# CVEs published 2021-08-26

61 CVEs were published on August 26, 2021: 2 critical, 4 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-39167](https://cve.now/CVE-2021-39167.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0, openzeppelin-contracts · @openzeppelin/contracts)
- [CVE-2021-39168](https://cve.now/CVE-2021-39168.md): TimelockController vulnerability in OpenZeppelin Contracts (CVSS 10.0, openzeppelin-contracts-upgradeable · @openzeppelin/contract…)
- [CVE-2020-20675](https://cve.now/CVE-2020-20675.md): Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/. (no CVSS)
- [CVE-2021-39165](https://cve.now/CVE-2021-39165.md): Unauthenticated SQL Injection (CVSS 8.1, fiveai Cachet · cachethq/cachet)
- [CVE-2021-39161](https://cve.now/CVE-2021-39161.md): Cross-site scripting via category name in Discourse (CVSS 4.4, discourse)
- [CVE-2021-37715](https://cve.now/CVE-2021-37715.md): A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.13.0. (no CVSS, Aruba AirWave Management Platform)
- [CVE-2021-29862](https://cve.now/CVE-2021-29862.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of ser (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2021-29801](https://cve.now/CVE-2021-29801.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. (CVSS 8.4, IBM VIOS · IBM AIX)
- [CVE-2021-29772](https://cve.now/CVE-2021-29772.md): IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. (CVSS 5.6, IBM API Connect)
- [CVE-2021-29727](https://cve.now/CVE-2021-29727.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial of service. (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2021-29715](https://cve.now/CVE-2021-29715.md): IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of serivce attacks due (CVSS 6.5, IBM API Connect)
- [CVE-2021-29487](https://cve.now/CVE-2021-29487.md): Authentication bypass in Octobercms (CVSS 7.4, octobercms october · october/system)
- [CVE-2021-32648](https://cve.now/CVE-2021-32648.md): Account Takeover in Octobercms (CVSS 8.2, KEV, octobercms october · october/system)
- [CVE-2021-30604](https://cve.now/CVE-2021-30604.md): Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-30603](https://cve.now/CVE-2021-30603.md): Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2021-30602](https://cve.now/CVE-2021-30602.md): Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a malicious website to po (no CVSS, Google Chrome)
- [CVE-2021-30601](https://cve.now/CVE-2021-30601.md): Use after free in Extensions API in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to install a malicious ext (no CVSS, Google Chrome)
- [CVE-2021-30600](https://cve.now/CVE-2021-30600.md): Use after free in Printing in Google Chrome prior to 92.0.4515.159 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2021-30599](https://cve.now/CVE-2021-30599.md): Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (no CVSS, Google Chrome)
- [CVE-2021-30598](https://cve.now/CVE-2021-30598.md): Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (no CVSS, Google Chrome)
- [CVE-2020-18477](https://cve.now/CVE-2020-18477.md): SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con\_content field. (no CVSS)
- [CVE-2020-18476](https://cve.now/CVE-2020-18476.md): SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd\_image field. (no CVSS)
- [CVE-2020-18475](https://cve.now/CVE-2020-18475.md): Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes\_title field. (no CVSS)
- [CVE-2020-18470](https://cve.now/CVE-2020-18470.md): Stored cross-site scripting (XSS) vulnerability in the Name of application field found in the General Configuration page in Rukovoditel 2.4. (no CVSS)
- [CVE-2020-18469](https://cve.now/CVE-2020-18469.md): Stored cross-site scripting (XSS) vulnerability in the Copyright Text field found in the Application page under the Configuration menu in Ru (no CVSS)
- [CVE-2020-18468](https://cve.now/CVE-2020-18468.md): Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a c (no CVSS)
- [CVE-2020-18467](https://cve.now/CVE-2020-18467.md): Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via (no CVSS)
- [CVE-2021-36931](https://cve.now/CVE-2021-36931.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 4.4, Microsoft Edge)
- [CVE-2021-36929](https://cve.now/CVE-2021-36929.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2021-36928](https://cve.now/CVE-2021-36928.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.0, Microsoft Edge)
- [CVE-2021-30597](https://cve.now/CVE-2021-30597.md): Use after free in Browser UI in Google Chrome on Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome)
- [CVE-2021-30596](https://cve.now/CVE-2021-30596.md): Incorrect security UI in Navigation in Google Chrome on Android prior to 92.0.4515.131 allowed a remote attacker to spoof the contents of th (no CVSS, Google Chrome)
- [CVE-2021-30594](https://cve.now/CVE-2021-30594.md): Use after free in Page Info UI in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-30593](https://cve.now/CVE-2021-30593.md): Out of bounds read in Tab Strip in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious exte (no CVSS, Google Chrome)
- [CVE-2021-30592](https://cve.now/CVE-2021-30592.md): Out of bounds write in Tab Groups in Google Chrome prior to 92.0.4515.131 allowed an attacker who convinced a user to install a malicious ex (no CVSS, Google Chrome)
- [CVE-2021-30591](https://cve.now/CVE-2021-30591.md): Use after free in File System API in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-30590](https://cve.now/CVE-2021-30590.md): Heap buffer overflow in Bookmarks in Google Chrome prior to 92.0.4515.131 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-40147](https://cve.now/CVE-2021-40147.md): EmTec ZOC before 8.02.2 allows \\e\[201~ pastes, a different vulnerability than CVE-2021-32198. (no CVSS)
- [CVE-2021-32076](https://cve.now/CVE-2021-32076.md): Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass (CVSS 5.3, SolarWinds Web Help Desk)
- [CVE-2021-36352](https://cve.now/CVE-2021-36352.md): Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. (no CVSS)
- [CVE-2021-3734](https://cve.now/CVE-2021-3734.md): Improper Restriction of Rendered UI Layers or Frames in yourls/yourls (CVSS 6.5, yourls/yourls)
- [CVE-2021-38559](https://cve.now/CVE-2021-38559.md): DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter. (no CVSS)
- [CVE-2021-27944](https://cve.now/CVE-2021-27944.md): Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an un (no CVSS)
- [CVE-2020-14160](https://cve.now/CVE-2020-14160.md): An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able t (no CVSS)
- [CVE-2020-14161](https://cve.now/CVE-2020-14161.md): It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint. (no CVSS)
- [CVE-2020-19822](https://cve.now/CVE-2020-19822.md): A remote code execution (RCE) vulnerability in template\_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via th (no CVSS)
- [CVE-2020-19821](https://cve.now/CVE-2020-19821.md): A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders\[\] parameter. (no CVSS)
- [CVE-2020-19705](https://cve.now/CVE-2020-19705.md): thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add. (no CVSS)
- [CVE-2020-19709](https://cve.now/CVE-2020-19709.md): Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload. (no CVSS, feehi/feehicms)
- [CVE-2020-19704](https://cve.now/CVE-2020-19704.md): A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execut (no CVSS)
- [CVE-2020-19703](https://cve.now/CVE-2020-19703.md): A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or H (no CVSS)
- [CVE-2021-20815](https://cve.now/CVE-2021-20815.md): Cross-site scripting vulnerability in Edit Boilerplate screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Mo (no CVSS, Six Apart Movable Type)
- [CVE-2021-20814](https://cve.now/CVE-2021-20814.md): Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type (Movable Type 7 r.4903 and ear (no CVSS, Six Apart Movable Type)
- [CVE-2021-20813](https://cve.now/CVE-2021-20813.md): Cross-site scripting vulnerability in Edit screen of Content Data of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series) (no CVSS, Six Apart Movable Type)
- [CVE-2021-20812](https://cve.now/CVE-2021-20812.md): Cross-site scripting vulnerability in Setting screen of Server Sync of Movable Type (Movable Type Advanced 7 r.4903 and earlier (Movable Typ (no CVSS, Six Apart Movable Type)
- [CVE-2021-20811](https://cve.now/CVE-2021-20811.md): Cross-site scripting vulnerability in List of Assets screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Mova (no CVSS, Six Apart Movable Type)
- [CVE-2021-20810](https://cve.now/CVE-2021-20810.md): Cross-site scripting vulnerability in Website Management screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), (no CVSS, Six Apart Movable Type)
- [CVE-2021-20809](https://cve.now/CVE-2021-20809.md): Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type of Movable Type (Movable Type 7 r.4903 and earlier (Mo (no CVSS, Six Apart Movable Type)
- [CVE-2021-20808](https://cve.now/CVE-2021-20808.md): Cross-site scripting vulnerability in Search screen of Movable Type (Movable Type 7 r.4903 and earlier (Movable Type 7 Series), Movable Type (no CVSS, Six Apart Movable Type)
- [CVE-2021-20793](https://cve.now/CVE-2021-20793.md): Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1. (no CVSS, The installers of multiple Sony products)
- [CVE-2021-40145](https://cve.now/CVE-2021-40145.md): gdImageGd2Ptr in gd\_gd2.c in the GD Graphics Library (aka LibGD) through 2.3.2 has a double free. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.