# CVEs published 2021-08-16

106 CVEs were published on August 16, 2021: 2 critical, 12 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-37711](https://cve.now/CVE-2021-37711.md): Authenticated server-side request forgery in file upload via URL. (CVSS 8.8, shopware platform · shopware/platform +1)
- [CVE-2021-37710](https://cve.now/CVE-2021-37710.md): Cross-Site Scripting via SVG media files (CVSS 8.0, shopware platform · shopware/core +1)
- [CVE-2021-37709](https://cve.now/CVE-2021-37709.md): Insecure direct object reference of log files of the Import/Export feature (CVSS 6.5, shopware platform · shopware/platform +1)
- [CVE-2021-36282](https://cve.now/CVE-2021-36282.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. (CVSS 2.5, Dell PowerScale OneFS)
- [CVE-2021-36281](https://cve.now/CVE-2021-36281.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2021-36280](https://cve.now/CVE-2021-36280.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2021-36279](https://cve.now/CVE-2021-36279.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an incorrect permission assignment for critical resource vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2021-36278](https://cve.now/CVE-2021-36278.md): Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2021-21599](https://cve.now/CVE-2021-21599.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2021-21595](https://cve.now/CVE-2021-21595.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2021-21594](https://cve.now/CVE-2021-21594.md): Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. (CVSS 8.2, Dell PowerScale OneFS)
- [CVE-2021-21592](https://cve.now/CVE-2021-21592.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x improperly handle an exceptional condition. (CVSS 3.1, Dell PowerScale OneFS)
- [CVE-2021-21568](https://cve.now/CVE-2021-21568.md): Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an insufficient logging vulnerability. (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2021-32826](https://cve.now/CVE-2021-32826.md): Remote code execution in Proxyee-Down (CVSS 6.8, proxyee-down-org proxyee-down)
- [CVE-2021-32827](https://cve.now/CVE-2021-32827.md): Arbitrary code execution in MockServer (CVSS 6.1, mock-server mockserver · org.mock-server:mockserver)
- [CVE-2021-37708](https://cve.now/CVE-2021-37708.md): Command injection in mail agent settings (CVSS 8.8, shopware platform · shopware/platform +1)
- [CVE-2021-21861](https://cve.now/CVE-2021-21861.md): An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content libr (CVSS 8.8, GPAC Project)
- [CVE-2021-21860](https://cve.now/CVE-2021-21860.md): An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content libr (CVSS 8.8, GPAC Project)
- [CVE-2021-21859](https://cve.now/CVE-2021-21859.md): An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content libr (CVSS 8.8, GPAC Project)
- [CVE-2021-38608](https://cve.now/CVE-2021-38608.md): Incorrect Access Control in Tranquil WAPT Enterprise - before 1.8.2.7373 and before 2.0.0.9450 allows guest OS users to escalate privileges (no CVSS)
- [CVE-2021-32825](https://cve.now/CVE-2021-32825.md): ZipSlip vulnerability in bblfshd (CVSS 2.7, bblfshd)
- [CVE-2021-37707](https://cve.now/CVE-2021-37707.md): Manipulation of product reviews via API (CVSS 6.5, shopware platform · shopware/platform +1)
- [CVE-2021-38315](https://cve.now/CVE-2021-38315.md): SP Project & Document Manager \<= 4.25 Reflected Cross-Site Scripting (CVSS 6.1, SmartyPants SP Project & Document Manager)
- [CVE-2021-34641](https://cve.now/CVE-2021-34641.md): SEOPress \<= 5.0.0 – 5.0.3 Authenticated Stored Cross-Site Scripting (CVSS 6.4, SEOPress)
- [CVE-2021-32822](https://cve.now/CVE-2021-32822.md): File disclosure in hbs (CVSS 4.0, pillarjs hbs · hbs)
- [CVE-2021-22937](https://cve.now/CVE-2021-22937.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform a file write via a maliciously c (no CVSS, Pulse Connect Secure)
- [CVE-2021-22936](https://cve.now/CVE-2021-22936.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow a threat actor to perform a cross-site script attack against an authentica (no CVSS, Pulse Connect Secure)
- [CVE-2021-22932](https://cve.now/CVE-2021-22932.md): An issue has been identified in the CTX269106 mitigation tool for Citrix ShareFile storage zones controller which causes the ShareFile file (no CVSS, Citrix ShareFile Storage Zones Controller)
- [CVE-2021-22935](https://cve.now/CVE-2021-22935.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanit (no CVSS, Pulse Connect Secure)
- [CVE-2021-22934](https://cve.now/CVE-2021-22934.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator or compromised Pulse Connect Secure device (no CVSS, Pulse Connect Secure)
- [CVE-2021-22938](https://cve.now/CVE-2021-22938.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform command injection via an unsanit (no CVSS, Pulse Connect Secure)
- [CVE-2021-22933](https://cve.now/CVE-2021-22933.md): A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a m (no CVSS, Pulse Connect Secure)
- [CVE-2021-0114](https://cve.now/CVE-2021-0114.md): Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable an escalation of privi (no CVSS, Intel(R) Processors)
- [CVE-2021-34667](https://cve.now/CVE-2021-34667.md): Calendar\_plugin \<= 1.0 Reflected Cross-Site Scripting (CVSS 6.1, Calendar\_plugin)
- [CVE-2021-34666](https://cve.now/CVE-2021-34666.md): Add Sidebar \<= 2.0.0 Reflected Cross-Site Scripting (CVSS 6.1, Add Sidebar)
- [CVE-2021-34665](https://cve.now/CVE-2021-34665.md): WP SEO Tags \<= 2.2.7 Reflected Cross-Site Scripting (CVSS 6.1, WP SEO Tags)
- [CVE-2021-34664](https://cve.now/CVE-2021-34664.md): Moova for WooCommerce \<= 3.5 Reflected Cross-Site Scripting (CVSS 6.1, Moova for WooCommerce)
- [CVE-2021-34659](https://cve.now/CVE-2021-34659.md): Plugmatter Pricing Table Lite \<= 1.0.32 Reflected Cross-Site Scripting (CVSS 6.1, Plugmatter Pricing Table Lite)
- [CVE-2021-34663](https://cve.now/CVE-2021-34663.md): jQuery Tagline Rotator \<= 0.1.5 Reflected Cross-Site Scripting (CVSS 6.1, jQuery Tagline Rotator)
- [CVE-2021-34658](https://cve.now/CVE-2021-34658.md): Simple Popup Newsletter \<= 1.4.7 Reflected Cross-Site Scripting (CVSS 6.1, Simple Popup Newsletter)
- [CVE-2021-34655](https://cve.now/CVE-2021-34655.md): WP Songbook \<= 2.0.11 Reflected Cross-Site Scripting (CVSS 6.1, WP Songbook)
- [CVE-2021-34657](https://cve.now/CVE-2021-34657.md): TypoFR \<= 0.11 Reflected Cross-Site Scripting (CVSS 6.1, TypoFR)
- [CVE-2021-34656](https://cve.now/CVE-2021-34656.md): 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat \<= 5.2.7 Reflected Cross-Site Scripting (CVSS 6.1, 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat)
- [CVE-2021-34651](https://cve.now/CVE-2021-34651.md): Scribble Maps \<= 1.2 Reflected Cross-Site Scripting (CVSS 6.1, Scribble Maps)
- [CVE-2021-34654](https://cve.now/CVE-2021-34654.md): Custom Post Type Relations \<= 1.0 Reflected Cross-Site Scripting (CVSS 6.1, Custom Post Type Relations)
- [CVE-2021-34653](https://cve.now/CVE-2021-34653.md): WP Fountain \<= 1.5.9 Reflected Cross-Site Scripting (CVSS 6.1, WP Fountain)
- [CVE-2021-34649](https://cve.now/CVE-2021-34649.md): Simple Behance Portfolio \<= 0.2 Reflected Cross-Site Scripting (CVSS 6.1, Simple Behance Portfolio)
- [CVE-2021-34652](https://cve.now/CVE-2021-34652.md): Media Usage \<= 0.0.4 Reflected Cross-Site Scripting (CVSS 6.1, Media Usage)
- [CVE-2021-34642](https://cve.now/CVE-2021-34642.md): Smart Email Alerts \<= 1.0.10 Reflected Cross-Site Scripting (CVSS 6.1, Followistic Smart Email Alerts)
- [CVE-2021-34644](https://cve.now/CVE-2021-34644.md): Multiplayer Games \<= 3.7 Reflected Cross-Site Scripting (CVSS 6.1, Multiplayer Games)
- [CVE-2021-34643](https://cve.now/CVE-2021-34643.md): Skaut bazar \<= 1.3.2 Reflected Cross-Site Scripting (CVSS 6.1, Skaut Bazar)
- [CVE-2020-18705](https://cve.now/CVE-2020-18705.md): XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views. (no CVSS, quokka)
- [CVE-2020-18704](https://cve.now/CVE-2020-18704.md): Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' wid (no CVSS, django-widgy)
- [CVE-2020-18703](https://cve.now/CVE-2020-18703.md): XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'. (no CVSS, quokka)
- [CVE-2020-18702](https://cve.now/CVE-2020-18702.md): Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component (no CVSS, quokka)
- [CVE-2020-18701](https://cve.now/CVE-2020-18701.md): Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the a (no CVSS, lin-cms)
- [CVE-2020-18699](https://cve.now/CVE-2020-18699.md): Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Usernam (no CVSS, lin-cms)
- [CVE-2020-18698](https://cve.now/CVE-2020-18698.md): Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'lo (no CVSS, lin-cms)
- [CVE-2021-38758](https://cve.now/CVE-2021-38758.md): Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php. (no CVSS)
- [CVE-2021-38757](https://cve.now/CVE-2021-38757.md): Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php. (no CVSS)
- [CVE-2021-38756](https://cve.now/CVE-2021-38756.md): Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php. (no CVSS)
- [CVE-2021-38755](https://cve.now/CVE-2021-38755.md): Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php. (no CVSS)
- [CVE-2021-38754](https://cve.now/CVE-2021-38754.md): SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php. (no CVSS)
- [CVE-2021-38753](https://cve.now/CVE-2021-38753.md): An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access (no CVSS)
- [CVE-2021-38752](https://cve.now/CVE-2021-38752.md): A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrari (no CVSS)
- [CVE-2021-38751](https://cve.now/CVE-2021-38751.md): A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent\_constants.php. (no CVSS)
- [CVE-2021-38607](https://cve.now/CVE-2021-38607.md): Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input. (no CVSS)
- [CVE-2021-35392](https://cve.now/CVE-2021-35392.md): Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. (no CVSS)
- [CVE-2021-35393](https://cve.now/CVE-2021-35393.md): Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. (no CVSS)
- [CVE-2021-35394](https://cve.now/CVE-2021-35394.md): Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. (CVSS 9.8, KEV)
- [CVE-2021-35395](https://cve.now/CVE-2021-35395.md): Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the (CVSS 9.8, KEV)
- [CVE-2021-24548](https://cve.now/CVE-2021-24548.md): Mimetic Books \<= 0.2.13 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Mimetic Books)
- [CVE-2021-24541](https://cve.now/CVE-2021-24541.md): Wonder PDF Embed \< 1.7 - Contributor+ Stored XSS (no CVSS, Wonder PDF Embed)
- [CVE-2021-24538](https://cve.now/CVE-2021-24538.md): Current Book \<= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Current Book)
- [CVE-2021-24540](https://cve.now/CVE-2021-24540.md): Wonder Video Embed \< 1.8 - Contributor+ Stored XSS (no CVSS, Wonder Video Embed)
- [CVE-2021-24536](https://cve.now/CVE-2021-24536.md): Custom Login Redirect \<= 1.0.0 - CSRF to Stored XSS (no CVSS, Custom Login Redirect)
- [CVE-2021-24535](https://cve.now/CVE-2021-24535.md): Light Messages \<= 1.0 - CSRF to Stored XSS (no CVSS, Light Messages)
- [CVE-2021-24534](https://cve.now/CVE-2021-24534.md): PhoneTrack Meu Site Manager \<= 0.1 - Authenticated Stored XSS (no CVSS, PhoneTrack Meu Site Manager)
- [CVE-2021-24527](https://cve.now/CVE-2021-24527.md): Profile Builder \< 3.4.9 - Admin Access via Password Reset (no CVSS, User Registration & User Profile – Profile Builder)
- [CVE-2021-24526](https://cve.now/CVE-2021-24526.md): Form Maker \< 1.13.60 - Authenticated Stored XSS (no CVSS, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2021-24519](https://cve.now/CVE-2021-24519.md): Vik Rent Car \< 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, VikRentCar Car Rental Management System)
- [CVE-2021-24518](https://cve.now/CVE-2021-24518.md): WPFront Notification Bar \< 2.0.0.07176 - Authenticated Stored XSS (no CVSS, WPFront Notification Bar)
- [CVE-2021-24512](https://cve.now/CVE-2021-24512.md): Video Posts Webcam Recorder \< 3.2.4 - Authenticated Reflected XSS (no CVSS, Video Posts Webcam Recorder)
- [CVE-2021-24471](https://cve.now/CVE-2021-24471.md): YouTube Embed \< 5.2.2 - Contributor+ Stored XSS (no CVSS, YouTube Embed)
- [CVE-2021-24466](https://cve.now/CVE-2021-24466.md): Verse-O-Matic \<= 4.1.1 - CSRF to Stored XSS (no CVSS, Verse-O-Matic)
- [CVE-2021-24445](https://cve.now/CVE-2021-24445.md): My Site Audit \<= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, My Site Audit)
- [CVE-2021-24410](https://cve.now/CVE-2021-24410.md): Telugu Bible Verse Daily \<= 1.0 - CSRF to Stored XSS (no CVSS, తెలుగు బైబిల్ వచనములు)
- [CVE-2021-24411](https://cve.now/CVE-2021-24411.md): Social Tape \<= 1.0 - CSRF to Stored XSS (no CVSS, Social Tape)
- [CVE-2021-24380](https://cve.now/CVE-2021-24380.md): Shantz WordPress QOTD \<= 1.2.2 - Arbitrary Setting Update via CSRF (no CVSS, Shantz WordPress QOTD)
- [CVE-2021-24363](https://cve.now/CVE-2021-24363.md): Photo Gallery \< 1.5.75 - File Upload Path Traversal (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2021-24362](https://cve.now/CVE-2021-24362.md): Photo Gallery \< 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2021-23422](https://cve.now/CVE-2021-23422.md): Arbitrary Code Injection (CVSS 7.8, bikeshed)
- [CVE-2021-23423](https://cve.now/CVE-2021-23423.md): Directory Traversal (CVSS 5.5, bikeshed)
- [CVE-2021-35936](https://cve.now/CVE-2021-35936.md): No Authentication on Logging Server (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2021-3708](https://cve.now/CVE-2021-3708.md): D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. (no CVSS, D-Link DSL-2750U)
- [CVE-2021-3707](https://cve.now/CVE-2021-3707.md): D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. (no CVSS, D-Link DSL-2750U)
- [CVE-2021-38712](https://cve.now/CVE-2021-38712.md): OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. (no CVSS)
- [CVE-2021-38713](https://cve.now/CVE-2021-38713.md): imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header. (no CVSS, helloxz/imgurl)
- [CVE-2021-38711](https://cve.now/CVE-2021-38711.md): In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files. (no CVSS)
- [CVE-2021-38708](https://cve.now/CVE-2021-38708.md): In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS. (no CVSS)
- [CVE-2021-38709](https://cve.now/CVE-2021-38709.md): In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff\_messaging messaging system for XSS. (no CVSS)
- [CVE-2021-26086](https://cve.now/CVE-2021-26086.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to read particular files via a path traversal vulnerabilit (CVSS 5.3, KEV, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-22931](https://cve.now/CVE-2021-22931.md): Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation (no CVSS, NodeJS Node)
- [CVE-2021-22939](https://cve.now/CVE-2021-22939.md): If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned an (no CVSS, NodeJS Node)
- [CVE-2021-22940](https://cve.now/CVE-2021-22940.md): Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c (no CVSS, NodeJS Node)
- [CVE-2021-33193](https://cve.now/CVE-2021-33193.md): Request splitting via HTTP/2 method injection and mod\_proxy (no CVSS, Apache Software Foundation Apache HTTP Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.