# CVEs published 2021-08-29

8 CVEs were published on August 29, 2021: 0 critical, 0 high. Days are UTC.

- [CVE-2021-40172](https://cve.now/CVE-2021-40172.md): Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings. (no CVSS)
- [CVE-2021-40173](https://cve.now/CVE-2021-40173.md): Zoho ManageEngine Cloud Security Plus before Build 4117 allows a CSRF attack on the server proxy settings. (no CVSS)
- [CVE-2021-40174](https://cve.now/CVE-2021-40174.md): Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings. (no CVSS)
- [CVE-2021-40175](https://cve.now/CVE-2021-40175.md): Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. (no CVSS)
- [CVE-2021-40176](https://cve.now/CVE-2021-40176.md): Zoho ManageEngine Log360 before Build 5225 allows stored XSS. (no CVSS)
- [CVE-2021-40177](https://cve.now/CVE-2021-40177.md): Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. (no CVSS)
- [CVE-2021-40178](https://cve.now/CVE-2021-40178.md): Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO\_PATH key value in the logon settings. (no CVSS)
- [CVE-2021-38154](https://cve.now/CVE-2021-38154.md): Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.