CVEs published August 30, 2021
88 CVEs were published on August 30, 2021: 6 critical, 13 high. 1 is now in CISA KEV.
- Published
- 88
- Critical
- 6
- High
- 13
- Medium
- 10
- Low
- 1
- Unrated
- 58
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- Delta Electronics DIAEnergie
- 8
- VMware vRealize Operations
- 6
- Mautic · mautic/core
- 5
- Atlassian Jira Server · Atlassian Jira Data Center
- 3
- CGAL Project
- 3
- IBM Sterling Secure Proxy
- 3
- FreeBSD
- 2
- Kyle Phillips Nested Pages
- 2
- rundeck · org.rundeck:rundeck-core
- 2
- apache ofbiz-framework
- 1
Critical 6
- CVE-2021-34646Booster for WooCommerce <= 5.4.3 Authentication BypassPluggabl Booster for WooCommcerce
- CVE-2020-15744Stack-based buffer overflow leading to RCE in Victure CameraVicture PC420
- CVE-2021-26084In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attackAtlassian Confluence Server · Atlassian Confluence Data Cen…
- CVE-2020-35633A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.CGAL Project
- CVE-2020-35634A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1.CGAL Project
- CVE-2020-35635A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pCGAL Project
High 13
- CVE-2021-39178XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0vercel next.js · next
- CVE-2021-39177User impersonation due to incorrect handling of the login JWTGeyserMC Geyser · org.geysermc:connector
- CVE-2021-32831Code injection in total.jstotaljs framework · total.js
- CVE-2021-39175XSS vector in slide mode speaker-viewhedgedoc
- CVE-2021-39133Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck serverrundeck · org.rundeck:rundeck-core
- CVE-2021-39132YAML deserialization can run untrusted coderundeck · org.rundeck:rundeck-core
- CVE-2021-38342Nested Pages <= 3.1.15 Cross-Site Request Forgery to Arbitrary Post Deletion and ModificationKyle Phillips Nested Pages
- CVE-2021-27663CEM Systems AC2000Johnson Controls CEM Systems AC2000
- CVE-2021-27912XSS vulnerability on asset viewMautic · mautic/core
- CVE-2021-27911XSS vulnerability on contacts viewMautic · mautic/core
- CVE-2021-27910Stored XSS vulnerability on Bounce Management CallbackMautic · mautic/core
- CVE-2021-37911The management interface of BenQ smart wireless conference projector does not properly control user's privilege.BenQ EH600 OTA
- CVE-2021-39113Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after loAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 69
- CVE-2020-22848A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands.
- CVE-2021-32832ReDOS in Rocket.ChatRocketChat Rocket.Chat
- CVE-2021-36692libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec_apng.cc jxl::DecodeImageAPNG().
- CVE-2021-36691libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase().
- CVE-2021-35062A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid tok
- CVE-2021-35061Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary
- CVE-2021-36370An issue was discovered in Midnight Commander through 4.8.26.
- CVE-2021-34066An issue was discovered in EdgeGallery/developer before v1.0.
- CVE-2021-37421Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass.
- CVE-2021-37417Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation.
- CVE-2021-37416Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.
- CVE-2021-33055Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions.
- CVE-2021-22021VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation.VMware vRealize Log Insight
- CVE-2021-38343Nested Pages <= 3.1.15 Open RedirectKyle Phillips Nested Pages
- CVE-2021-34668WordPress Real Media Library <= 4.14.1 Author-only Stored Cross-Site Scriptingdevowl.io WordPress Real Media Library
- CVE-2021-29630In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-RELFreeBSD
- CVE-2021-29631In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELFreeBSD
- CVE-2021-27018The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certifPuppet Remediate
- CVE-2021-27019PuppetDB logging included potentially sensitive system information.PuppetDB, Puppet Enterprise
- CVE-2021-27020Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.Puppet Enterprise
- CVE-2021-22025The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access.VMware vRealize Operations
- CVE-2021-22026The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point.VMware vRealize Operations
- CVE-2021-22027The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point.VMware vRealize Operations
- CVE-2021-22024The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability.VMware vRealize Operations
- CVE-2021-22023The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability.VMware vRealize Operations
- CVE-2021-22022The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability.VMware vRealize Operations
- CVE-2021-38390A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5Delta Electronics DIAEnergie
- CVE-2021-32983A Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and pDelta Electronics DIAEnergie
- CVE-2021-38393A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5Delta Electronics DIAEnergie
- CVE-2021-38391A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 andDelta Electronics DIAEnergie
- CVE-2021-32991Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a useDelta Electronics DIAEnergie
- CVE-2021-32955Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code.Delta Electronics DIAEnergie
- CVE-2021-32967Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or aDelta Electronics DIAEnergie
- CVE-2021-33003Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithDelta Electronics DIAEnergie
- CVE-2021-33019A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a speciallDelta Electronics DOPSoft
- CVE-2021-3628OpenKM Document Management Community vulnerable to Cross Site ScriptingOpenKM Document Management Community
- CVE-2021-29743IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting.IBM Maximo Asset Management
- CVE-2021-29728IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, whichIBM Sterling Secure Proxy
- CVE-2021-29723IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attackerIBM Sterling Secure Proxy
- CVE-2021-29722IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attackerIBM Sterling Secure Proxy
- CVE-2021-33007A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project fiDelta Electronics TPEditor
- CVE-2020-18125A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbit
- CVE-2020-18121A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.
- CVE-2020-18124A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords.
- CVE-2020-18123A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts.
- CVE-2020-18126Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary
- CVE-2020-18127An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
- CVE-2021-27909XSS vulnerability on password reset pageMautic · mautic/core
- CVE-2021-27913Use of a Broken or Risky Cryptographic AlgorithmMautic · mautic/core
- CVE-2021-24667Gallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site ScriptingGallery Blocks with Lightbox. Image Gallery, (HTML5 video ,…
- CVE-2021-24665WP Video Lightbox < 1.9.3 - Contributor+ Stored Cross-Site ScriptingWP Video Lightbox
- CVE-2021-24593Business Hours Indicator < 2.3.5 - Authenticated Stored XSSBusiness Hours Indicator
- CVE-2021-24592Sitewide Notice WP < 2.3 - Authenticated Stored XSSSitewide Notice WP
- CVE-2021-24581Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)Blue Admin
- CVE-2021-24580Side Menu Lite < 2.2.6 - Authenticated SQL InjectionSide Menu Lite - add sticky fixed buttons
- CVE-2021-24579Bold Page Builder < 3.1.6 - PHP Object InjectionBold Page Builder
- CVE-2021-24528FluentSMTP < 2.0.1 - Authenticated Stored XSSFluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun an…
- CVE-2021-24438ShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)ShareThis Dashboard for Google Analytics
- CVE-2021-24437Favicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)Favicon by RealFaviconGenerator
- CVE-2021-25958Generation of Error Message Containing Sensitive Information in Apache OFBizapache ofbiz-framework
- CVE-2021-39117The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-39111The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-39272Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUT
- CVE-2021-39271OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python c
- CVE-2021-36359OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\platyp
- CVE-2021-37749MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) pa
- CVE-2021-21741There is a command execution vulnerability in a ZTE conference management system.ZXV10 M910
- CVE-2021-34434In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a The Eclipse Foundation Eclipse Mosquitto
- CVE-2021-38385Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verificatio