CVEs published September 1, 2021
115 CVEs were published on September 1, 2021: 14 critical, 40 high. 1 is now in CISA KEV.
- Published
- 115
- Critical
- 14
- High
- 40
- Medium
- 24
- Low
- 5
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Adobe Magento Commerce · magento/project-community-editi… +1
- 22
- Adobe Bridge
- 16
- Adobe XMP Toolkit
- 14
- Adobe Connect
- 3
- IBM Planning Analytics Local
- 3
- Adobe Photoshop
- 2
- Amazon Kindle e-reader
- 2
- elFinder.NetCore
- 2
- pimcore · pimcore/pimcore
- 2
- SolarWinds Orion Platform
- 2
Critical 14
- CVE-2021-39185Default CORS config allows any origin with credentialshttp4s · org.http4s:http4s-server_2.13.0-M5 +5
- CVE-2021-36042Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36041Magento Commerce Improper Input Validation Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36040Magento Commerce Improper Input Validation Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36025Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36035Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code ExecutionAdobe Magento Commerce
- CVE-2021-36024Magento Commerce Improper Neutralization of Special Elements Used In A CommandAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36029Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36028Magento Commerce XML Injection Vulnerability Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36034Magento Commerce Improper Input Validation Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36022Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36033Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2020-9002An issue was discovered in iPortalis iCS 7.1.13.0.
- CVE-2021-37415Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio
High 40
- CVE-2021-39115Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to exAtlassian Jira Service Desk Server · Atlassian Jira Service…
- CVE-2021-39181Unsafe Deserialization of User Data Using XStreamOpenOLAT
- CVE-2021-39817Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36079Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2021-36075Adobe Bridge Buffer Overflow leads to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36073Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2021-39847XMP Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36078Adobe Bridge PDF File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2021-39816Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36076Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36069Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36067Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36065Adobe Photoshop Heap-Based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe Photoshop
- CVE-2021-36072Adobe Bridge SGI File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2021-36070Adobe Media Encoder Improper Memory Access When Parsing SVG Files Could Lead To Remote Code ExecutionAdobe Media Encoder
- CVE-2021-36066Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop
- CVE-2021-36068Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36064XMP Toolkit SDK SVG_Adapter ParseFullNS Buffer UnderflowAdobe XMP Toolkit
- CVE-2021-36059Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36055XMP Toolkit SDK Use After Free Vulnerability In ReadingXMPNewDOM Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36052XMPToolkit SDK ImportTIFF_CheckStandardMapping Memory CorruptionAdobe XMP Toolkit
- CVE-2021-36050XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36044Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of ServiceAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36048XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36047XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36049Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-36043Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36046XMP Toolkit SDK TIFF_MemoryReader::SortIFD function Memory CorruptionAdobe XMP Toolkit
- CVE-2021-36030Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege EscalationAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36020Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36031Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code ExecutionAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-23427Arbitrary File Write via Archive Extraction (Zip Slip)elFinder.NetCore
- CVE-2021-23428Directory TraversalelFinder.NetCore
- CVE-2021-36032Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege EscalationAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-35218Chart Endpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Patch Manager
- CVE-2021-35216Deserialization of Untrusted Data in Resource Controls Remote Code ExecutionSolarWinds Patch Manager
- CVE-2021-35215ActionPluginBaseView Deserialization of Untrusted Data RCESolarWinds Orion Platform
- CVE-2021-39170Improper Encoding or Escaping of Output in Asset Metadata Componentpimcore · pimcore/pimcore
- CVE-2021-39166Improper Neutralization of Text-Values in Object Version Previewpimcore · pimcore/pimcore
- CVE-2021-39109The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traAtlassian Atlasboard · atlasboard
Medium, low and unrated 61
- CVE-2021-31797The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading
- CVE-2021-39119Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2020-20349WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module.
- CVE-2020-20347WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module.
- CVE-2020-20348WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module.
- CVE-2020-20345WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain
- CVE-2020-20344WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module
- CVE-2020-20343WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attacke
- CVE-2021-40385An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2.
- CVE-2021-40387An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2.
- CVE-2021-39186Improper Input Validation in GlobalNewFilesmiraheze GlobalNewFiles
- CVE-2020-20341YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.
- CVE-2020-20340A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database infor
- CVE-2021-23438Prototype Pollutionmpath
- CVE-2021-30355Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privilegeAmazon Kindle e-reader
- CVE-2021-30354Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in funcAmazon Kindle e-reader
- CVE-2021-23436Prototype Pollutionimmer
- CVE-2021-34435In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.The Eclipse Foundation Eclipse Theia · @theia/mini-browser
- CVE-2021-40379An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.
- CVE-2021-40380An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.
- CVE-2021-40381An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.
- CVE-2021-40382An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.
- CVE-2021-40378An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.
- CVE-2021-29853IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some meIBM Planning Analytics Local
- CVE-2021-29852IBM Planning Analytics 2.0 is vulnerable to cross-site scripting.IBM Planning Analytics Local
- CVE-2021-29851IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.IBM Planning Analytics Local
- CVE-2021-36077Adobe Bridge SVG File Memory Corruption Could Lead To Application Denial Of ServiceAdobe Bridge
- CVE-2021-36071Adobe Bridge PNG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-36074Adobe Bridge PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-36063Adobe Connect Reflected Cross-site Scripting via 'isTabletDeviceHTML' parameterAdobe Connect
- CVE-2021-36058XMP Toolkit SDK Integer Overflow Vulnerability Could Result In Application Denial Of ServiceAdobe XMP Toolkit
- CVE-2021-36061Adobe Connect Violation of Secure Design Principles Vulnerability Can Lead To Editing Or Deleting RecordingsAdobe Connect
- CVE-2021-36056XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-36062Adobe Connect Reflected Cross-site Scripting via 'campaign-id' parameterAdobe Connect
- CVE-2021-36054XMP Toolkit SDK Heap-based Buffer Overflow in the PSD_MetaHandler::CacheFileData Could Lead To Application Denial Of ServiceAdobe XMP Toolkit
- CVE-2021-36057XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of ServiceAdobe XMP Toolkit
- CVE-2021-36053XMP Toolkit SDK Out-of-bounds Read Vulnerability In FindAndReadXMPChunk Could Lead To Information ExposureAdobe XMP Toolkit
- CVE-2021-36045XMP Toolkit SDK Out-of-bounds Read Vulnerability In PostScriptSupport::ConvertToDate Could Lead To Information ExposureAdobe XMP Toolkit
- CVE-2021-36027Magento Commerce Stored Cross-site Scripting VulnerabilityAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36039Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information DisclosureAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36026Magento Commerce Stored Cross-site Scripting VulnerabilityAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36038Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information ExposureAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36002Adobe Captivate Installer Creation of Temporary File In Directory With Incorrect Permissions Could Lead To Privilege EscalationAdobe Captivate
- CVE-2021-36037Magento Commerce Improper Authorization Vulnerability Could Lead To Information ExposureAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-36012Magento Commerce Gift Card Business Logic ErrorAdobe Magento Commerce · magento/project-community-editi… +1
- CVE-2021-23426Prototype PollutionProto
- CVE-2021-40350webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing a
- CVE-2021-39320underConstruction <= 1.18 - Reflected Cross-Site ScriptingNoah Kagan underConstruction
- CVE-2021-35508NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged u
- CVE-2021-39379A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.
- CVE-2021-37151CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid.CyberArk Identity
- CVE-2021-39377A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.
- CVE-2021-39373Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management.
- CVE-2021-39378A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.
- CVE-2021-40352OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of a
- CVE-2021-38703Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the sys
- CVE-2021-35238Stored XSS through URL POST parameter in CreateExternalWebsite VulnerabilitySolarWinds Orion Platform
- CVE-2020-9000An issue was discovered in iPortalis iCS 7.1.13.0.
- CVE-2021-33582Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled duri
- CVE-2021-36235An issue was discovered in Ivanti Workspace Control before 10.6.30.0.
- CVE-2021-40353A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.