CVEs published August 27, 2021
32 CVEs were published on August 27, 2021: 0 critical, 7 high.
- Published
- 32
- Critical
- 0
- High
- 7
- Medium
- 3
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- xen
- 7
- fiveai Cachet · cachethq/cachet
- 3
- OpenMage magento-lts · openmage/magento-lts
- 2
- simiki
- 2
- IBM Maximo Asset Management
- 1
- mezzanine
- 1
- misskey-dev misskey
- 1
- node-saml passport-saml · passport-saml
- 1
- object-path
- 1
High 7
- CVE-2021-39174Configuration leakfiveai Cachet · cachethq/cachet
- CVE-2021-39173Forced reinstallfiveai Cachet · cachethq/cachet
- CVE-2021-39172New line injection during configuration editionfiveai Cachet · cachethq/cachet
- CVE-2021-32759Data Flow Sanitation Issue FixOpenMage magento-lts · openmage/magento-lts
- CVE-2021-32758Layout XML Arbitrary Code FixOpenMage magento-lts · openmage/magento-lts
- CVE-2021-39169XSS vulnerability using dialogmisskey-dev misskey
- CVE-2021-40142In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefull
Medium, low and unrated 25
- CVE-2021-39171Unlimited transforms allowed for signed nodesnode-saml passport-saml · passport-saml
- CVE-2020-18116A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.
- CVE-2020-18114An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format
- CVE-2020-18106The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.
- CVE-2021-28695IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrxen
- CVE-2021-28696IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrxen
- CVE-2021-28694IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corrxen
- CVE-2021-28697grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory.xen
- CVE-2021-28233Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in ok_jpg.c.
- CVE-2021-28698long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domaxen
- CVE-2021-28699inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status.xen
- CVE-2020-19002Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componenmezzanine
- CVE-2020-19000Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simisimiki
- CVE-2020-19001Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'sisimiki
- CVE-2020-18999Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'.
- CVE-2020-18998Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/
- CVE-2021-28700xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly frxen
- CVE-2021-3264SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.
- CVE-2021-23434Prototype Pollutionobject-path
- CVE-2021-36530ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking t
- CVE-2021-36531ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the bou
- CVE-2021-29744IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting.IBM Maximo Asset Management
- CVE-2021-35342The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x befo
- CVE-2020-23226Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.php, (3) data_input.ph
- CVE-2021-40153squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create