CVEs published August 25, 2021
68 CVEs were published on August 25, 2021: 4 critical, 19 high.
- Published
- 68
- Critical
- 4
- High
- 19
- Medium
- 18
- Low
- 2
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- GitLab
- 9
- GPAC Project
- 9
- Cisco Application Policy Infrastructure Controller
- 6
- Cisco NX-OS Software
- 4
- Cisco NX-OS System Software in ACI Mode
- 4
- Cscape
- 3
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- Axis Communications AB AXIS Device Manager
- 1
- baserproject basercms · baserproject/basercms
- 1
- Cisco Unified Computing System
- 1
Critical 4
- CVE-2021-1577Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2021-39159Remote code execution in Binderhubjupyterhub binderhub · binderhub
- CVE-2021-39160Code injection in nbgitpullerjupyterhub nbgitpuller · nbgitpuller
- CVE-2021-33885An Insufficient Verification of Data Authenticity vulnerability in B.
High 19
- CVE-2021-1588Cisco NX-OS Software MPLS OAM Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2021-1587Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2021-1586Cisco Nexus 9000 Series Fabric Switches ACI Mode Multi-Pod and Multi-Site TCP Denial of Service VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1579Cisco Application Policy Infrastructure Controller App Privilege Escalation VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2021-1578Cisco Application Policy Infrastructure Controller Privilege Escalation VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2021-1523Cisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-22242Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scGitLab
- CVE-2021-21850An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21848An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21849An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21841An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21842An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21840An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21836An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21834An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21835An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librarGPAC Project
- CVE-2021-21869An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS DevCODESYS
- CVE-2021-39136Cross-site scripting vulnerability in file uploadbaserproject basercms · baserproject/basercms
- CVE-2021-33886An improper sanitization of input vulnerability in B.
Medium, low and unrated 45
- CVE-2021-37334Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution
- CVE-2021-37153ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass iss
- CVE-2021-37154In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0
- CVE-2021-28070Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete.
- CVE-2020-19547Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
- CVE-2020-18065Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
- CVE-2021-1592Cisco UCS Manager Software SSH Sessions Denial of Service VulnerabilityCisco Unified Computing System
- CVE-2021-1591Cisco Nexus 9500 Series Switches Access Control List Bypass VulnerabilityCisco NX-OS Software
- CVE-2021-1590Cisco NX-OS Software system login block-for Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2021-1584Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1583Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read VulnerabilityCisco NX-OS System Software in ACI Mode
- CVE-2021-1582Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting VulnerabilityCisco Application Policy Infrastructure Controller
- CVE-2021-1581Cisco Application Policy Infrastructure Controller Command Injection and File Upload VulnerabilitiesCisco Application Policy Infrastructure Controller
- CVE-2021-1580Cisco Application Policy Infrastructure Controller Command Injection and File Upload VulnerabilitiesCisco Application Policy Infrastructure Controller
- CVE-2021-3713An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0.QEMU
- CVE-2021-22236Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application.GitLab
- CVE-2021-22237Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled.GitLab
- CVE-2021-22243Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another emaGitLab
- CVE-2021-22244Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulneGitLab
- CVE-2021-22247Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analyticsGitLab
- CVE-2021-22245Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossiblGitLab
- CVE-2021-22256Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track thGitLab
- CVE-2021-31989A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump Axis Communications AB AXIS Device Manager
- CVE-2021-22250Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administGitLab
- CVE-2021-21778A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0.MZ Automation"
- CVE-2021-33015Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files.Cscape
- CVE-2021-32975Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files.Cscape
- CVE-2021-32995Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files.Cscape
- CVE-2020-18976Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'.
- CVE-2020-18974Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/cr
- CVE-2020-18972Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToke
- CVE-2020-18971Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'
- CVE-2018-10790The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), r
- CVE-2021-33605Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20Vaadin · vaadin-checkbox-flow +1
- CVE-2021-33884An Unrestricted Upload of File with Dangerous Type vulnerability in B.
- CVE-2021-33883A Cleartext Transmission of Sensitive Information vulnerability in B.
- CVE-2021-33882A Missing Authentication for Critical Function vulnerability in B.
- CVE-2021-39112Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnappAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-40086An issue was discovered in PrimeKey EJBCA before 7.6.0.
- CVE-2021-40087An issue was discovered in PrimeKey EJBCA before 7.6.0.
- CVE-2021-40088An issue was discovered in PrimeKey EJBCA before 7.6.0.
- CVE-2021-40089An issue was discovered in PrimeKey EJBCA before 7.6.0.
- CVE-2021-40083Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iteration
- CVE-2021-40084opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters.
- CVE-2021-3605There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5.OpenEXR