18702Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component quokka
- CVE-2020-18701Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the alin-cms
- CVE-2020-18699Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Usernamlin-cms
- CVE-2020-18698Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'lolin-cms
- CVE-2021-38758Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.
- CVE-2021-38757Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
- CVE-2021-38756Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
- CVE-2021-38755Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.
- CVE-2021-38754SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
- CVE-2021-38753An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access
- CVE-2021-38752A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrari
- CVE-2021-38751A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php.
- CVE-2021-38607Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
- CVE-2021-35392Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.
- CVE-2021-35393Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.
- CVE-2021-24548Mimetic Books <= 0.2.13 - Authenticated Stored Cross-Site Scripting (XSS)Mimetic Books
- CVE-2021-24541Wonder PDF Embed < 1.7 - Contributor+ Stored XSSWonder PDF Embed
- CVE-2021-24538Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)Current Book
- CVE-2021-24540Wonder Video Embed < 1.8 - Contributor+ Stored XSSWonder Video Embed
- CVE-2021-24536Custom Login Redirect <= 1.0.0 - CSRF to Stored XSSCustom Login Redirect
- CVE-2021-24535Light Messages <= 1.0 - CSRF to Stored XSSLight Messages
- CVE-2021-24534PhoneTrack Meu Site Manager <= 0.1 - Authenticated Stored XSSPhoneTrack Meu Site Manager
- CVE-2021-24527Profile Builder < 3.4.9 - Admin Access via Password ResetUser Registration & User Profile – Profile Builder
- CVE-2021-24526Form Maker < 1.13.60 - Authenticated Stored XSSForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2021-24519Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)VikRentCar Car Rental Management System
- CVE-2021-24518WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSSWPFront Notification Bar
- CVE-2021-24512Video Posts Webcam Recorder < 3.2.4 - Authenticated Reflected XSSVideo Posts Webcam Recorder
- CVE-2021-24471YouTube Embed < 5.2.2 - Contributor+ Stored XSSYouTube Embed
- CVE-2021-24466Verse-O-Matic <= 4.1.1 - CSRF to Stored XSSVerse-O-Matic
- CVE-2021-24445My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)My Site Audit
- CVE-2021-24410Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSSతెలుగు బైబిల్ వచనములు
- CVE-2021-24411Social Tape <= 1.0 - CSRF to Stored XSSSocial Tape
- CVE-2021-24380Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRFShantz WordPress QOTD
- CVE-2021-24363Photo Gallery < 1.5.75 - File Upload Path TraversalPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2021-24362Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVGPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2021-23423Directory Traversalbikeshed
- CVE-2021-35936No Authentication on Logging ServerApache Software Foundation Apache Airflow · apache-airflow
- CVE-2021-3708D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection.D-Link DSL-2750U
- CVE-2021-3707D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification.D-Link DSL-2750U
- CVE-2021-38712OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents.
- CVE-2021-38713imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.helloxz/imgurl
- CVE-2021-38711In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.
- CVE-2021-38708In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
- CVE-2021-38709In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.
- CVE-2021-26086Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilitAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-22931Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validationNodeJS Node
- CVE-2021-22939If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned anNodeJS Node
- CVE-2021-22940Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cNodeJS Node
- CVE-2021-33193Request splitting via HTTP/2 method injection and mod_proxyApache Software Foundation Apache HTTP Server