# CVEs published 2021-08-23

92 CVEs were published on August 23, 2021: 0 critical, 18 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-28596](https://cve.now/CVE-2021-28596.md): Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2021-36013](https://cve.now/CVE-2021-36013.md): Adobe Media Encoder VOB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Media Encoder)
- [CVE-2021-39602](https://cve.now/CVE-2021-39602.md): A Buffer Overflow vulnerabilty exists in Miniftpd 1.0 in the do\_mkd function in the ftpproto.c file, which could let a remote malicious user (no CVSS)
- [CVE-2021-39599](https://cve.now/CVE-2021-39599.md): Multiple Cross Site Scripting (XSS) vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in (1) public/search.php and in the (no CVSS)
- [CVE-2020-18776](https://cve.now/CVE-2020-18776.md): In Libav 12.3, there is a segmentation fault in vc1\_decode\_b\_mb\_intfr in vc1\_block.c that allows an attacker to cause denial-of-service via (no CVSS)
- [CVE-2020-18778](https://cve.now/CVE-2020-18778.md): In Libav 12.3, there is a heap-based buffer over-read in vc1\_decode\_p\_mb\_intfi in vc1\_block.c that allows an attacker to cause denial-of-ser (no CVSS)
- [CVE-2020-18775](https://cve.now/CVE-2020-18775.md): In Libav 12.3, there is a heap-based buffer over-read in vc1\_decode\_b\_mb\_intfi in vc1\_block.c that allows an attacker to cause denial-of-ser (no CVSS)
- [CVE-2021-39615](https://cve.now/CVE-2021-39615.md): D-Link DSR-500N version 1.02 contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file.If an attacker succeed (no CVSS)
- [CVE-2021-39614](https://cve.now/CVE-2021-39614.md): D-Link DVX-2000MS contains hard-coded credentials for undocumented user accounts in the '/etc/passwd' file. (no CVSS)
- [CVE-2021-39613](https://cve.now/CVE-2021-39613.md): D-Link DVG-3104MS version 1.0.2.0.3, 1.0.2.0.4, and 1.0.2.0.4E contains hard-coded credentials for undocumented user accounts in the '/etc/p (CVSS 8.8)
- [CVE-2021-39609](https://cve.now/CVE-2021-39609.md): Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function. (no CVSS)
- [CVE-2021-39608](https://cve.now/CVE-2021-39608.md): Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user e (no CVSS)
- [CVE-2021-39158](https://cve.now/CVE-2021-39158.md): Dependency injection in NVCaffe (CVSS 8.8, NVIDIA caffe)
- [CVE-2020-18735](https://cve.now/CVE-2020-18735.md): A heap buffer overflow in /src/dds\_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. (no CVSS)
- [CVE-2020-18734](https://cve.now/CVE-2020-18734.md): A stack buffer overflow in /ddsi/q\_bitset.h of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash. (no CVSS)
- [CVE-2020-18731](https://cve.now/CVE-2020-18731.md): A segmentation violation in the Iec104\_Deal\_FirmUpdate function of IEC104 v1.0 allows attackers to cause a denial of service (DOS). (no CVSS)
- [CVE-2020-18730](https://cve.now/CVE-2020-18730.md): A segmentation violation in the Iec104\_Deal\_I function of IEC104 v1.0 allows attackers to cause a denial of service (DOS). (no CVSS)
- [CVE-2021-22249](https://cve.now/CVE-2021-22249.md): A verbose error message in GitLab EE affecting all versions since 12.2 could disclose the private email address of a user invited to a group (CVSS 4.3, GitLab)
- [CVE-2021-22248](https://cve.now/CVE-2021-22248.md): Improper authorization on the pipelines page in GitLab CE/EE affecting all versions since 13.12 allowed unauthorized users to view some pipe (CVSS 5.3, GitLab)
- [CVE-2021-22251](https://cve.now/CVE-2021-22251.md): Improper validation of invited users' email address in GitLab EE affecting all versions since 12.2 allowed projects to add members with emai (CVSS 4.3, GitLab)
- [CVE-2021-22252](https://cve.now/CVE-2021-22252.md): A confusion between tag and branch names in GitLab CE/EE affecting all versions since 13.7 allowed a Developer to access protected CI variab (CVSS 6.5, GitLab)
- [CVE-2021-22253](https://cve.now/CVE-2021-22253.md): Improper authorization in GitLab EE affecting all versions since 13.4 allowed a user who previously had the necessary access to trigger depl (CVSS 4.9, GitLab)
- [CVE-2021-22449](https://cve.now/CVE-2021-22449.md): There is a logic vulnerability in Elf-G10HN 1.0.0.608. (no CVSS, Elf-G10HN)
- [CVE-2021-22357](https://cve.now/CVE-2021-22357.md): There is a denial of service vulnerability in Huawei products. (no CVSS, S12700;S5700;S6700;S7700)
- [CVE-2021-22328](https://cve.now/CVE-2021-22328.md): There is a denial of service vulnerability in some huawei products. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2021-39150](https://cve.now/CVE-2021-39150.md): A Server-Side Forgery Request vulnerability in XStream via PriorityQueue unmarshaling (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39152](https://cve.now/CVE-2021-39152.md): A Server-Side Forgery Request vulnerability in XStream via HashMap unmarshaling (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39140](https://cve.now/CVE-2021-39140.md): XStream can cause a Denial of Service (CVSS 6.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39149](https://cve.now/CVE-2021-39149.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39148](https://cve.now/CVE-2021-39148.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39147](https://cve.now/CVE-2021-39147.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39146](https://cve.now/CVE-2021-39146.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39145](https://cve.now/CVE-2021-39145.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39141](https://cve.now/CVE-2021-39141.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39153](https://cve.now/CVE-2021-39153.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39151](https://cve.now/CVE-2021-39151.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39139](https://cve.now/CVE-2021-39139.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-39154](https://cve.now/CVE-2021-39154.md): XStream is vulnerable to an Arbitrary Code Execution attack (CVSS 8.5, x-stream xstream · com.thoughtworks.xstream:xstream)
- [CVE-2021-29802](https://cve.now/CVE-2021-29802.md): IBM Security SOAR performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or (CVSS 5.6, IBM Security)
- [CVE-2021-29704](https://cve.now/CVE-2021-29704.md): IBM Security SOAR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. (CVSS 5.9, IBM Security)
- [CVE-2021-35465](https://cve.now/CVE-2021-35465.md): Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. (no CVSS)
- [CVE-2021-3731](https://cve.now/CVE-2021-3731.md): Improper Restriction of Rendered UI Layers or Frames in ledgersmb/ledgersmb (CVSS 5.9, ledgersmb/ledgersmb)
- [CVE-2021-3730](https://cve.now/CVE-2021-3730.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 6.5, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3729](https://cve.now/CVE-2021-3729.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 4.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3694](https://cve.now/CVE-2021-3694.md): Cross-site Scripting (XSS) - Reflected in ledgersmb/ledgersmb (CVSS 8.2, ledgersmb/ledgersmb)
- [CVE-2021-3728](https://cve.now/CVE-2021-3728.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 6.5, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3693](https://cve.now/CVE-2021-3693.md): Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb (CVSS 8.8, ledgersmb/ledgersmb)
- [CVE-2021-24658](https://cve.now/CVE-2021-24658.md): Erident Custom Login and Dashboard \< 3.5.9 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Libin V Babu Erident Custom Login and Dashboard)
- [CVE-2021-24602](https://cve.now/CVE-2021-24602.md): HM Multiple Roles \< 1.3 - Arbitrary Role Change (no CVSS, HM Multiple Roles)
- [CVE-2021-24574](https://cve.now/CVE-2021-24574.md): Simple Banner \< 2.10.4 - Authenticated Stored XSS (no CVSS, Simple Banner)
- [CVE-2021-24571](https://cve.now/CVE-2021-24571.md): HD Quiz \< 1.8.4 - Authenticated Stored XSS (no CVSS, HD Quiz)
- [CVE-2021-24565](https://cve.now/CVE-2021-24565.md): Contact Form 7 Captcha \< 0.0.9 - CSRF to Stored XSS (no CVSS, Contact Form 7 Captcha)
- [CVE-2021-24564](https://cve.now/CVE-2021-24564.md): WPFront Scroll Top \< 2.0.6.07225 - Authenticated Stored XSS (no CVSS, WPFront Scroll Top)
- [CVE-2021-24562](https://cve.now/CVE-2021-24562.md): LifterLMS \< 4.21.2 - Access Other Student Grades/Answers via IDOR (no CVSS, LMS by LifterLMS – Online Course, Membership & Learning Man…)
- [CVE-2021-24561](https://cve.now/CVE-2021-24561.md): WP SMS \< 5.4.13 - Authenticated Stored Cross-Site Scripting (no CVSS, WP SMS)
- [CVE-2021-24558](https://cve.now/CVE-2021-24558.md): Project Status \<= 1.6 - Reflected Cross-Site Scripting (XSS) (no CVSS, Project Status)
- [CVE-2021-24557](https://cve.now/CVE-2021-24557.md): M-vSlider \<= 2.1.3 - Authenticated (admin+) SQL Injection (no CVSS, M-vSlider)
- [CVE-2021-24556](https://cve.now/CVE-2021-24556.md): Email Subscriber \<= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) (no CVSS, Email Subscriber)
- [CVE-2021-24554](https://cve.now/CVE-2021-24554.md): Paytm - Donation Plugin \<= 1.3.2 - Authenticated (admin+) SQL Injection (no CVSS, Paytm – Donation Plugin)
- [CVE-2021-24555](https://cve.now/CVE-2021-24555.md): Diary & Availability Calendar \<= 1.0.3 - Authenticated (subscriber+) SQL Injection (no CVSS, Diary & Availability Calendar)
- [CVE-2021-24553](https://cve.now/CVE-2021-24553.md): Timeline Calendar \<= 1.2 - Authenticated (admin+) SQL Injection (no CVSS, Timeline Calendar)
- [CVE-2021-24552](https://cve.now/CVE-2021-24552.md): Simple Events Calendar \<= 1.4.0 - Authenticated (admin+) SQL Injection (no CVSS, Simple Events Calendar)
- [CVE-2021-24551](https://cve.now/CVE-2021-24551.md): Edit Comments \<= 0.3 - Unauthenticated SQL Injection (no CVSS, Edit Comments)
- [CVE-2021-24550](https://cve.now/CVE-2021-24550.md): Broken Link Manager \<= 0.6.5 - Authenticated (admin+) SQL Injection (no CVSS, Broken Link Manager)
- [CVE-2021-24549](https://cve.now/CVE-2021-24549.md): AceIDE \<= 2.6.2 - Authenticated (admin+) Arbitrary File Access (no CVSS, AceIDE)
- [CVE-2021-24547](https://cve.now/CVE-2021-24547.md): KN Fix Your Title \<= 1.0.1 - Authenticated Stored XSS (no CVSS, KN Fix Your Title)
- [CVE-2021-24533](https://cve.now/CVE-2021-24533.md): Maintenance \< 4.03 - Authenticated Stored XSS (no CVSS, Maintenance)
- [CVE-2021-24529](https://cve.now/CVE-2021-24529.md): Grid Gallery \< 1.2.5 - Authenticated Stored Cross Site Scripting (XSS) (no CVSS, Grid Gallery – Photo Image Grid Gallery)
- [CVE-2021-24531](https://cve.now/CVE-2021-24531.md): Charitable – Donation Plugin \< 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Charitable – Donation Plugin)
- [CVE-2021-24524](https://cve.now/CVE-2021-24524.md): GiveWP \< 2.12.0 - Authenticated Stored XSS (no CVSS, GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2021-24506](https://cve.now/CVE-2021-24506.md): Slider Hero \< 8.2.7 - Contributor+ SQL Injection (no CVSS, Slider Hero with Animation, Video Background & Intro Maker)
- [CVE-2021-24497](https://cve.now/CVE-2021-24497.md): Giveaway \<= 1.2.2 - Authenticated SQL Injection (no CVSS, Giveaway)
- [CVE-2021-24486](https://cve.now/CVE-2021-24486.md): Simple Social Media Share Buttons \< 3.2.3 - Contributor+ Stored XSS (no CVSS, Simple Social Media Share Buttons – Social Sharing for Ever…)
- [CVE-2021-33598](https://cve.now/CVE-2021-33598.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.6, F-Secure endpoint protection products on Windows, Mac and L…)
- [CVE-2021-35940](https://cve.now/CVE-2021-35940.md): Regression of CVE-2017-12613 (no CVSS, Apache Software Foundation Apache Portable Runtime)
- [CVE-2021-39291](https://cve.now/CVE-2021-39291.md): Certain NetModule devices allow credentials via GET parameters to CLI-PHP. (no CVSS)
- [CVE-2021-39290](https://cve.now/CVE-2021-39290.md): Certain NetModule devices allow Limited Session Fixation via PHPSESSID. (no CVSS)
- [CVE-2021-39289](https://cve.now/CVE-2021-39289.md): Certain NetModule devices have Insecure Password Handling (cleartext or reversible encryption), These models with firmware before 4.3.0.113, (no CVSS)
- [CVE-2021-39245](https://cve.now/CVE-2021-39245.md): Hardcoded .htaccess Credentials for getlogs.cgi exist on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices. (no CVSS)
- [CVE-2021-39244](https://cve.now/CVE-2021-39244.md): Authenticated Semi-Blind Command Injection (via Parameter Injection) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the g (no CVSS)
- [CVE-2021-39243](https://cve.now/CVE-2021-39243.md): Cross-Site Request Forgery (CSRF) exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via any CGI endpoint. (no CVSS)
- [CVE-2021-38598](https://cve.now/CVE-2021-38598.md): OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtab (no CVSS, neutron)
- [CVE-2021-39371](https://cve.now/CVE-2021-39371.md): An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assign (no CVSS, pywps)
- [CVE-2020-18771](https://cve.now/CVE-2020-18771.md): Exiv2 0.27.99.0 has a global buffer over-read in Exiv2::Internal::Nikon1MakerNote::print0x0088 in nikonmn\_int.cpp which can result in an inf (no CVSS)
- [CVE-2020-18773](https://cve.now/CVE-2020-18773.md): An invalid memory access in the decode function in iptc.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via a cra (no CVSS)
- [CVE-2020-18774](https://cve.now/CVE-2020-18774.md): A float point exception in the printLong function in tags\_int.cpp of Exiv2 0.27.99.0 allows attackers to cause a denial of service (DOS) via (no CVSS)
- [CVE-2020-36475](https://cve.now/CVE-2020-36475.md): An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). (no CVSS)
- [CVE-2020-36476](https://cve.now/CVE-2020-36476.md): An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). (no CVSS)
- [CVE-2020-36477](https://cve.now/CVE-2020-36477.md): An issue was discovered in Mbed TLS before 2.24.0. (no CVSS)
- [CVE-2020-36478](https://cve.now/CVE-2020-36478.md): An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). (no CVSS)
- [CVE-2021-37750](https://cve.now/CVE-2021-37750.md): The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/ (no CVSS)
- [CVE-2021-39144](https://cve.now/CVE-2021-39144.md): XStream is vulnerable to a Remote Command Execution attack (CVSS 8.5, KEV, x-stream xstream · com.thoughtworks.xstream:xstream)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.