LiveActive security incident?Get immediate response
CVE archive

August 2021

Browse CVE records published in August 2021, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEsKnown exploited

Showing 50 of 2044 matching CVEs · Page 8 of 41.

High · CVSS 7.5

CVE-2021-23430: Directory Traversal

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.

Published Aug 24, 2021 · Updated Sep 17, 2024

Medium · CVSS 4.2

CVE-2021-20332: MongoDB Rust Driver may publish events containing authentication-related data to a connection pool event listener configured by an application

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default. This issue affects MongoDB Rust Driver version 2.0.0-alpha, MongoDB Rust Driver version 2.0.0-alpha1 and MongoDB Rust Driver version 1.0.0 through to and including 1.2.1

Published Aug 2, 2021 · Updated Sep 17, 2024

High · CVSS 8.2

CVE-2021-27910: Stored XSS vulnerability on Bounce Management Callback

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user. An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function. The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.

Published Aug 30, 2021 · Updated Sep 17, 2024

Medium · CVSS 4.4

CVE-2021-21562: Dell EMC PowerScale OneFS contains an untrusted search path vulnerability.

Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE) and (ISI_PRIV_SYS_UPGRADE or ISI_PRIV_AUDIT) to provide an untrusted path which can lead to run resources that are not under the application’s direct control.

Published Aug 2, 2021 · Updated Sep 17, 2024

Medium · CVSS 5.3

CVE-2021-32076: Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Published Aug 26, 2021 · Updated Sep 17, 2024

Low · CVSS 3.3

CVE-2021-35991: Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability

Adobe Bridge version 11.0.2 (and earlier) is affected by an Access of Uninitialized Pointer vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 17, 2024

Medium · CVSS 6.3

CVE-2021-39085: IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0...

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 215888.

Published Aug 16, 2022 · Updated Sep 17, 2024

High · CVSS 7.8

CVE-2021-35983: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 17, 2024

Unknown · CVSS Not scored

CVE-2021-46778: Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitec...

Execution unit scheduler contention may lead to a side channel vulnerability found on AMD CPU microarchitectures codenamed “Zen 1”, “Zen 2” and “Zen 3” that use simultaneous multithreading (SMT). By measuring the contention level on scheduler queues an attacker may potentially leak sensitive information.

Published Aug 9, 2022 · Updated Sep 17, 2024

Medium · CVSS 4.3

CVE-2021-25954: Improper Access Control in “Dolibarr”

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint.

Published Aug 9, 2021 · Updated Sep 17, 2024

Medium · CVSS 6

CVE-2021-21595: Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements u...

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.

Published Aug 16, 2021 · Updated Sep 17, 2024

Low · CVSS 3.3

CVE-2021-35988: Adobe Acrobat Pro DC Out-of-Bounds Read Bug

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 17, 2024

High · CVSS 8.8

CVE-2021-37214: Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3

The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.

Published Aug 9, 2021 · Updated Sep 17, 2024

High · CVSS 7.3

CVE-2021-28640: Adobe Acrobat Reader Use-After-Free Arbitrary Code Execution Vulnerability

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 17, 2024

Low · CVSS 3.3

CVE-2021-35987: Adobe Acrobat Pro DC PDFLibTool Out-of-Bound Read

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 17, 2024

Medium · CVSS 6.5

CVE-2021-36802: Akaunting DoS via User-Controlled 'locale' Variable

Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'locale' variable and sending it in an otherwise normal HTTP POST request. This issue was fixed in version 2.1.13 of the product.

Published Aug 4, 2021 · Updated Sep 17, 2024

Medium · CVSS 6.1

CVE-2021-28633: Adobe Creative Cloud Installer Arbitrary File Write

Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Insecure temporary file creation vulnerability. An attacker could leverage this vulnerability to cause arbitrary file overwriting in the context of the current user. Exploitation of this issue requires physical interaction to the system.

Published Aug 24, 2021 · Updated Sep 17, 2024

Medium · CVSS 4.9

CVE-2021-3045: PAN-OS: OS Command Argument Injection in Web Interface

An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.10. PAN-OS 10.0 and later versions are not impacted.

Published Aug 11, 2021 · Updated Sep 16, 2024

Low · CVSS 3.3

CVE-2021-35986: Adobe Acrobat Pro DC getAnnot Type Confusion Information Disclosure Vulnerability

Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Type Confusion vulnerability. An unauthenticated attacker could leverage this vulnerability to read arbitrary system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 20, 2021 · Updated Sep 16, 2024

High · CVSS 7.8

CVE-2021-28552: Adobe Acrobat Reader DC XFA Template Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Aug 24, 2021 · Updated Sep 16, 2024

High · CVSS 8.8

CVE-2021-3050: PAN-OS: OS Command Injection Vulnerability in Web Interface

An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 9.0 version 9.0.10 through PAN-OS 9.0.14; PAN-OS 9.1 version 9.1.4 through PAN-OS 9.1.10; PAN-OS 10.0 version 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through PAN-OS 10.1.1. Prisma Access firewalls and firewalls running PAN-OS 8.1 versions are not impacted by this issue.

Published Aug 11, 2021 · Updated Sep 16, 2024

Critical · CVSS 9.8

CVE-2021-26606: DreamSecurity MagicLine Buffer Overflow Vulnerability

A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficient validation of the authorization certificate. An attacker could exploit this vulnerability by sending a crafted HTTP request an affected program. A successful exploit could allow the attacker to remotely execute arbitrary code on a target system.

Published Aug 6, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.4

CVE-2021-37211: Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.

Published Aug 9, 2021 · Updated Sep 16, 2024