# CVEs published 2021-08-25

68 CVEs were published on August 25, 2021: 4 critical, 19 high. Days are UTC.

- [CVE-2021-37334](https://cve.now/CVE-2021-37334.md): Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution (no CVSS)
- [CVE-2021-37153](https://cve.now/CVE-2021-37153.md): ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass iss (no CVSS)
- [CVE-2021-37154](https://cve.now/CVE-2021-37154.md): In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 (no CVSS)
- [CVE-2021-28070](https://cve.now/CVE-2021-28070.md): Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete. (no CVSS)
- [CVE-2020-19547](https://cve.now/CVE-2020-19547.md): Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php. (no CVSS)
- [CVE-2020-18065](https://cve.now/CVE-2020-18065.md): Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu. (no CVSS)
- [CVE-2021-1592](https://cve.now/CVE-2021-1592.md): Cisco UCS Manager Software SSH Sessions Denial of Service Vulnerability (CVSS 4.3, Cisco Unified Computing System)
- [CVE-2021-1591](https://cve.now/CVE-2021-1591.md): Cisco Nexus 9500 Series Switches Access Control List Bypass Vulnerability (CVSS 5.8, Cisco NX-OS Software)
- [CVE-2021-1590](https://cve.now/CVE-2021-1590.md): Cisco NX-OS Software system login block-for Denial of Service Vulnerability (CVSS 5.3, Cisco NX-OS Software)
- [CVE-2021-1588](https://cve.now/CVE-2021-1588.md): Cisco NX-OS Software MPLS OAM Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2021-1587](https://cve.now/CVE-2021-1587.md): Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2021-1586](https://cve.now/CVE-2021-1586.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Multi-Pod and Multi-Site TCP Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1584](https://cve.now/CVE-2021-1584.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Privilege Escalation Vulnerability (CVSS 6.0, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1583](https://cve.now/CVE-2021-1583.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Arbitrary File Read Vulnerability (CVSS 4.4, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-1582](https://cve.now/CVE-2021-1582.md): Cisco Application Policy Infrastructure Controller Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1581](https://cve.now/CVE-2021-1581.md): Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities (CVSS 6.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1580](https://cve.now/CVE-2021-1580.md): Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities (CVSS 6.5, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1579](https://cve.now/CVE-2021-1579.md): Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability (CVSS 8.1, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1578](https://cve.now/CVE-2021-1578.md): Cisco Application Policy Infrastructure Controller Privilege Escalation Vulnerability (CVSS 8.8, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1577](https://cve.now/CVE-2021-1577.md): Cisco Application Policy Infrastructure Controller Arbitrary File Read and Write Vulnerability (CVSS 9.1, Cisco Application Policy Infrastructure Controller)
- [CVE-2021-1523](https://cve.now/CVE-2021-1523.md): Cisco Nexus 9000 Series Fabric Switches ACI Mode Queue Wedge Denial of Service Vulnerability (CVSS 8.6, Cisco NX-OS System Software in ACI Mode)
- [CVE-2021-3713](https://cve.now/CVE-2021-3713.md): An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. (no CVSS, QEMU)
- [CVE-2021-22236](https://cve.now/CVE-2021-22236.md): Due to improper handling of OAuth client IDs, new subscriptions generated OAuth tokens on an incorrect OAuth client application. (CVSS 5.5, GitLab)
- [CVE-2021-22242](https://cve.now/CVE-2021-22242.md): Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site sc (CVSS 8.7, GitLab)
- [CVE-2021-22237](https://cve.now/CVE-2021-22237.md): Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. (CVSS 6.6, GitLab)
- [CVE-2021-22243](https://cve.now/CVE-2021-22243.md): Under specialized conditions, GitLab CE/EE versions starting 7.10 may allow existing GitLab users to use an invite URL meant for another ema (CVSS 5.0, GitLab)
- [CVE-2021-22244](https://cve.now/CVE-2021-22244.md): Improper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulne (CVSS 3.1, GitLab)
- [CVE-2021-22247](https://cve.now/CVE-2021-22247.md): Improper authorization in GitLab CE/EE affecting all versions since 13.0 allows guests in private projects to view CI/CD analytics (CVSS 4.3, GitLab)
- [CVE-2021-22245](https://cve.now/CVE-2021-22245.md): Improper validation of commit author in GitLab CE/EE affecting all versions allowed an attacker to make several pages in a project impossibl (CVSS 2.7, GitLab)
- [CVE-2021-22256](https://cve.now/CVE-2021-22256.md): Improper authorization in GitLab CE/EE affecting all versions since 12.6 allowed guest users to create issues for Sentry errors and track th (CVSS 5.4, GitLab)
- [CVE-2021-31989](https://cve.now/CVE-2021-31989.md): A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump (no CVSS, Axis Communications AB AXIS Device Manager)
- [CVE-2021-22250](https://cve.now/CVE-2021-22250.md): Improper authorization in GitLab CE/EE affecting all versions since 13.3 allowed users to view and delete impersonation tokens that administ (CVSS 5.4, GitLab)
- [CVE-2021-21778](https://cve.now/CVE-2021-21778.md): A denial of service vulnerability exists in the ASDU message processing functionality of MZ Automation GmbH lib60870.NET 2.2.0. (no CVSS, MZ Automation")
- [CVE-2021-21850](https://cve.now/CVE-2021-21850.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21848](https://cve.now/CVE-2021-21848.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21849](https://cve.now/CVE-2021-21849.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21841](https://cve.now/CVE-2021-21841.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21842](https://cve.now/CVE-2021-21842.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21840](https://cve.now/CVE-2021-21840.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21836](https://cve.now/CVE-2021-21836.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-39159](https://cve.now/CVE-2021-39159.md): Remote code execution in Binderhub (CVSS 9.6, jupyterhub binderhub · binderhub)
- [CVE-2021-21834](https://cve.now/CVE-2021-21834.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21835](https://cve.now/CVE-2021-21835.md): An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content librar (CVSS 8.8, GPAC Project)
- [CVE-2021-21869](https://cve.now/CVE-2021-21869.md): An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Dev (CVSS 8.8, CODESYS)
- [CVE-2021-33015](https://cve.now/CVE-2021-33015.md): Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. (no CVSS, Cscape)
- [CVE-2021-32975](https://cve.now/CVE-2021-32975.md): Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. (no CVSS, Cscape)
- [CVE-2021-32995](https://cve.now/CVE-2021-32995.md): Cscape (All Versions prior to 9.90 SP5) lacks proper validation of user-supplied data when parsing project files. (no CVSS, Cscape)
- [CVE-2021-39160](https://cve.now/CVE-2021-39160.md): Code injection in nbgitpuller (CVSS 9.6, jupyterhub nbgitpuller · nbgitpuller)
- [CVE-2021-39136](https://cve.now/CVE-2021-39136.md): Cross-site scripting vulnerability in file upload (CVSS 8.7, baserproject basercms · baserproject/basercms)
- [CVE-2020-18976](https://cve.now/CVE-2020-18976.md): Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do\_checksum' function in 'checksum.c'. (no CVSS)
- [CVE-2020-18974](https://cve.now/CVE-2020-18974.md): Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/cr (no CVSS)
- [CVE-2020-18972](https://cve.now/CVE-2020-18972.md): Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToke (no CVSS)
- [CVE-2020-18971](https://cve.now/CVE-2020-18971.md): Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65' (no CVSS)
- [CVE-2018-10790](https://cve.now/CVE-2018-10790.md): The AP4\_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), r (no CVSS)
- [CVE-2021-33605](https://cve.now/CVE-2021-33605.md): Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20 (CVSS 4.3, Vaadin · vaadin-checkbox-flow +1)
- [CVE-2021-33886](https://cve.now/CVE-2021-33886.md): An improper sanitization of input vulnerability in B. (CVSS 8.1)
- [CVE-2021-33885](https://cve.now/CVE-2021-33885.md): An Insufficient Verification of Data Authenticity vulnerability in B. (CVSS 10.0)
- [CVE-2021-33884](https://cve.now/CVE-2021-33884.md): An Unrestricted Upload of File with Dangerous Type vulnerability in B. (CVSS 6.5)
- [CVE-2021-33883](https://cve.now/CVE-2021-33883.md): A Cleartext Transmission of Sensitive Information vulnerability in B. (CVSS 5.9)
- [CVE-2021-33882](https://cve.now/CVE-2021-33882.md): A Missing Authentication for Critical Function vulnerability in B. (CVSS 6.8)
- [CVE-2021-39112](https://cve.now/CVE-2021-39112.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to redirect users to a malicious URL via a reverse tabnapp (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-40086](https://cve.now/CVE-2021-40086.md): An issue was discovered in PrimeKey EJBCA before 7.6.0. (no CVSS)
- [CVE-2021-40087](https://cve.now/CVE-2021-40087.md): An issue was discovered in PrimeKey EJBCA before 7.6.0. (no CVSS)
- [CVE-2021-40088](https://cve.now/CVE-2021-40088.md): An issue was discovered in PrimeKey EJBCA before 7.6.0. (no CVSS)
- [CVE-2021-40089](https://cve.now/CVE-2021-40089.md): An issue was discovered in PrimeKey EJBCA before 7.6.0. (no CVSS)
- [CVE-2021-40083](https://cve.now/CVE-2021-40083.md): Knot Resolver before 5.3.2 is prone to an assertion failure, triggerable by a remote attacker in an edge case (NSEC3 with too many iteration (no CVSS)
- [CVE-2021-40084](https://cve.now/CVE-2021-40084.md): opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. (no CVSS)
- [CVE-2021-3605](https://cve.now/CVE-2021-3605.md): There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. (no CVSS, OpenEXR)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.