CVEs published September 17, 2021
50 CVEs were published on September 17, 2021: 2 critical, 16 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 2
- High
- 16
- Medium
- 9
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- bytecodealliance wasmtime · wasmtime
- 3
- Delta Electronics DOPSoft
- 3
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 3
- J’s Communication Co. RevoWorks Browser
- 2
- McAfee Endpoint Security (ENS) for WIndows
- 2
- pi-hole/adminlte
- 2
- @cookiex/deep
- 1
- ActiveFusions Co. Order Status Batch Change Plug-in
- 1
- AITpro BulletProof Security
- 1
- Apache Software Foundation Apache Shiro · org.apache.shiro:…
- 1
Critical 2
High 16
- CVE-2021-38404Delta Electronics DOPSoft 2 Heap-based Buffer OverflowDelta Electronics DOPSoft
- CVE-2021-38402Delta Electronics DOPSoft 2 Stack-Based Buffer OverflowDelta Electronics DOPSoft
- CVE-2021-38406Delta Electronics DOPSoft 2 Out-of-Bounds WriteDelta Electronics DOPSoft
- CVE-2021-31844Local Privilege Escalation in McAfee DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLP) Endpoint for Windows
- CVE-2021-31845Remote Code Execution in McAfee DLP DiscoverMcAfee Data Loss Prevention (DLP) Discover
- CVE-2021-31843Improper access control vulnerability in McAfee ENS for WindowsMcAfee Endpoint Security (ENS) for WIndows
- CVE-2021-23442Prototype Pollution@cookiex/deep
- CVE-2021-30261Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in…Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2021-30260Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1947Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon…Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2021-1939Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto…Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-3810Inefficient Regular Expression Complexity in cdr/code-servercdr/code-server · code-server
- CVE-2021-3804Inefficient Regular Expression Complexity in nervjs/taronervjs/taro · @tarojs/helper
- CVE-2021-3803Inefficient Regular Expression Complexity in fb55/nth-checkfb55/nth-check · nth-check
- CVE-2021-3805Prototype Pollution in mariocasciaro/object-pathmariocasciaro/object-path · object-path
- CVE-2021-3807Inefficient Regular Expression Complexity in chalk/ansi-regexchalk/ansi-regex · ansi-regex
Medium, low and unrated 32
- CVE-2021-41392static/main-preload.js in Boost Note through 0.22.0 allows remote command execution.
- CVE-2021-41391In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored…
- CVE-2021-41390In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV…
- CVE-2021-41387seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.
- CVE-2020-21548Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.
- CVE-2020-21547Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.
- CVE-2021-39218Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtimebytecodealliance wasmtime · wasmtime
- CVE-2021-39219Wrong type for `Linker`-define functions when used across two `Engine`sbytecodealliance wasmtime · wasmtime
- CVE-2021-39216Use after free passing `externref`s to Wasm in Wasmtimebytecodealliance wasmtime · wasmtime
- CVE-2021-41383setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server…
- CVE-2021-41380RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data.
- CVE-2020-12083An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
- CVE-2020-12082A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1…
- CVE-2020-12080A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6.
- CVE-2021-40825nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability.
- CVE-2021-38304Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to…
- CVE-2019-9060An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2021-41317XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
- CVE-2021-41315The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility.
- CVE-2021-41316The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility.
- CVE-2021-39227Fix prototype pollution in the zrender merge and clone helper methodsecomfe zrender · zrender
- CVE-2021-39228Memory Safety Issue when using patch or merge on state and assign the result back to statetremor-rs tremor-runtime · tremor-script
- CVE-2021-31842XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a…McAfee Endpoint Security (ENS) for WIndows
- CVE-2021-39327BulletProof Security <= 5.1 Sensitive Information DisclosureAITpro BulletProof Security
- CVE-2021-41303Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassApache Software Foundation Apache Shiro · org.apache.shiro:…
Show all 32 entriesShow fewer entries
- CVE-2021-3812Cross-site Scripting (XSS) - Reflected in pi-hole/adminltepi-hole/adminlte
- CVE-2021-3811Cross-site Scripting (XSS) - Reflected in pi-hole/adminltepi-hole/adminlte
- CVE-2021-20828Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to…ActiveFusions Co. Order Status Batch Change Plug-in
- CVE-2021-20825Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a…shiro8 Co. List (order management) item change plug-in
- CVE-2021-20791Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access restriction and to…J’s Communication Co. RevoWorks Browser
- CVE-2021-20790Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary…J’s Communication Co. RevoWorks Browser
- CVE-2021-41326In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.