CVEs published August 18, 2021
98 CVEs were published on August 18, 2021: 2 critical, 26 high.
- Published
- 98
- Critical
- 2
- High
- 26
- Medium
- 10
- Low
- 0
- Unrated
- 60
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Cybozu Garoon
- 23
- GPAC
- 15
- MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- 6
- Cisco TelePresence Video Communication Server (VCS) Express…
- 2
- CODESYS
- 2
- Fortinet FortiPortal
- 2
- GPAC"
- 2
- MT6580, MT6735, MT6739, MT6755S, MT6757, MT6761, MT6763, MT…
- 2
- nextcloud security-advisories
- 2
- ansi-html
- 1
Critical 2
- CVE-2021-32588A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions Fortinet FortiPortal
- CVE-2021-34730Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service VulnerabilityCisco Small Business RV Series Router Firmware
High 26
- CVE-2021-34745AppDynamics .NET Agent Privilege Escalation VulnerabilityCisco AppDynamics .NET Agent for Windows
- CVE-2021-25218A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in useISC BIND9
- CVE-2021-37617Untrusted Search Path in Nextcloud Desktop Clientnextcloud security-advisories
- CVE-2021-23424Regular Expression Denial of Service (ReDoS)ansi-html
- CVE-2021-37714Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptionsjhy jsoup · org.jsoup:jsoup
- CVE-2021-37702Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcorepimcore · pimcore/pimcore
- CVE-2021-21868An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS CODESYS
- CVE-2021-21867An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESCODESYS
- CVE-2021-21862Multiple exploitable integer truncation vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ConteGPAC
- CVE-2021-21825A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’AT&T
- CVE-2021-21858Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21857Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21856Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21855Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21854Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21853Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21839Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21838Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21837Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21844Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21843Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21846Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21845Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21847Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC
- CVE-2021-21851Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC"
- CVE-2021-21852Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced ContentGPAC"
Medium, low and unrated 70
- CVE-2021-32602An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5Fortinet FortiPortal
- CVE-2021-24038Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged pFacebook Oculus Desktop
- CVE-2021-39138New anonymous user session acts as if it's created with passwordparse-community parse-server · parse-server
- CVE-2020-22345/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters centreon/centreon
- CVE-2021-34749Multiple Cisco Products Server Name Identification Data Exfiltration VulnerabilityCisco Web Security Appliance
- CVE-2021-34734Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Double-Free Denial of Service VulnerabilityCisco Video Surveillance 7000 Series IP Cameras
- CVE-2021-34716Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2021-34715Cisco Expressway Series and TelePresence Video Communication Server Image Verification VulnerabilityCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2021-1561Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access VulnerabilityCisco Content Security Management Appliance
- CVE-2021-39270In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.Ping Identity RSA SecurID Integration Kit
- CVE-2020-25928The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow.
- CVE-2020-25767An issue was discovered in HCC Embedded NicheStack IPv4 4.1.
- CVE-2020-25927The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read.
- CVE-2020-25926The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id.
- CVE-2020-19669Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin
- CVE-2020-22120A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execu
- CVE-2020-22122A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database informatio
- CVE-2020-22124A vulnerability in the \inc\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information.
- CVE-2021-39286Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.pywb
- CVE-2021-39282Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files.
- CVE-2021-39283liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands.
- CVE-2020-18875Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl
- CVE-2020-28146Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.
- CVE-2020-23069Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general_serv.php, which could let a malicious user read arb
- CVE-2021-23425Regular Expression Denial of Service (ReDoS)trim-off-newlines
- CVE-2021-32728End-to-end encryption device setup did not verify public keynextcloud security-advisories
- CVE-2021-0628In OMA DRM, there is a possible memory corruption due to improper input validation.MT6580, MT6735, MT6739, MT6755S, MT6757, MT6761, MT6763, MT…
- CVE-2021-0627In OMA DRM, there is a possible memory corruption due to an integer overflow.MT6580, MT6735, MT6739, MT6755S, MT6757, MT6761, MT6763, MT…
- CVE-2021-0626In ged, there is a possible out of bounds write due to a missing bounds check.MT6768, MT6771, MT6779, MT6785
- CVE-2021-0420In memory management driver, there is a possible system crash due to a missing bounds check.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0419In memory management driver, there is a possible system crash due to improper input validation.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0418In memory management driver, there is a possible system crash due to improper input validation.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0417In memory management driver, there is a possible system crash due to improper input validation.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0416In memory management driver, there is a possible system crash due to improper input validation.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0415In memory management driver, there is a possible information disclosure due to a missing permission check.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0408In asf extractor, there is a possible out of bounds read due to an incorrect bounds check.MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT…
- CVE-2021-0407In clk driver, there is a possible out of bounds write due to an incorrect bounds check.MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6…
- CVE-2021-38710Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script.
- CVE-2021-21781An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54.Linux Kernel
- CVE-2021-37358SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin_ajax.php?action=chec
- CVE-2020-18746SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy_list.php".
- CVE-2021-31820In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown inOctopus Deploy Octopus Server
- CVE-2021-37608Arbitrary file upload vulnerability in OFBizApache Software Foundation Apache OFBiz
- CVE-2021-33580regex injection leading to DoSApache Software Foundation Apache Roller
- CVE-2021-20792Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script viExpressTech Quiz And Survey Master
- CVE-2021-20775Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the daCybozu Garoon
- CVE-2021-20774Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to injCybozu Garoon
- CVE-2021-20773There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route inCybozu Garoon
- CVE-2021-20772Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the titleCybozu Garoon
- CVE-2021-20771Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitraCybozu Garoon
- CVE-2021-20770Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary Cybozu Garoon
- CVE-2021-20769Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitraryCybozu Garoon
- CVE-2021-20768Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attCybozu Garoon
- CVE-2021-20767Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an aCybozu Garoon
- CVE-2021-20766Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unsCybozu Garoon
- CVE-2021-20765Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via unCybozu Garoon
- CVE-2021-20764Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of AttCybozu Garoon
- CVE-2021-20763Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain theCybozu Garoon
- CVE-2021-20762Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail Cybozu Garoon
- CVE-2021-20761Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege Cybozu Garoon
- CVE-2021-20760Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the Cybozu Garoon
- CVE-2021-20759Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter thCybozu Garoon
- CVE-2021-20758Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack Cybozu Garoon
- CVE-2021-20757Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the Cybozu Garoon
- CVE-2021-20756Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the daCybozu Garoon
- CVE-2021-20755Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the datCybozu Garoon
- CVE-2021-20754Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the dataCybozu Garoon
- CVE-2021-20753Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrarCybozu Garoon
- CVE-2021-39267Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaSc
- CVE-2021-39268Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaSc