CVEs published August 23, 2021
92 CVEs were published on August 23, 2021: 0 critical, 18 high. 1 is now in CISA KEV.
- Published
- 92
- Critical
- 0
- High
- 18
- Medium
- 13
- Low
- 1
- Unrated
- 60
- Now in CISA KEV
- 1
- Fix available
- 41
Most affected products
- x-stream xstream · com.thoughtworks.xstream:xstream
- 14
- GitLab
- 5
- firefly-iii/firefly-iii · grumpydictator/firefly-iii
- 3
- ledgersmb/ledgersmb
- 3
- IBM Security
- 2
- AceIDE
- 1
- Adobe FrameMaker
- 1
- Adobe Media Encoder
- 1
- Apache Software Foundation Apache Portable Runtime
- 1
- Broken Link Manager
- 1
High 18
- CVE-2021-28596Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe FrameMaker
- CVE-2021-39613D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/p
- CVE-2021-39158Dependency injection in NVCaffeNVIDIA caffe
- CVE-2021-39150A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshalingx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39152A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshalingx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39149XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39148XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39147XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39146XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39145XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39141XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39153XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39151XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39139XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-39154XStream is vulnerable to an Arbitrary Code Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-3694Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmbledgersmb/ledgersmb
- CVE-2021-3693Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmbledgersmb/ledgersmb
- CVE-2021-39144XStream is vulnerable to a Remote Command Execution attackx-stream xstream · com.thoughtworks.xstream:xstream
Medium, low and unrated 74
- CVE-2021-36013Adobe Media Encoder VOB File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Media Encoder
- CVE-2021-39602A Buffer Overflow vulnerabilty exists in Miniftpd 1.0 in the do_mkd function in the ftpproto.c file, which could let a remote malicious user
- CVE-2021-39599Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the
- CVE-2020-18776In Libav 12.3, there is a segmentation fault in vc1_decode_b_mb_intfr in vc1_block.c that allows an attacker to cause denial-of-service via
- CVE-2020-18778In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_p_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-ser
- CVE-2020-18775In Libav 12.3, there is a heap-based buffer over-read in vc1_decode_b_mb_intfi in vc1_block.c that allows an attacker to cause denial-of-ser
- CVE-2021-39615D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeed
- CVE-2021-39614D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.
- CVE-2021-39609Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
- CVE-2021-39608Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user e
- CVE-2020-18735A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
- CVE-2020-18734A stack buffer overflow in /ddsi/q_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.
- CVE-2020-18731A segmentation violation in the Iec104_Deal_FirmUpdate function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).
- CVE-2020-18730A segmentation violation in the Iec104_Deal_I function of IEC104 v1.0 allows attackers to cause a denial of service (DOS).
- CVE-2021-22249A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a groupGitLab
- CVE-2021-22248Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipeGitLab
- CVE-2021-22251Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emaiGitLab
- CVE-2021-22252A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variabGitLab
- CVE-2021-22253Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger deplGitLab
- CVE-2021-22449There is a logic vulnerability in Elf-G10HN 1.0.0.608.Elf-G10HN
- CVE-2021-22357There is a denial of service vulnerability in Huawei products.S12700;S5700;S6700;S7700
- CVE-2021-22328There is a denial of service vulnerability in some huawei products.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-39140XStream can cause a Denial of Servicex-stream xstream · com.thoughtworks.xstream:xstream
- CVE-2021-29802IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses orIBM Security
- CVE-2021-29704IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.IBM Security
- CVE-2021-35465Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction.
- CVE-2021-3731Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmbledgersmb/ledgersmb
- CVE-2021-3730Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-3729Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-3728Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-24658Erident Custom Login and Dashboard < 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS)Libin V Babu Erident Custom Login and Dashboard
- CVE-2021-24602HM Multiple Roles < 1.3 - Arbitrary Role ChangeHM Multiple Roles
- CVE-2021-24574Simple Banner < 2.10.4 - Authenticated Stored XSSSimple Banner
- CVE-2021-24571HD Quiz < 1.8.4 - Authenticated Stored XSSHD Quiz
- CVE-2021-24565Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSSContact Form 7 Captcha
- CVE-2021-24564WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSSWPFront Scroll Top
- CVE-2021-24562LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDORLMS by LifterLMS – Online Course, Membership & Learning Man…
- CVE-2021-24561WP SMS < 5.4.13 - Authenticated Stored Cross-Site ScriptingWP SMS
- CVE-2021-24558Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)Project Status
- CVE-2021-24557M-vSlider <= 2.1.3 - Authenticated (admin+) SQL InjectionM-vSlider
- CVE-2021-24556Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)Email Subscriber
- CVE-2021-24554Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL InjectionPaytm – Donation Plugin
- CVE-2021-24555Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL InjectionDiary & Availability Calendar
- CVE-2021-24553Timeline Calendar <= 1.2 - Authenticated (admin+) SQL InjectionTimeline Calendar
- CVE-2021-24552Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL InjectionSimple Events Calendar
- CVE-2021-24551Edit Comments <= 0.3 - Unauthenticated SQL InjectionEdit Comments
- CVE-2021-24550Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL InjectionBroken Link Manager
- CVE-2021-24549AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File AccessAceIDE
- CVE-2021-24547KN Fix Your Title <= 1.0.1 - Authenticated Stored XSSKN Fix Your Title
- CVE-2021-24533Maintenance < 4.03 - Authenticated Stored XSSMaintenance
- CVE-2021-24529Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)Grid Gallery – Photo Image Grid Gallery
- CVE-2021-24531Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)Charitable – Donation Plugin
- CVE-2021-24524GiveWP < 2.12.0 - Authenticated Stored XSSGiveWP – Donation Plugin and Fundraising Platform
- CVE-2021-24506Slider Hero < 8.2.7 - Contributor+ SQL InjectionSlider Hero with Animation, Video Background & Intro Maker
- CVE-2021-24497Giveaway <= 1.2.2 - Authenticated SQL InjectionGiveaway
- CVE-2021-24486Simple Social Media Share Buttons < 3.2.3 - Contributor+ Stored XSSSimple Social Media Share Buttons – Social Sharing for Ever…
- CVE-2021-33598Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows, Mac and L…
- CVE-2021-35940Regression of CVE-2017-12613Apache Software Foundation Apache Portable Runtime
- CVE-2021-39291Certain NetModule devices allow credentials via GET parameters to CLI-PHP.
- CVE-2021-39290Certain NetModule devices allow Limited Session Fixation via PHPSESSID.
- CVE-2021-39289Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113,
- CVE-2021-39245Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices.
- CVE-2021-39244Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the g
- CVE-2021-39243Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint.
- CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtabneutron
- CVE-2021-39371An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assignpywps
- CVE-2020-18771Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn_int.cpp which can result in an inf
- CVE-2020-18773An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a cra
- CVE-2020-18774A float point exception in the printLong function in tags_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via
- CVE-2020-36475An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS).
- CVE-2020-36476An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS).
- CVE-2020-36477An issue was discovered in Mbed TLS before 2.24.0.
- CVE-2020-36478An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS).
- CVE-2021-37750The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/