# CVEs published 2021-08-20

73 CVEs were published on August 20, 2021: 0 critical, 30 high. Days are UTC.

- [CVE-2021-21828](https://cve.now/CVE-2021-21828.md): A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. (CVSS 8.1, AT&T)
- [CVE-2021-21827](https://cve.now/CVE-2021-21827.md): A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. (CVSS 8.1, AT&T)
- [CVE-2021-21826](https://cve.now/CVE-2021-21826.md): A heap-based buffer overflow vulnerability exists in the XML Decompression DecodeTreeBlock functionality of AT&T Labs Xmill 0.7. (CVSS 8.1, AT&T)
- [CVE-2020-24130](https://cve.now/CVE-2020-24130.md): A cross site request forgery (CSRF) vulnerability in the configure.html component of Ponzu 0.11.0 allows attackers to change user and admini (no CVSS)
- [CVE-2020-27466](https://cve.now/CVE-2020-27466.md): An arbitrary file write vulnerability in lib/AjaxHandlers/ajaxEditTemplate.php of rConfig 3.9.6 allows attackers to execute arbitrary code v (no CVSS)
- [CVE-2020-27464](https://cve.now/CVE-2020-27464.md): An insecure update feature in the /updater.php component of rConfig 3.9.6 and below allows attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2020-27461](https://cve.now/CVE-2020-27461.md): A remote code execution vulnerability in SEOPanel 4.6.0 has been fixed for 4.7.0. (no CVSS)
- [CVE-2020-25359](https://cve.now/CVE-2020-25359.md): An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. (no CVSS)
- [CVE-2020-25353](https://cve.now/CVE-2020-25353.md): A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. (no CVSS)
- [CVE-2020-25352](https://cve.now/CVE-2020-25352.md): A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. (no CVSS)
- [CVE-2020-25351](https://cve.now/CVE-2020-25351.md): An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. (no CVSS)
- [CVE-2021-36016](https://cve.now/CVE-2021-36016.md): Adobe Media Encoder FLV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-36014](https://cve.now/CVE-2021-36014.md): Adobe Media Encoder MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-36015](https://cve.now/CVE-2021-36015.md): Adobe Media Encoder Memory Corruption Could Lead To Remote Code Execution (CVSS 7.8, Adobe Media Encoder)
- [CVE-2021-36010](https://cve.now/CVE-2021-36010.md): Adobe Illustrator SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-36011](https://cve.now/CVE-2021-36011.md): Adobe Illustrator improper neutralization of special elements used in an OS command (CVSS 8.3, Adobe Illustrator)
- [CVE-2021-36008](https://cve.now/CVE-2021-36008.md): Adobe Illustrator PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-36009](https://cve.now/CVE-2021-36009.md): Adobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-36006](https://cve.now/CVE-2021-36006.md): Adobe Photoshop MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe Photoshop)
- [CVE-2021-36007](https://cve.now/CVE-2021-36007.md): Adobe Prelude MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe Prelude)
- [CVE-2021-36005](https://cve.now/CVE-2021-36005.md): Adobe Photoshop PSD File Parsing Stack Overflow Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-36001](https://cve.now/CVE-2021-36001.md): Adobe Character Animator PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Character Animator)
- [CVE-2021-35999](https://cve.now/CVE-2021-35999.md): Adobe Prelude Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Prelude)
- [CVE-2021-36000](https://cve.now/CVE-2021-36000.md): Adobe Character Animator Memory Corruption Arbitrary Code Execution Vulnerability (CVSS 7.8, Adobe Character Animator)
- [CVE-2021-35992](https://cve.now/CVE-2021-35992.md): Adobe Bridge PostScript Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-35990](https://cve.now/CVE-2021-35990.md): Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-35997](https://cve.now/CVE-2021-35997.md): Adobe Premiere Pro Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Premiere)
- [CVE-2021-35991](https://cve.now/CVE-2021-35991.md): Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-35989](https://cve.now/CVE-2021-35989.md): Adobe Bridge PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-35988](https://cve.now/CVE-2021-35988.md): Adobe Acrobat Pro DC Out-of-Bounds Read Bug (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-35984](https://cve.now/CVE-2021-35984.md): Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-35987](https://cve.now/CVE-2021-35987.md): Adobe Acrobat Pro DC PDFLibTool Out-of-Bound Read (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-35986](https://cve.now/CVE-2021-35986.md): Adobe Acrobat Pro DC getAnnot Type Confusion Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-35981](https://cve.now/CVE-2021-35981.md): Adobe Acrobat Reader DC launchURL Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-35985](https://cve.now/CVE-2021-35985.md): Adobe Acrobat Pro DC PDFLibTool Null Pointer Dereference Bug (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-35983](https://cve.now/CVE-2021-35983.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28643](https://cve.now/CVE-2021-28643.md): Adobe Acrobat Pro DC embedDocAsDataObject Type Confusion Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-28640](https://cve.now/CVE-2021-28640.md): Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution Vulnerability (CVSS 7.3, Adobe Acrobat Reader)
- [CVE-2021-28642](https://cve.now/CVE-2021-28642.md): Adobe Acrobat Pro DC Out-of-Bounds Write Arbitrary Code Execution Vulnerability (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-28641](https://cve.now/CVE-2021-28641.md): Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28638](https://cve.now/CVE-2021-28638.md): Adobe Acrobat Reader DC PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28639](https://cve.now/CVE-2021-28639.md): Adobe Acrobat Reader DC setAction Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28636](https://cve.now/CVE-2021-28636.md): Adobe Acrobat Reader Unquoted Search Path Vulnerability (CVSS 7.3, Adobe Acrobat Reader)
- [CVE-2021-28635](https://cve.now/CVE-2021-28635.md): Adobe Acrobat Reader Use-After-Free Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28637](https://cve.now/CVE-2021-28637.md): Adobe Acrobat Pro DC PDFLibTool Out-of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28634](https://cve.now/CVE-2021-28634.md): Adobe Acrobat Reader AcrobatUtils.scpt Extension OS Command Injection Vulnerability (CVSS 8.2, Adobe Acrobat Reader)
- [CVE-2021-28595](https://cve.now/CVE-2021-28595.md): Adobe Dimension Uncontrolled Search Path Element Could Lead To Remote Code Execution (CVSS 7.8, Adobe Dimension)
- [CVE-2021-28591](https://cve.now/CVE-2021-28591.md): Adobe Illustrator PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-28624](https://cve.now/CVE-2021-28624.md): Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-28589](https://cve.now/CVE-2021-28589.md): Adobe Media Encoder TS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-28592](https://cve.now/CVE-2021-28592.md): Adobe Illustrator JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-28593](https://cve.now/CVE-2021-28593.md): Adobe Illustrator PostScript Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-28590](https://cve.now/CVE-2021-28590.md): Adobe Media Encoder VOB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-22255](https://cve.now/CVE-2021-22255.md): SSRF in URL file upload in Baserow \<1.1.0 allows remote authenticated users to retrieve files from the internal server network exposed over (CVSS 7.7, Baserow B.V. Baserow)
- [CVE-2021-22238](https://cve.now/CVE-2021-22238.md): An issue has been discovered in GitLab affecting all versions starting with 13.3. (CVSS 6.8, GitLab)
- [CVE-2021-22246](https://cve.now/CVE-2021-22246.md): A vulnerability was discovered in GitLab versions before 14.0.2, 13.12.6, 13.11.6. (CVSS 7.7, GitLab)
- [CVE-2021-22254](https://cve.now/CVE-2021-22254.md): Under very specific conditions a user could be impersonated using Gitlab shell. (CVSS 3.1, GitLab)
- [CVE-2021-35529](https://cve.now/CVE-2021-35529.md): Password in Memory Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB) (CVSS 7.7, Hitachi ABB Power Grids Retail Operations · Hitachi ABB Pow…)
- [CVE-2021-36748](https://cve.now/CVE-2021-36748.md): A SQL Injection issue in the list controller of the Prestahome Blog (aka ph\_simpleblog) module before 1.7.8 for Prestashop allows a remote a (no CVSS)
- [CVE-2021-21823](https://cve.now/CVE-2021-21823.md): An information disclosure vulnerability exists in the Friend finder functionality of GmbH Komoot version 10.26.9 up to 11.1.11. (CVSS 5.3, Komoot)
- [CVE-2021-34433](https://cve.now/CVE-2021-34433.md): In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 to 3.0.0-M3, the certificate based (x509 and RPK) DTLS handshakes accidentally su (no CVSS, The Eclipse Foundation Eclipse Californium)
- [CVE-2021-34228](https://cve.now/CVE-2021-34228.md): Cross-site scripting in parent\_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execut (no CVSS)
- [CVE-2021-34223](https://cve.now/CVE-2021-34223.md): Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arb (no CVSS)
- [CVE-2021-34220](https://cve.now/CVE-2021-34220.md): Cross-site scripting in tr069config.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute a (no CVSS)
- [CVE-2021-34218](https://cve.now/CVE-2021-34218.md): Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /add/ , /img/, /js/, an (no CVSS)
- [CVE-2021-34215](https://cve.now/CVE-2021-34215.md): Cross-site scripting in tcpipwan.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbi (no CVSS)
- [CVE-2021-34207](https://cve.now/CVE-2021-34207.md): Cross-site scripting in ddns.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrar (no CVSS)
- [CVE-2020-36474](https://cve.now/CVE-2020-36474.md): SafeCurl before 0.9.2 has a DNS rebinding vulnerability. (no CVSS, vanilla/safecurl)
- [CVE-2020-18886](https://cve.now/CVE-2020-18886.md): Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload\_file\_do.php'. (no CVSS)
- [CVE-2020-18885](https://cve.now/CVE-2020-18885.md): Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/we (no CVSS)
- [CVE-2020-18879](https://cve.now/CVE-2020-18879.md): Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component ' (no CVSS)
- [CVE-2020-18878](https://cve.now/CVE-2020-18878.md): Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=l (no CVSS)
- [CVE-2020-18877](https://cve.now/CVE-2020-18877.md): SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/corefr (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.