# CVEs published 2021-08-17

73 CVEs were published on August 17, 2021: 3 critical, 8 high. Days are UTC.

- [CVE-2021-0284](https://cve.now/CVE-2021-0284.md): Junos OS: Upon receipt of specific sequences of genuine packets destined to the device the kernel will crash and restart (vmcore) (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2021-39249](https://cve.now/CVE-2021-39249.md): Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become (no CVSS)
- [CVE-2021-39250](https://cve.now/CVE-2021-39250.md): Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploade (no CVSS)
- [CVE-2021-28372](https://cve.now/CVE-2021-28372.md): ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte unique (no CVSS)
- [CVE-2020-23341](https://cve.now/CVE-2020-23341.md): A reflected cross site scripting (XSS) vulnerability in the /header.tmpl.php component of ATutor 2.2.4 allows attackers to execute arbitrary (no CVSS)
- [CVE-2020-23333](https://cve.now/CVE-2020-23333.md): A heap-based buffer overflow exists in the AP4\_CttsAtom::AP4\_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. (no CVSS)
- [CVE-2020-23334](https://cve.now/CVE-2020-23334.md): A WRITE memory access in the AP4\_NullTerminatedStringAtom::AP4\_NullTerminatedStringAtom component of Bento4 version 06c39d9 can lead to a se (no CVSS)
- [CVE-2020-23331](https://cve.now/CVE-2020-23331.md): An issue was discovered in Bento4 version 06c39d9. (no CVSS)
- [CVE-2020-23332](https://cve.now/CVE-2020-23332.md): A heap-based buffer overflow exists in the AP4\_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento (no CVSS)
- [CVE-2020-23330](https://cve.now/CVE-2020-23330.md): An issue was discovered in Bento4 version 06c39d9. (no CVSS)
- [CVE-2021-39248](https://cve.now/CVE-2021-39248.md): Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion. (no CVSS)
- [CVE-2021-39247](https://cve.now/CVE-2021-39247.md): Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is\_last\_single\_ascii in code1.c, and rs\_encode\_uint in reed (no CVSS)
- [CVE-2021-39131](https://cve.now/CVE-2021-39131.md): Improper Handling of Unexpected Data Type in ced (CVSS 7.5, sonicdoe ced · ced)
- [CVE-2021-38702](https://cve.now/CVE-2021-38702.md): Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=\[XSS\] attacks. (no CVSS)
- [CVE-2021-21810](https://cve.now/CVE-2021-21810.md): A memory corruption vulnerability exists in the XML-parsing ParseAttribs functionality of AT&T Labs’ Xmill 0.7. (CVSS 8.1, AT&T Labs)
- [CVE-2020-18164](https://cve.now/CVE-2020-18164.md): SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter. (no CVSS)
- [CVE-2020-28594](https://cve.now/CVE-2020-28594.md): A use-after-free vulnerability exists in the \_3MF\_Importer::\_handle\_end\_model() functionality of Prusa Research PrusaSlicer 2.2.0 and Master (CVSS 8.8, Prusa Research)
- [CVE-2020-13589](https://cve.now/CVE-2020-13589.md): An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel)
- [CVE-2020-13588](https://cve.now/CVE-2020-13588.md): An exploitable SQL injection vulnerability exists in the ‘entities/fields’ page of the Rukovoditel Project Management App 2.7.2. (CVSS 5.4, Rukovoditel)
- [CVE-2021-29980](https://cve.now/CVE-2021-29980.md): Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable cra (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29981](https://cve.now/CVE-2021-29981.md): An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-29982](https://cve.now/CVE-2021-29982.md): Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a singl (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-29983](https://cve.now/CVE-2021-29983.md): Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. (no CVSS, Mozilla Firefox)
- [CVE-2021-29984](https://cve.now/CVE-2021-29984.md): Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collect (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29985](https://cve.now/CVE-2021-29985.md): A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29986](https://cve.now/CVE-2021-29986.md): A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29987](https://cve.now/CVE-2021-29987.md): After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-29988](https://cve.now/CVE-2021-29988.md): Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a p (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29989](https://cve.now/CVE-2021-29989.md): Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-29990](https://cve.now/CVE-2021-29990.md): Mozilla developers and community members reported memory safety bugs present in Firefox 90. (no CVSS, Mozilla Firefox)
- [CVE-2021-3619](https://cve.now/CVE-2021-3619.md): Rapid7 Velociraptor Notebooks Authenticated Persistent XSS (CVSS 3.5, Rapid7 Velociraptor)
- [CVE-2021-21832](https://cve.now/CVE-2021-21832.md): A memory corruption vulnerability exists in the ISO Parsing functionality of Disc Soft Ltd Deamon Tools Pro 8.3.0.0767. (CVSS 8.1, Disc)
- [CVE-2020-22937](https://cve.now/CVE-2020-22937.md): A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious c (no CVSS)
- [CVE-2021-22156](https://cve.now/CVE-2021-22156.md): An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Develop (CVSS 9.0, BlackBerry QNX Software Development Platform (SDP), QNX OS…)
- [CVE-2021-25263](https://cve.now/CVE-2021-25263.md): Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker to execute arbitary (no CVSS, Yandex Browser)
- [CVE-2021-39240](https://cve.now/CVE-2021-39240.md): An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. (no CVSS)
- [CVE-2021-39241](https://cve.now/CVE-2021-39241.md): An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. (no CVSS)
- [CVE-2021-39242](https://cve.now/CVE-2021-39242.md): An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. (no CVSS)
- [CVE-2021-0639](https://cve.now/CVE-2021-0639.md): In multiple functions of libl3oemcrypto.cpp, there is a possible weakness in the existing obfuscation mechanism due to the way sensitive dat (no CVSS, Android)
- [CVE-2021-0640](https://cve.now/CVE-2021-0640.md): In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0576](https://cve.now/CVE-2021-0576.md): In flv extractor, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0574](https://cve.now/CVE-2021-0574.md): In asf extractor, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0581](https://cve.now/CVE-2021-0581.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0580](https://cve.now/CVE-2021-0580.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0579](https://cve.now/CVE-2021-0579.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0573](https://cve.now/CVE-2021-0573.md): In asf extractor, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0578](https://cve.now/CVE-2021-0578.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0582](https://cve.now/CVE-2021-0582.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0641](https://cve.now/CVE-2021-0641.md): In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing pe (CVSS 5.5, Android)
- [CVE-2021-0642](https://cve.now/CVE-2021-0642.md): In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permissions due to a missi (CVSS 5.5, Android)
- [CVE-2021-0591](https://cve.now/CVE-2021-0591.md): In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcast receivers due to a (no CVSS, Android)
- [CVE-2021-0593](https://cve.now/CVE-2021-0593.md): In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiver due to a confused (no CVSS, Android)
- [CVE-2021-0584](https://cve.now/CVE-2021-0584.md): In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. (CVSS 5.5, Android)
- [CVE-2021-0519](https://cve.now/CVE-2021-0519.md): In BITSTREAM\_FLUSH of ih264e\_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0645](https://cve.now/CVE-2021-0645.md): In shouldBlockFromTree of ExternalStorageProvider.java, there is a possible permissions bypass. (no CVSS, Android)
- [CVE-2021-0646](https://cve.now/CVE-2021-0646.md): In sqlite3\_str\_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2021-29313](https://cve.now/CVE-2021-29313.md): Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v\_company and (2) v\_tvs parameters in /admin\_video.php, (no CVSS)
- [CVE-2021-32830](https://cve.now/CVE-2021-32830.md): The @diez/generation npm package is a client for Diez. (CVSS 3.9, diez · @diez/generation)
- [CVE-2021-29056](https://cve.now/CVE-2021-29056.md): Cross Site Scripting (XSS) vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php. (no CVSS)
- [CVE-2020-29548](https://cve.now/CVE-2020-29548.md): An issue was discovered in SmarterTools SmarterMail through 100.0.7537. (no CVSS)
- [CVE-2020-15955](https://cve.now/CVE-2020-15955.md): In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client a (no CVSS)
- [CVE-2021-3633](https://cve.now/CVE-2021-3633.md): A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation (CVSS 7.3, Lenovo Driver Management)
- [CVE-2021-3617](https://cve.now/CVE-2021-3617.md): A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted networ (CVSS 7.2, Lenovo Smart Camera X3, X5, and C2E firmware)
- [CVE-2021-3616](https://cve.now/CVE-2021-3616.md): A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter (CVSS 9.4, Lenovo Smart Camera X3, X5, and C2E firmware)
- [CVE-2021-3615](https://cve.now/CVE-2021-3615.md): A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attache (CVSS 6.6, Lenovo Smart Camera X3, X5, and C2E firmware)
- [CVE-2021-3459](https://cve.now/CVE-2021-3459.md): A privilege escalation vulnerability was reported in the MM1000 device configuration web server, which could allow privileged shell access a (CVSS 6.8, Motorola MM1000 MoCA Adapter)
- [CVE-2021-3458](https://cve.now/CVE-2021-3458.md): The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified. (CVSS 6.1, Motorola MM1000 MoCA Adapter)
- [CVE-2021-32829](https://cve.now/CVE-2021-32829.md): Post-authentication Remote Code Execution (RCE) in ZStack REST API (CVSS 9.6, zstackio zstack)
- [CVE-2020-28846](https://cve.now/CVE-2020-28846.md): Cross Site Request Forgery (CSRF) vulnerability exists in SeaCMS 10.7 in admin\_manager.php, which could let a malicious user add an admin ac (no CVSS)
- [CVE-2021-25956](https://cve.now/CVE-2021-25956.md): Improper User Access Control in "Dolibarr" Leads to Account Takeover (CVSS 4.7, dolibarr · dolibarr/dolibarr)
- [CVE-2021-25957](https://cve.now/CVE-2021-25957.md): Account Takeover in "Dolibarr" via Password Reset Functionality (CVSS 8.8, dolibarr · dolibarr/dolibarr)
- [CVE-2020-4992](https://cve.now/CVE-2020-4992.md): IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.16 is vulnerable to cross-site request forgery which could allow an attacker to execute ma (CVSS 4.3, IBM DataPower Gateway)
- [CVE-2020-4706](https://cve.now/CVE-2020-4706.md): IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. (CVSS 5.4, IBM API Connect)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.