# CVEs published 2021-08-27

32 CVEs were published on August 27, 2021: 0 critical, 7 high. Days are UTC.

- [CVE-2021-39174](https://cve.now/CVE-2021-39174.md): Configuration leak (CVSS 8.8, fiveai Cachet · cachethq/cachet)
- [CVE-2021-39173](https://cve.now/CVE-2021-39173.md): Forced reinstall (CVSS 8.8, fiveai Cachet · cachethq/cachet)
- [CVE-2021-39172](https://cve.now/CVE-2021-39172.md): New line injection during configuration edition (CVSS 8.8, fiveai Cachet · cachethq/cachet)
- [CVE-2021-39171](https://cve.now/CVE-2021-39171.md): Unlimited transforms allowed for signed nodes (CVSS 5.3, node-saml passport-saml · passport-saml)
- [CVE-2021-32759](https://cve.now/CVE-2021-32759.md): Data Flow Sanitation Issue Fix (CVSS 7.2, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2020-18116](https://cve.now/CVE-2020-18116.md): A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection. (no CVSS)
- [CVE-2020-18114](https://cve.now/CVE-2020-18114.md): An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format (no CVSS)
- [CVE-2020-18106](https://cve.now/CVE-2020-18106.md): The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection. (no CVSS)
- [CVE-2021-28695](https://cve.now/CVE-2021-28695.md): IOMMU page mapping issues on x86 T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr (no CVSS, xen)
- [CVE-2021-28696](https://cve.now/CVE-2021-28696.md): IOMMU page mapping issues on x86 T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr (no CVSS, xen)
- [CVE-2021-28694](https://cve.now/CVE-2021-28694.md): IOMMU page mapping issues on x86 T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr (no CVSS, xen)
- [CVE-2021-28697](https://cve.now/CVE-2021-28697.md): grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. (no CVSS, xen)
- [CVE-2021-28233](https://cve.now/CVE-2021-28233.md): Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok\_jpg\_generate\_huffman\_table function in ok\_jpg.c. (no CVSS)
- [CVE-2021-28698](https://cve.now/CVE-2021-28698.md): long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a doma (no CVSS, xen)
- [CVE-2021-28699](https://cve.now/CVE-2021-28699.md): inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. (no CVSS, xen)
- [CVE-2020-19002](https://cve.now/CVE-2020-19002.md): Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componen (no CVSS, mezzanine)
- [CVE-2020-19000](https://cve.now/CVE-2020-19000.md): Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simi (no CVSS, simiki)
- [CVE-2020-19001](https://cve.now/CVE-2020-19001.md): Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'si (no CVSS, simiki)
- [CVE-2020-18999](https://cve.now/CVE-2020-18999.md): Cross Site Scripting (XSS) in Blog\_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'. (no CVSS)
- [CVE-2020-18998](https://cve.now/CVE-2020-18998.md): Cross Site Scripting (XSS) in Blog\_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/ (no CVSS)
- [CVE-2021-28700](https://cve.now/CVE-2021-28700.md): xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly fr (no CVSS, xen)
- [CVE-2021-3264](https://cve.now/CVE-2021-3264.md): SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php. (no CVSS)
- [CVE-2021-32758](https://cve.now/CVE-2021-32758.md): Layout XML Arbitrary Code Fix (CVSS 7.2, OpenMage magento-lts · openmage/magento-lts)
- [CVE-2021-23434](https://cve.now/CVE-2021-23434.md): Prototype Pollution (CVSS 5.6, object-path)
- [CVE-2021-36530](https://cve.now/CVE-2021-36530.md): ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB\_NO\_FILE mode, GetByteStr() copy memory buffer without checking t (no CVSS)
- [CVE-2021-36531](https://cve.now/CVE-2021-36531.md): ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB\_NO\_FILE mode, GetByte() reads memory buffer without checking the bou (no CVSS)
- [CVE-2021-29744](https://cve.now/CVE-2021-29744.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Maximo Asset Management)
- [CVE-2021-39169](https://cve.now/CVE-2021-39169.md): XSS vulnerability using dialog (CVSS 8.0, misskey-dev misskey)
- [CVE-2021-35342](https://cve.now/CVE-2021-35342.md): The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender Enterprise 2.6.x befo (no CVSS)
- [CVE-2021-40142](https://cve.now/CVE-2021-40142.md): In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefull (CVSS 7.5)
- [CVE-2020-23226](https://cve.now/CVE-2020-23226.md): Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports\_admin.php, (2) data\_queries.php, (3) data\_input.ph (no CVSS)
- [CVE-2021-40153](https://cve.now/CVE-2021-40153.md): squashfs\_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.