# CVEs published 2021-08-30

88 CVEs were published on August 30, 2021: 6 critical, 13 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-39178](https://cve.now/CVE-2021-39178.md): XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0 (CVSS 7.5, vercel next.js · next)
- [CVE-2021-39177](https://cve.now/CVE-2021-39177.md): User impersonation due to incorrect handling of the login JWT (CVSS 7.4, GeyserMC Geyser · org.geysermc:connector)
- [CVE-2020-22848](https://cve.now/CVE-2020-22848.md): A remote code execution (RCE) vulnerability in the \\Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands. (no CVSS)
- [CVE-2021-32832](https://cve.now/CVE-2021-32832.md): ReDOS in Rocket.Chat (CVSS 4.3, RocketChat Rocket.Chat)
- [CVE-2021-32831](https://cve.now/CVE-2021-32831.md): Code injection in total.js (CVSS 7.5, totaljs framework · total.js)
- [CVE-2021-39175](https://cve.now/CVE-2021-39175.md): XSS vector in slide mode speaker-view (CVSS 8.1, hedgedoc)
- [CVE-2021-36692](https://cve.now/CVE-2021-36692.md): libjxl v0.3.7 is affected by a Divide By Zero in issue in lib/extras/codec\_apng.cc jxl::DecodeImageAPNG(). (no CVSS)
- [CVE-2021-36691](https://cve.now/CVE-2021-36691.md): libjxl v0.5.0 is affected by a Assertion failed issue in lib/jxl/image.cc jxl::PlaneBase::PlaneBase(). (no CVSS)
- [CVE-2021-39133](https://cve.now/CVE-2021-39133.md): Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server (CVSS 7.2, rundeck · org.rundeck:rundeck-core)
- [CVE-2021-39132](https://cve.now/CVE-2021-39132.md): YAML deserialization can run untrusted code (CVSS 8.8, rundeck · org.rundeck:rundeck-core)
- [CVE-2021-35062](https://cve.now/CVE-2021-35062.md): A Shell Metacharacter Injection vulnerability in result.php in DRK Odenwaldkreis Testerfassung March-2021 allow an attacker with a valid tok (no CVSS)
- [CVE-2021-35061](https://cve.now/CVE-2021-35061.md): Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary (no CVSS)
- [CVE-2021-36370](https://cve.now/CVE-2021-36370.md): An issue was discovered in Midnight Commander through 4.8.26. (no CVSS)
- [CVE-2021-34066](https://cve.now/CVE-2021-34066.md): An issue was discovered in EdgeGallery/developer before v1.0. (no CVSS)
- [CVE-2021-37421](https://cve.now/CVE-2021-37421.md): Zoho ManageEngine ADSelfService Plus 6103 and prior is vulnerable to admin portal access-restriction bypass. (no CVSS)
- [CVE-2021-37417](https://cve.now/CVE-2021-37417.md): Zoho ManageEngine ADSelfService Plus version 6103 and prior allows CAPTCHA bypass due to improper parameter validation. (no CVSS)
- [CVE-2021-37416](https://cve.now/CVE-2021-37416.md): Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page. (no CVSS)
- [CVE-2021-33055](https://cve.now/CVE-2021-33055.md): Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. (no CVSS)
- [CVE-2021-22021](https://cve.now/CVE-2021-22021.md): VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. (no CVSS, VMware vRealize Log Insight)
- [CVE-2021-38342](https://cve.now/CVE-2021-38342.md): Nested Pages \<= 3.1.15 Cross-Site Request Forgery to Arbitrary Post Deletion and Modification (CVSS 8.1, Kyle Phillips Nested Pages)
- [CVE-2021-38343](https://cve.now/CVE-2021-38343.md): Nested Pages \<= 3.1.15 Open Redirect (CVSS 4.7, Kyle Phillips Nested Pages)
- [CVE-2021-34646](https://cve.now/CVE-2021-34646.md): Booster for WooCommerce \<= 5.4.3 Authentication Bypass (CVSS 9.8, Pluggabl Booster for WooCommcerce)
- [CVE-2021-34668](https://cve.now/CVE-2021-34668.md): WordPress Real Media Library \<= 4.14.1 Author-only Stored Cross-Site Scripting (CVSS 6.4, devowl.io WordPress Real Media Library)
- [CVE-2021-29630](https://cve.now/CVE-2021-29630.md): In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9, 12.2-STABLE before r370383, 11.4-STABLE before r370381, 13.0-RELEASE before p4, 12.2-REL (no CVSS, FreeBSD)
- [CVE-2021-29631](https://cve.now/CVE-2021-29631.md): In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-REL (no CVSS, FreeBSD)
- [CVE-2021-27018](https://cve.now/CVE-2021-27018.md): The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certif (no CVSS, Puppet Remediate)
- [CVE-2021-27019](https://cve.now/CVE-2021-27019.md): PuppetDB logging included potentially sensitive system information. (no CVSS, PuppetDB, Puppet Enterprise)
- [CVE-2021-27020](https://cve.now/CVE-2021-27020.md): Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. (no CVSS, Puppet Enterprise)
- [CVE-2021-22025](https://cve.now/CVE-2021-22025.md): The vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control vulnerability leading to unauthenticated API access. (no CVSS, VMware vRealize Operations)
- [CVE-2021-22026](https://cve.now/CVE-2021-22026.md): The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. (no CVSS, VMware vRealize Operations)
- [CVE-2021-22027](https://cve.now/CVE-2021-22027.md): The vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in an end point. (no CVSS, VMware vRealize Operations)
- [CVE-2021-22024](https://cve.now/CVE-2021-22024.md): The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. (no CVSS, VMware vRealize Operations)
- [CVE-2021-22023](https://cve.now/CVE-2021-22023.md): The vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference vulnerability. (no CVSS, VMware vRealize Operations)
- [CVE-2021-22022](https://cve.now/CVE-2021-22022.md): The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read vulnerability. (no CVSS, VMware vRealize Operations)
- [CVE-2021-38390](https://cve.now/CVE-2021-38390.md): A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-32983](https://cve.now/CVE-2021-32983.md): A Blind SQL injection vulnerability exists in the /DataHandler/Handler\_CFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and p (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-38393](https://cve.now/CVE-2021-38393.md): A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-38391](https://cve.now/CVE-2021-38391.md): A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM\_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-32991](https://cve.now/CVE-2021-32991.md): Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a use (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-32955](https://cve.now/CVE-2021-32955.md): Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code. (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-32967](https://cve.now/CVE-2021-32967.md): Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or a (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-33003](https://cve.now/CVE-2021-33003.md): Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorith (no CVSS, Delta Electronics DIAEnergie)
- [CVE-2021-33019](https://cve.now/CVE-2021-33019.md): A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a speciall (no CVSS, Delta Electronics DOPSoft)
- [CVE-2021-3628](https://cve.now/CVE-2021-3628.md): OpenKM Document Management Community vulnerable to Cross Site Scripting (CVSS 4.6, OpenKM Document Management Community)
- [CVE-2021-29743](https://cve.now/CVE-2021-29743.md): IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Maximo Asset Management)
- [CVE-2021-29728](https://cve.now/CVE-2021-29728.md): IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which (CVSS 4.9, IBM Sterling Secure Proxy)
- [CVE-2021-29723](https://cve.now/CVE-2021-29723.md): IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker (CVSS 5.9, IBM Sterling Secure Proxy)
- [CVE-2021-29722](https://cve.now/CVE-2021-29722.md): IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker (CVSS 5.9, IBM Sterling Secure Proxy)
- [CVE-2021-27663](https://cve.now/CVE-2021-27663.md): CEM Systems AC2000 (CVSS 8.2, Johnson Controls CEM Systems AC2000)
- [CVE-2021-33007](https://cve.now/CVE-2021-33007.md): A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project fi (no CVSS, Delta Electronics TPEditor)
- [CVE-2020-18125](https://cve.now/CVE-2020-18125.md): A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbit (no CVSS)
- [CVE-2020-18121](https://cve.now/CVE-2020-18121.md): A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell. (no CVSS)
- [CVE-2020-18124](https://cve.now/CVE-2020-18124.md): A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily reset account passwords. (no CVSS)
- [CVE-2020-18123](https://cve.now/CVE-2020-18123.md): A cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to arbitrarily delete admin accounts. (no CVSS)
- [CVE-2020-18126](https://cve.now/CVE-2020-18126.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary (no CVSS)
- [CVE-2020-18127](https://cve.now/CVE-2020-18127.md): An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files. (no CVSS)
- [CVE-2021-27909](https://cve.now/CVE-2021-27909.md): XSS vulnerability on password reset page (CVSS 6.3, Mautic · mautic/core)
- [CVE-2021-27913](https://cve.now/CVE-2021-27913.md): Use of a Broken or Risky Cryptographic Algorithm (CVSS 3.5, Mautic · mautic/core)
- [CVE-2021-27912](https://cve.now/CVE-2021-27912.md): XSS vulnerability on asset view (CVSS 7.1, Mautic · mautic/core)
- [CVE-2021-27911](https://cve.now/CVE-2021-27911.md): XSS vulnerability on contacts view (CVSS 8.3, Mautic · mautic/core)
- [CVE-2021-27910](https://cve.now/CVE-2021-27910.md): Stored XSS vulnerability on Bounce Management Callback (CVSS 8.2, Mautic · mautic/core)
- [CVE-2021-37911](https://cve.now/CVE-2021-37911.md): The management interface of BenQ smart wireless conference projector does not properly control user's privilege. (CVSS 8.8, BenQ EH600 OTA)
- [CVE-2021-24667](https://cve.now/CVE-2021-24667.md): Gallery Blocks with Lightbox \< 2.2.1- Authenticated Stored Cross-Site Scripting (no CVSS, Gallery Blocks with Lightbox. Image Gallery, (HTML5 video ,…)
- [CVE-2021-24665](https://cve.now/CVE-2021-24665.md): WP Video Lightbox \< 1.9.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, WP Video Lightbox)
- [CVE-2021-24593](https://cve.now/CVE-2021-24593.md): Business Hours Indicator \< 2.3.5 - Authenticated Stored XSS (no CVSS, Business Hours Indicator)
- [CVE-2021-24592](https://cve.now/CVE-2021-24592.md): Sitewide Notice WP \< 2.3 - Authenticated Stored XSS (no CVSS, Sitewide Notice WP)
- [CVE-2021-24581](https://cve.now/CVE-2021-24581.md): Blue Admin \<= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, Blue Admin)
- [CVE-2021-24580](https://cve.now/CVE-2021-24580.md): Side Menu Lite \< 2.2.6 - Authenticated SQL Injection (no CVSS, Side Menu Lite - add sticky fixed buttons)
- [CVE-2021-24579](https://cve.now/CVE-2021-24579.md): Bold Page Builder \< 3.1.6 - PHP Object Injection (no CVSS, Bold Page Builder)
- [CVE-2021-24528](https://cve.now/CVE-2021-24528.md): FluentSMTP \< 2.0.1 - Authenticated Stored XSS (no CVSS, FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun an…)
- [CVE-2021-24438](https://cve.now/CVE-2021-24438.md): ShareThis Dashboard for Google Analytics \< 2.5.2 - Reflected Cross-Site Scripting (XSS) (no CVSS, ShareThis Dashboard for Google Analytics)
- [CVE-2021-24437](https://cve.now/CVE-2021-24437.md): Favicon by RealFaviconGenerator \<= 1.3.20 - Reflected Cross-Site Scripting (XSS) (no CVSS, Favicon by RealFaviconGenerator)
- [CVE-2021-25958](https://cve.now/CVE-2021-25958.md): Generation of Error Message Containing Sensitive Information in Apache OFBiz (CVSS 6.5, apache ofbiz-framework)
- [CVE-2020-15744](https://cve.now/CVE-2020-15744.md): Stack-based buffer overflow leading to RCE in Victure Camera (CVSS 9.6, Victure PC420)
- [CVE-2021-39117](https://cve.now/CVE-2021-39117.md): The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-39113](https://cve.now/CVE-2021-39113.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to continue to view cached content even after lo (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-39111](https://cve.now/CVE-2021-39111.md): The Editor plugin in Atlassian Jira Server and Data Center before version 8.5.18, from 8.6.0 before 8.13.10, and from version 8.14.0 before (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-26084](https://cve.now/CVE-2021-26084.md): In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack (CVSS 9.8, KEV, Atlassian Confluence Server · Atlassian Confluence Data Cen…)
- [CVE-2021-39272](https://cve.now/CVE-2021-39272.md): Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUT (no CVSS)
- [CVE-2021-39271](https://cve.now/CVE-2021-39271.md): OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python c (no CVSS)
- [CVE-2021-36359](https://cve.now/CVE-2021-36359.md): OrbiTeam BSCW Classic before 7.4.3 allows exportpdf authenticated remote code execution (RCE) via XML tag injection because reportlab\\platyp (no CVSS)
- [CVE-2021-37749](https://cve.now/CVE-2021-37749.md): MapService.svc in Hexagon GeoMedia WebMap 2020 before Update 2 (aka 16.6.2.66) allows blind SQL Injection via the Id (within sourceItems) pa (no CVSS)
- [CVE-2020-35633](https://cve.now/CVE-2020-35633.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project)
- [CVE-2020-35634](https://cve.now/CVE-2020-35634.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. (CVSS 10.0, CGAL Project)
- [CVE-2020-35635](https://cve.now/CVE-2020-35635.md): A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef\_S2/SNC\_io\_parser.h SNC\_io\_p (CVSS 10.0, CGAL Project)
- [CVE-2021-21741](https://cve.now/CVE-2021-21741.md): There is a command execution vulnerability in a ZTE conference management system. (no CVSS, ZXV10 M910)
- [CVE-2021-34434](https://cve.now/CVE-2021-34434.md): In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a (no CVSS, The Eclipse Foundation Eclipse Mosquitto)
- [CVE-2021-38385](https://cve.now/CVE-2021-38385.md): Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verificatio (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.