# CVEs published 2021-08-18

98 CVEs were published on August 18, 2021: 2 critical, 26 high. Days are UTC.

- [CVE-2021-32602](https://cve.now/CVE-2021-32602.md): An improper neutralization of input during web page generation vulnerability (CWE-79) in FortiPortal GUI 6.0.4 and below, 5.3.6 and below, 5 (CVSS 5.8, Fortinet FortiPortal)
- [CVE-2021-24038](https://cve.now/CVE-2021-24038.md): Due to a bug with management of handles in OVRServiceLauncher.exe, an attacker could expose a privileged process handle to an unprivileged p (no CVSS, Facebook Oculus Desktop)
- [CVE-2021-39138](https://cve.now/CVE-2021-39138.md): New anonymous user session acts as if it's created with password (CVSS 4.8, parse-community parse-server · parse-server)
- [CVE-2021-32588](https://cve.now/CVE-2021-32588.md): A use of hard-coded credentials (CWE-798) vulnerability in FortiPortal versions 5.2.5 and below, 5.3.5 and below, 6.0.4 and below, versions (CVSS 9.8, Fortinet FortiPortal)
- [CVE-2020-22345](https://cve.now/CVE-2020-22345.md): /graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters (no CVSS, centreon/centreon)
- [CVE-2021-34745](https://cve.now/CVE-2021-34745.md): AppDynamics .NET Agent Privilege Escalation Vulnerability (CVSS 7.8, Cisco AppDynamics .NET Agent for Windows)
- [CVE-2021-34749](https://cve.now/CVE-2021-34749.md): Multiple Cisco Products Server Name Identification Data Exfiltration Vulnerability (CVSS 5.8, Cisco Web Security Appliance)
- [CVE-2021-34734](https://cve.now/CVE-2021-34734.md): Cisco Video Surveillance 7000 Series IP Cameras Link Layer Discovery Protocol Double-Free Denial of Service Vulnerability (CVSS 6.5, Cisco Video Surveillance 7000 Series IP Cameras)
- [CVE-2021-34730](https://cve.now/CVE-2021-34730.md): Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerability (CVSS 9.8, Cisco Small Business RV Series Router Firmware)
- [CVE-2021-34716](https://cve.now/CVE-2021-34716.md): Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability (CVSS 6.7, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2021-34715](https://cve.now/CVE-2021-34715.md): Cisco Expressway Series and TelePresence Video Communication Server Image Verification Vulnerability (CVSS 4.7, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2021-1561](https://cve.now/CVE-2021-1561.md): Cisco Secure Email and Web Manager Spam Quarantine Unauthorized Access Vulnerability (CVSS 5.4, Cisco Content Security Management Appliance)
- [CVE-2021-39270](https://cve.now/CVE-2021-39270.md): In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. (no CVSS, Ping Identity RSA SecurID Integration Kit)
- [CVE-2020-25928](https://cve.now/CVE-2020-25928.md): The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. (no CVSS)
- [CVE-2020-25767](https://cve.now/CVE-2020-25767.md): An issue was discovered in HCC Embedded NicheStack IPv4 4.1. (no CVSS)
- [CVE-2020-25927](https://cve.now/CVE-2020-25927.md): The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Out-of-bounds Read. (no CVSS)
- [CVE-2020-25926](https://cve.now/CVE-2020-25926.md): The DNS client in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Insufficient entropy in the DNS transaction id. (no CVSS)
- [CVE-2020-19669](https://cve.now/CVE-2020-19669.md): Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin (no CVSS)
- [CVE-2021-25218](https://cve.now/CVE-2021-25218.md): A too-strict assertion check could be triggered when responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if RRL is in use (CVSS 7.5, ISC BIND9)
- [CVE-2020-22120](https://cve.now/CVE-2020-22120.md): A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execu (no CVSS)
- [CVE-2020-22122](https://cve.now/CVE-2020-22122.md): A SQL injection vulnerability in /oa.php?c=Staff&a=read of Find a Place LJCMS v 1.3 allows attackers to access sensitive database informatio (no CVSS)
- [CVE-2020-22124](https://cve.now/CVE-2020-22124.md): A vulnerability in the \\inc\\config.php component of joyplus-cms v1.6 allows attackers to access sensitive information. (no CVSS)
- [CVE-2021-39286](https://cve.now/CVE-2021-39286.md): Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped. (no CVSS, pywb)
- [CVE-2021-37617](https://cve.now/CVE-2021-37617.md): Untrusted Search Path in Nextcloud Desktop Client (CVSS 7.3, nextcloud security-advisories)
- [CVE-2021-39282](https://cve.now/CVE-2021-39282.md): Live555 through 1.08 has a memory leak in AC3AudioStreamParser for AC3 files. (no CVSS)
- [CVE-2021-39283](https://cve.now/CVE-2021-39283.md): liveMedia/FramedSource.cpp in Live555 through 1.08 allows an assertion failure and application exit via multiple SETUP and PLAY commands. (no CVSS)
- [CVE-2020-18875](https://cve.now/CVE-2020-18875.md): Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (no CVSS)
- [CVE-2020-28146](https://cve.now/CVE-2020-28146.md): Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter. (no CVSS)
- [CVE-2020-23069](https://cve.now/CVE-2020-23069.md): Path Traversal vulneraility exists in webTareas 2.0 via the extpath parameter in general\_serv.php, which could let a malicious user read arb (no CVSS)
- [CVE-2021-23424](https://cve.now/CVE-2021-23424.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, ansi-html)
- [CVE-2021-23425](https://cve.now/CVE-2021-23425.md): Regular Expression Denial of Service (ReDoS) (CVSS 5.3, trim-off-newlines)
- [CVE-2021-32728](https://cve.now/CVE-2021-32728.md): End-to-end encryption device setup did not verify public key (CVSS 6.5, nextcloud security-advisories)
- [CVE-2021-37714](https://cve.now/CVE-2021-37714.md): Crafted input may cause the jsoup HTML and XML parser to get stuck, timeout, or throw unchecked exceptions (CVSS 7.5, jhy jsoup · org.jsoup:jsoup)
- [CVE-2021-37702](https://cve.now/CVE-2021-37702.md): Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore (CVSS 8.0, pimcore · pimcore/pimcore)
- [CVE-2021-0628](https://cve.now/CVE-2021-0628.md): In OMA DRM, there is a possible memory corruption due to improper input validation. (no CVSS, MT6580, MT6735, MT6739, MT6755S, MT6757, MT6761, MT6763, MT…)
- [CVE-2021-0627](https://cve.now/CVE-2021-0627.md): In OMA DRM, there is a possible memory corruption due to an integer overflow. (no CVSS, MT6580, MT6735, MT6739, MT6755S, MT6757, MT6761, MT6763, MT…)
- [CVE-2021-0626](https://cve.now/CVE-2021-0626.md): In ged, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6768, MT6771, MT6779, MT6785)
- [CVE-2021-0420](https://cve.now/CVE-2021-0420.md): In memory management driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0419](https://cve.now/CVE-2021-0419.md): In memory management driver, there is a possible system crash due to improper input validation. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0418](https://cve.now/CVE-2021-0418.md): In memory management driver, there is a possible system crash due to improper input validation. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0417](https://cve.now/CVE-2021-0417.md): In memory management driver, there is a possible system crash due to improper input validation. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0416](https://cve.now/CVE-2021-0416.md): In memory management driver, there is a possible system crash due to improper input validation. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0415](https://cve.now/CVE-2021-0415.md): In memory management driver, there is a possible information disclosure due to a missing permission check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0408](https://cve.now/CVE-2021-0408.md): In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT…)
- [CVE-2021-0407](https://cve.now/CVE-2021-0407.md): In clk driver, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6…)
- [CVE-2021-38710](https://cve.now/CVE-2021-38710.md): Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. (no CVSS)
- [CVE-2021-21781](https://cve.now/CVE-2021-21781.md): An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. (CVSS 4.0, Linux Kernel)
- [CVE-2021-21868](https://cve.now/CVE-2021-21868.md): An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get\_MissingTypes() functionality of CODESYS GmbH CODESYS (CVSS 8.8, CODESYS)
- [CVE-2021-21867](https://cve.now/CVE-2021-21867.md): An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODES (CVSS 8.8, CODESYS)
- [CVE-2021-37358](https://cve.now/CVE-2021-37358.md): SQL Injection in SEACMS v210530 (2021-05-30) allows remote attackers to execute arbitrary code via the component "admin\_ajax.php?action=chec (no CVSS)
- [CVE-2020-18746](https://cve.now/CVE-2020-18746.md): SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy\_list.php". (no CVSS)
- [CVE-2021-21862](https://cve.now/CVE-2021-21862.md): Multiple exploitable integer truncation vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Conte (CVSS 8.8, GPAC)
- [CVE-2021-21825](https://cve.now/CVE-2021-21825.md): A heap-based buffer overflow vulnerability exists in the XML Decompression PlainTextUncompressor::UncompressItem functionality of AT&T Labs’ (CVSS 8.1, AT&T)
- [CVE-2021-21858](https://cve.now/CVE-2021-21858.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21857](https://cve.now/CVE-2021-21857.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21856](https://cve.now/CVE-2021-21856.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21855](https://cve.now/CVE-2021-21855.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21854](https://cve.now/CVE-2021-21854.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21853](https://cve.now/CVE-2021-21853.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21839](https://cve.now/CVE-2021-21839.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21838](https://cve.now/CVE-2021-21838.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21837](https://cve.now/CVE-2021-21837.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21844](https://cve.now/CVE-2021-21844.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21843](https://cve.now/CVE-2021-21843.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21846](https://cve.now/CVE-2021-21846.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21845](https://cve.now/CVE-2021-21845.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21847](https://cve.now/CVE-2021-21847.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC)
- [CVE-2021-21851](https://cve.now/CVE-2021-21851.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC")
- [CVE-2021-31820](https://cve.now/CVE-2021-31820.md): In Octopus Server after version 2018.8.2 if the Octopus Server Web Request Proxy is configured with authentication, the password is shown in (no CVSS, Octopus Deploy Octopus Server)
- [CVE-2021-37608](https://cve.now/CVE-2021-37608.md): Arbitrary file upload vulnerability in OFBiz (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2021-33580](https://cve.now/CVE-2021-33580.md): regex injection leading to DoS (no CVSS, Apache Software Foundation Apache Roller)
- [CVE-2021-20792](https://cve.now/CVE-2021-20792.md): Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script vi (no CVSS, ExpressTech Quiz And Survey Master)
- [CVE-2021-20775](https://cve.now/CVE-2021-20775.md): Improper input validation vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the da (no CVSS, Cybozu Garoon)
- [CVE-2021-20774](https://cve.now/CVE-2021-20774.md): Cross-site scripting vulnerability in some functions of E-mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote authenticated attacker to inj (no CVSS, Cybozu Garoon)
- [CVE-2021-20773](https://cve.now/CVE-2021-20773.md): There is a vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.0, which may allow a remote authenticated attacker to delete the route in (no CVSS, Cybozu Garoon)
- [CVE-2021-20772](https://cve.now/CVE-2021-20772.md): Information disclosure vulnerability in Bulletin of Cybozu Garoon 4.10.0 to 5.5.0 allows a remote authenticated attacker to obtain the title (no CVSS, Cybozu Garoon)
- [CVE-2021-20771](https://cve.now/CVE-2021-20771.md): Cross-site scripting vulnerability in some functions of E-Mail of Cybozu Garoon 4.0.0 to 5.5.0 allows a remote attacker to inject an arbitra (no CVSS, Cybozu Garoon)
- [CVE-2021-20770](https://cve.now/CVE-2021-20770.md): Cross-site scripting vulnerability in Message of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary (no CVSS, Cybozu Garoon)
- [CVE-2021-20769](https://cve.now/CVE-2021-20769.md): Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrary (no CVSS, Cybozu Garoon)
- [CVE-2021-20768](https://cve.now/CVE-2021-20768.md): Operational restrictions bypass vulnerability in Scheduler and MultiReport of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated att (no CVSS, Cybozu Garoon)
- [CVE-2021-20767](https://cve.now/CVE-2021-20767.md): Cross-site scripting vulnerability in Full Text Search of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an a (no CVSS, Cybozu Garoon)
- [CVE-2021-20766](https://cve.now/CVE-2021-20766.md): Cross-site scripting vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via uns (no CVSS, Cybozu Garoon)
- [CVE-2021-20765](https://cve.now/CVE-2021-20765.md): Cross-site scripting vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to inject an arbitrary script via un (no CVSS, Cybozu Garoon)
- [CVE-2021-20764](https://cve.now/CVE-2021-20764.md): Improper input validation vulnerability in Attaching Files of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker to alter the data of Att (no CVSS, Cybozu Garoon)
- [CVE-2021-20763](https://cve.now/CVE-2021-20763.md): Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the (no CVSS, Cybozu Garoon)
- [CVE-2021-20762](https://cve.now/CVE-2021-20762.md): Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail (no CVSS, Cybozu Garoon)
- [CVE-2021-20761](https://cve.now/CVE-2021-20761.md): Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote attacker with an administrative privilege (no CVSS, Cybozu Garoon)
- [CVE-2021-20760](https://cve.now/CVE-2021-20760.md): Improper input validation vulnerability in User Profile of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the (no CVSS, Cybozu Garoon)
- [CVE-2021-20759](https://cve.now/CVE-2021-20759.md): Operational restrictions bypass vulnerability in Bulletin of Cybozu Garoon 4.6.0 to 5.0.2 allows a remote authenticated attacker to alter th (no CVSS, Cybozu Garoon)
- [CVE-2021-20758](https://cve.now/CVE-2021-20758.md): Cross-site request forgery (CSRF) vulnerability in Message of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to hijack (no CVSS, Cybozu Garoon)
- [CVE-2021-20757](https://cve.now/CVE-2021-20757.md): Operational restrictions bypass vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the (no CVSS, Cybozu Garoon)
- [CVE-2021-20756](https://cve.now/CVE-2021-20756.md): Viewing restrictions bypass vulnerability in Address of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the da (no CVSS, Cybozu Garoon)
- [CVE-2021-20755](https://cve.now/CVE-2021-20755.md): Viewing restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the dat (no CVSS, Cybozu Garoon)
- [CVE-2021-20754](https://cve.now/CVE-2021-20754.md): Improper input validation vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to alter the data (no CVSS, Cybozu Garoon)
- [CVE-2021-20753](https://cve.now/CVE-2021-20753.md): Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to inject an arbitrar (no CVSS, Cybozu Garoon)
- [CVE-2021-39267](https://cve.now/CVE-2021-39267.md): Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaSc (no CVSS)
- [CVE-2021-39268](https://cve.now/CVE-2021-39268.md): Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaSc (no CVSS)
- [CVE-2021-21852](https://cve.now/CVE-2021-21852.md): Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content (CVSS 8.8, GPAC")

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.