CVEs published in August 2021
2,473 vulnerabilities, 226 critical, 21 exploited.
- puppet remediateThe mechanism which performs certificate validation was discovered to have a flaw that resulted...7.5 High
- puppet puppetdb, enterprise +1 morePuppetDB logging included potentially sensitive system information.4.3 Medium
- perforce puppet enterprise, puppet enterprise +1 morePuppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.8.8 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) contains a broken access control...7.5 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in...7.5 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) contains a Server Side Request Forgery in...7.5 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read...7.5 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) has insecure object reference...7.2 High
- vmware vrealize operations manager, cloud foundation, vrealize suite lifecycle manager +2 moreThe vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary file read...4.9 Medium
- deltaww diaenergieA Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of...9.8 Critical
- deltaww diaenergieA Blind SQL injection vulnerability exists in the /DataHandler/Handler_CFG.ashx endpoint of Delta...9.8 Critical
- deltaww diaenergieA Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of...9.8 Critical
- deltaww diaenergieA Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of...9.8 Critical
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery,...4.3 Medium
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may...9.8 Critical
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new...9.8 Critical
- deltaww diaenergieDelta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords...5.5 Medium
- deltaww dopsoftA stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and...7.8 High
- openkm document management community, openkm +1 moreOpenKM Document Management Community vulnerable to Cross Site Scripting4.6 Medium
- ibm maximo asset management, maximo application suite +1 moreIBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to stored cross-site scripting. This...6.4 Medium
- ibm sterling secure proxy, sterling external authentication server +1 moreIBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials,...4.9 Medium
- ibm sterling secure proxy, sterling external authentication server +1 moreIBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected...5.9 Medium
- ibm sterling secure proxy, sterling external authentication server +1 moreIBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected...5.9 Medium
- johnson controls cem systems ac2000, johnsoncontrols ac2000 firmware +1 moreCEM Systems AC20008.2 High
- deltaww tpeditorA heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited...7.8 High
com.vaadin:vaadin-bomMavenUnauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-204.3 Medium- indexhibitA reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of...6.1 Medium
- indexhibitA configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files,...8.8 High
- indexhibitA cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to...5.7 Medium
- indexhibitA cross-site request forgery (CSRF) vulnerability in Indexhibit 2.1.5 allows attackers to...6.5 Medium
- indexhibitMultiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2...5.4 Medium
- indexhibitAn issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily...6.5 Medium
- acquia mauticXSS vulnerability on password reset page6.3 Medium
- acquia mauticUse of a Broken or Risky Cryptographic Algorithm3.5 Low
- acquia mauticXSS vulnerability on asset view7.1 High
- acquia mauticXSS vulnerability on contacts view8.3 High
- acquia mauticStored XSS vulnerability on Bounce Management Callback8.2 High
- benq eh600 ota, eh600 firmware +1 moreThe management interface of BenQ smart wireless conference projector does not properly control...8.8 High
- simplygallery simply gallery blocks with lightbox, gallerycreator gallery blocks with lightbox. image gallery, (html5 video , youtube, vimeo) video gallery and lightbox for native gallery +1 moreGallery Blocks with Lightbox < 2.2.1- Authenticated Stored Cross-Site Scripting5.4 Medium
- tipsandtricks-hq wp video lightboxWP Video Lightbox < 1.9.3 - Contributor+ Stored Cross-Site Scripting5.4 Medium
- business hours indicator project hours indicator, unknown business hours indicator +1 moreBusiness Hours Indicator < 2.3.5 - Authenticated Stored XSS5.4 Medium
- andrew lima sitewide notice wp, yoohooplugins sitewide notice +1 moreSitewide Notice WP < 2.3 - Authenticated Stored XSS4.8 Medium
- unknown blue admin, blue-admin project blue-admin +1 moreBlue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)8.8 High
- wow-estore side menu, unknown side menu lite - add sticky fixed buttons +1 moreSide Menu Lite < 2.2.6 - Authenticated SQL Injection8.8 High
- bold-themes bold page builderBold Page Builder < 3.1.6 - PHP Object Injection8.8 High
- wpmanageninja fluentsmtp, unknown fluentsmtp – wordpress mail smtp, ses, sendgrid, mailgun and any smtp plugin +1 moreFluentSMTP < 2.0.1 - Authenticated Stored XSS5.4 Medium
- sharethis dashboard for google analytics, unknown sharethis dashboard for google analytics +1 moreShareThis Dashboard for Google Analytics < 2.5.2 - Reflected Cross-Site Scripting (XSS)6.1 Medium
- realfavicongenerator favicon by realfavicongeneratorFavicon by RealFaviconGenerator <= 1.3.20 - Reflected Cross-Site Scripting (XSS)6.1 Medium
- apache ofbiz, ofbiz-framework +1 moreGeneration of Error Message Containing Sensitive Information in Apache OFBiz6.5 Medium
- govicture pc420 firmware, victure pc420 +1 moreStack-based buffer overflow leading to RCE in Victure Camera9.6 Critical
- Show moreLoading…