CVEs published August 17, 2021
73 CVEs were published on August 17, 2021: 3 critical, 8 high.
- Published
- 73
- Critical
- 3
- High
- 8
- Medium
- 11
- Low
- 2
- Unrated
- 49
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Android
- 18
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 6
- Lenovo Smart Camera X3, X5, and C2E firmware
- 3
- Mozilla Firefox · Mozilla Thunderbird
- 3
- dolibarr · dolibarr/dolibarr
- 2
- Motorola MM1000 MoCA Adapter
- 2
- Mozilla Firefox
- 2
- Rukovoditel
- 2
- AT&T Labs
- 1
- BlackBerry QNX Software Development Platform (SDP), QNX OS…
- 1
Critical 3
- CVE-2021-22156An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software DevelopBlackBerry QNX Software Development Platform (SDP), QNX OS…
- CVE-2021-3616A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter Lenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-32829Post-authentication Remote Code Execution (RCE) in ZStack REST APIzstackio zstack
High 8
- CVE-2021-0284Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore)Juniper Networks Junos OS
- CVE-2021-39131Improper Handling of Unexpected Data Type in cedsonicdoe ced · ced
- CVE-2021-21810A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7.AT&T Labs
- CVE-2020-28594A use-after-free vulnerability exists in the _3MF_Importer::_handle_end_model() functionality of Prusa Research PrusaSlicer 2.2.0 and MasterPrusa Research
- CVE-2021-21832A memory corruption vulnerability exists in the ISO Parsing functionality of Disc Soft Ltd Deamon Tools Pro 8.3.0.0767.Disc
- CVE-2021-3633A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalationLenovo Driver Management
- CVE-2021-3617A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted networLenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-25957Account Takeover in "Dolibarr" via Password Reset Functionalitydolibarr · dolibarr/dolibarr
Medium, low and unrated 62
- CVE-2021-39249Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become
- CVE-2021-39250Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploade
- CVE-2021-28372ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte unique
- CVE-2020-23341A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary
- CVE-2020-23333A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9.
- CVE-2020-23334A WRITE memory access in the AP4_NullTerminatedStringAtom::AP4_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a se
- CVE-2020-23331An issue was discovered in Bento4 version 06c39d9.
- CVE-2020-23332A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento
- CVE-2020-23330An issue was discovered in Bento4 version 06c39d9.
- CVE-2021-39248Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.
- CVE-2021-39247Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is_last_single_ascii in code1.c, and rs_encode_uint in reed
- CVE-2021-38702Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.
- CVE-2020-18164SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.
- CVE-2020-13589An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2020-13588An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2.Rukovoditel
- CVE-2021-29980Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable craMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29981An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code thatMozilla Firefox · Mozilla Thunderbird
- CVE-2021-29982Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a singlMozilla Firefox · Mozilla Thunderbird
- CVE-2021-29983Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit.Mozilla Firefox
- CVE-2021-29984Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collectMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29985A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29986A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29987After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a differentMozilla Firefox · Mozilla Thunderbird
- CVE-2021-29988Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a pMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29989Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-29990Mozilla developers and community members reported memory safety bugs present in Firefox 90.Mozilla Firefox
- CVE-2021-3619Rapid7 Velociraptor Notebooks Authenticated Persistent XSSRapid7 Velociraptor
- CVE-2020-22937A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious c
- CVE-2021-25263Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitaryYandex Browser
- CVE-2021-39240An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-39241An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-39242An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.
- CVE-2021-0639In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive datAndroid
- CVE-2021-0640In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0576In flv extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0574In asf extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0581In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0580In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0579In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0573In asf extractor, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-0578In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0582In wifi driver, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0641In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing peAndroid
- CVE-2021-0642In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missiAndroid
- CVE-2021-0591In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a Android
- CVE-2021-0593In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused Android
- CVE-2021-0584In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation.Android
- CVE-2021-0519In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0645In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass.Android
- CVE-2021-0646In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation.Android
- CVE-2021-29313Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,
- CVE-2021-32830The @diez/generation npm package is a client for Diez.diez · @diez/generation
- CVE-2021-29056Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php.
- CVE-2020-29548An issue was discovered in SmarterTools SmarterMail through 100.0.7537.
- CVE-2020-15955In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client a
- CVE-2021-3615A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attacheLenovo Smart Camera X3, X5, and C2E firmware
- CVE-2021-3459A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access aMotorola MM1000 MoCA Adapter
- CVE-2021-3458The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.Motorola MM1000 MoCA Adapter
- CVE-2020-28846Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin_manager.php, which could let a malicious user add an admin ac
- CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeoverdolibarr · dolibarr/dolibarr
- CVE-2020-4992IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute maIBM DataPower Gateway
- CVE-2020-4706IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.IBM API Connect