# CVEs published 2021-08-19

33 CVEs were published on August 19, 2021: 0 critical, 2 high. Days are UTC.

- [CVE-2020-18900](https://cve.now/CVE-2020-18900.md): A heap-based buffer overflow in the libexe\_io\_handle\_read\_coff\_optional\_header function of libyal libexe before 20181128. (CVSS 3.3)
- [CVE-2020-18898](https://cve.now/CVE-2020-18898.md): A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a cr (no CVSS)
- [CVE-2020-18897](https://cve.now/CVE-2020-18897.md): An use-after-free vulnerability in the libpff\_item\_tree\_create\_node function of libyal Libpff before 20180623 allows attackers to cause a de (no CVSS)
- [CVE-2021-37597](https://cve.now/CVE-2021-37597.md): WP Cerber before 8.9.3 allows MFA bypass via wordpress\_logged\_in\_\[hash\] manipulation. (no CVSS)
- [CVE-2021-37598](https://cve.now/CVE-2021-37598.md): WP Cerber before 8.9.3 allows bypass of /wp-json access control via a trailing ? character. (no CVSS)
- [CVE-2021-28490](https://cve.now/CVE-2021-28490.md): In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token. (no CVSS, org.owasp:csrfguard)
- [CVE-2020-20645](https://cve.now/CVE-2020-20645.md): Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic\_information area. (no CVSS)
- [CVE-2020-20642](https://cve.now/CVE-2020-20642.md): Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admi (no CVSS)
- [CVE-2021-39302](https://cve.now/CVE-2021-39302.md): MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions\['org'\] value. (no CVSS)
- [CVE-2020-18748](https://cve.now/CVE-2020-18748.md): Cross Site Scripting (XSS) in Typora v0.9.65 allows attackers to execute arbitrary code via mathjax syntax due to a mathjax configuration er (no CVSS)
- [CVE-2021-29280](https://cve.now/CVE-2021-29280.md): In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow (no CVSS)
- [CVE-2021-34645](https://cve.now/CVE-2021-34645.md): Shopping Cart & eCommerce Store \<= 5.1.0 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, WP EasyCart Shopping Cart & eCommerce Store)
- [CVE-2021-31868](https://cve.now/CVE-2021-31868.md): Rapid7 Nexpose Security Console Ticket Access Authentication Vulnerability (CVSS 4.3, Rapid7 Nexpose)
- [CVE-2021-27822](https://cve.now/CVE-2021-27822.md): A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers (no CVSS)
- [CVE-2021-37698](https://cve.now/CVE-2021-37698.md): Missing TLS service certificate validation in GelfWriter, ElasticsearchWriter, InfluxdbWriter and Influxdb2Writer (CVSS 7.5, icinga2)
- [CVE-2021-28002](https://cve.now/CVE-2021-28002.md): A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attacke (no CVSS)
- [CVE-2021-28001](https://cve.now/CVE-2021-28001.md): A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to exec (no CVSS)
- [CVE-2021-28000](https://cve.now/CVE-2021-28000.md): A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows re (no CVSS)
- [CVE-2021-27999](https://cve.now/CVE-2021-27999.md): A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. (no CVSS)
- [CVE-2021-39273](https://cve.now/CVE-2021-39273.md): In XeroSecurity Sn1per 9.0 (free version), insecure permissions (0777) are set upon application execution, allowing an unprivileged user to (no CVSS)
- [CVE-2021-39274](https://cve.now/CVE-2021-39274.md): In XeroSecurity Sn1per 9.0 (free version), insecure directory permissions (0777) are set during installation, allowing an unprivileged user (no CVSS)
- [CVE-2021-31401](https://cve.now/CVE-2021-31401.md): An issue was discovered in tcp\_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. (no CVSS)
- [CVE-2020-35685](https://cve.now/CVE-2020-35685.md): An issue was discovered in HCC Nichestack 3.0. (no CVSS)
- [CVE-2020-35684](https://cve.now/CVE-2020-35684.md): An issue was discovered in HCC Nichestack 3.0. (no CVSS)
- [CVE-2020-35683](https://cve.now/CVE-2020-35683.md): An issue was discovered in HCC Nichestack 3.0. (no CVSS)
- [CVE-2021-36762](https://cve.now/CVE-2021-36762.md): An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. (no CVSS)
- [CVE-2021-27565](https://cve.now/CVE-2021-27565.md): The web server in InterNiche NicheStack through 4.0.1 allows remote attackers to cause a denial of service (infinite loop and networking out (no CVSS)
- [CVE-2021-31400](https://cve.now/CVE-2021-31400.md): An issue was discovered in tcp\_pulloutofband() in tcp\_in.c in HCC embedded InterNiche 4.0.1. (no CVSS)
- [CVE-2021-31228](https://cve.now/CVE-2021-31228.md): An issue was discovered in HCC embedded InterNiche 4.0.1. (no CVSS)
- [CVE-2021-31227](https://cve.now/CVE-2021-31227.md): An issue was discovered in HCC embedded InterNiche 4.0.1. (no CVSS)
- [CVE-2021-31226](https://cve.now/CVE-2021-31226.md): An issue was discovered in HCC embedded InterNiche 4.0.1. (no CVSS)
- [CVE-2021-31338](https://cve.now/CVE-2021-31338.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.0 SP1). (no CVSS, Siemens SINEMA Remote Connect Client)
- [CVE-2020-18899](https://cve.now/CVE-2020-18899.md): An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of ser (CVSS 6.5, exiv2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.