CVEs published August 26, 2021
61 CVEs were published on August 26, 2021: 2 critical, 4 high. 1 is now in CISA KEV.
- Published
- 61
- Critical
- 2
- High
- 4
- Medium
- 10
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- Google Chrome
- 14
- Six Apart Movable Type
- 8
- Microsoft Edge
- 3
- IBM API Connect
- 2
- IBM VIOS · IBM AIX
- 2
- octobercms october · october/system
- 2
- Aruba AirWave Management Platform
- 1
- discourse
- 1
- feehi/feehicms
- 1
- fiveai Cachet · cachethq/cachet
- 1
Critical 2
High 4
- CVE-2021-39165Unauthenticated SQL Injectionfiveai Cachet · cachethq/cachet
- CVE-2021-29801IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges.IBM VIOS · IBM AIX
- CVE-2021-29487Authentication bypass in Octobercmsoctobercms october · october/system
- CVE-2021-32648Account Takeover in Octobercmsoctobercms october · october/system
Medium, low and unrated 55
- CVE-2020-20675Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/.
- CVE-2021-39161Cross-site scripting via category name in Discoursediscourse
- CVE-2021-37715A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0.Aruba AirWave Management Platform
- CVE-2021-29862IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of serIBM VIOS · IBM AIX
- CVE-2021-29772IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input.IBM API Connect
- CVE-2021-29727IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service.IBM AIX · IBM VIOS
- CVE-2021-29715IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks dueIBM API Connect
- CVE-2021-30604Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-30603Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2021-30602Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to poGoogle Chrome
- CVE-2021-30601Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious extGoogle Chrome
- CVE-2021-30600Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2021-30599Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2021-30598Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2020-18477SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.
- CVE-2020-18476SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.
- CVE-2020-18475Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field.
- CVE-2020-18470Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4.
- CVE-2020-18469Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Ru
- CVE-2020-18468Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a c
- CVE-2020-18467Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via
- CVE-2021-36931Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2021-36929Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2021-36928Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2021-30597Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2021-30596Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of thGoogle Chrome
- CVE-2021-30594Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2021-30593Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious exteGoogle Chrome
- CVE-2021-30592Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious exGoogle Chrome
- CVE-2021-30591Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-30590Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-40147EmTec ZOC before 8.02.2 allows \e[201~ pastes, a different vulnerability than CVE-2021-32198.
- CVE-2021-32076Access Restriction bypass vulnerability via referrer spoof - Business Logic BypassSolarWinds Web Help Desk
- CVE-2021-36352Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha.
- CVE-2021-3734Improper Restriction of Rendered UI Layers or Frames in yourls/yourlsyourls/yourls
- CVE-2021-38559DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
- CVE-2021-27944Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an un
- CVE-2020-14160An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able t
- CVE-2020-14161It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
- CVE-2020-19822A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via th
- CVE-2020-19821A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.
- CVE-2020-19705thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
- CVE-2020-19709Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.feehi/feehicms
- CVE-2020-19704A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execut
- CVE-2020-19703A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or H
- CVE-2021-20815Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), MoSix Apart Movable Type
- CVE-2021-20814Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and earSix Apart Movable Type
- CVE-2021-20813Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series)Six Apart Movable Type
- CVE-2021-20812Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable TypSix Apart Movable Type
- CVE-2021-20811Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), MovaSix Apart Movable Type
- CVE-2021-20810Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Six Apart Movable Type
- CVE-2021-20809Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (MoSix Apart Movable Type
- CVE-2021-20808Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable TypeSix Apart Movable Type
- CVE-2021-20793Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.The installers of multiple Sony products
- CVE-2021-40145gdImageGd2Ptr in gd_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free.