CVEs published September 7, 2021
124 CVEs were published on September 7, 2021: 4 critical, 9 high. 1 is now in CISA KEV.
- Published
- 124
- Critical
- 4
- High
- 9
- Medium
- 26
- Low
- 0
- Unrated
- 85
- Now in CISA KEV
- 1
- Fix available
- 20
Most affected products
- Aruba SD-WAN Software and Gateways; Aruba Operating System…
- 11
- nextcloud security-advisories
- 9
- Aruba Operating System Software
- 4
- Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- 2
- github.com/hashicorp/consul
- 2
- BetterErrors better_errors · better_errors
- 1
- charleskorn kaml · com.charleskorn.kaml:kaml
- 1
- F-Secure endpoint protection products on Windows and Mac. F…
- 1
- github.com/hashicorp/nomad
- 1
- Inoguard ExECM CoreB2B
- 1
Critical 4
- CVE-2021-32802Preview generation used third-party library not suited for user-generated content in Nextcloud servernextcloud security-advisories
- CVE-2021-39199Cross site scripting via unsafe defaults in remark-htmlremarkjs remark-html · remark-html
- CVE-2021-40539Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execu
- CVE-2020-7819nTracker USB Enterprise SQL-Injection vulnerabilitynTrackSystem nTracker USB Enterprise
High 9
- CVE-2021-32800Bypass of Two Factor Authentication in Nextcloud servernextcloud security-advisories
- CVE-2021-37628File Drop can be bypassed using Richdocuments app in nextcloudnextcloud security-advisories
- CVE-2021-39195Server-Side Request Forgery vulnerability in misskeymisskey-dev misskey
- CVE-2021-39196Authenticated non-privileged user can request unfiltered data without adequate permissions in pcapturejdhwpgmbca pcapture
- CVE-2020-7832RAONWIZ DEXT5 Upload remote code execution vulnerabilityRAONWIZ DEXT5 Upload
- CVE-2020-7865Inoguard ExECM CoreB2B solution remote code execution vulnerabilityInoguard ExECM CoreB2B
- CVE-2020-7877ZOOK solution(remote administration tool) buffer overflow vulnerabilitymastersoft ZOOKViewer_Setup.exe · mastersoft ZOOKAgentSetup…
- CVE-2021-38616In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to inc
- CVE-2021-38617In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/ user creation endpoint allows a standard user to create a super user acc
Medium, low and unrated 111
- CVE-2020-19855phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.
- CVE-2020-19853BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php.
- CVE-2021-37145A command-injection vulnerability in an authenticated Telnet connection in Poly (formerly Polycom) CX5500 and CX5100 1.3.5 leads an attacker
- CVE-2020-19767A lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows attackers to steal tokens from victim users vi
- CVE-2020-19769A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows attackers to steal tokens from victim users via a
- CVE-2020-19768A lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows attackers to steal tokens from victim users via a
- CVE-2020-19766The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large number to the _duration variable, compromis
- CVE-2020-19765An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack.
- CVE-2021-32801Exceptions may have logged Encryption-at-Rest key content in Nextcloud servernextcloud security-advisories
- CVE-2021-32766Nextcloud Text app can disclose existence of folders in "File Drop" link sharenextcloud security-advisories
- CVE-2021-37629Lack of ratelimit on Richdocuments OCS endpoint in nextcloudnextcloud security-advisories
- CVE-2021-39501EyouCMS 1.5.4 is vulnerable to Open Redirect.
- CVE-2021-39500Eyoucms 1.5.4 is vulnerable to Directory Traversal.
- CVE-2021-32782Cross-Site Scripting in Nextcloud Circlesnextcloud security-advisories
- CVE-2021-37630Secret Circle can be joined without approval in Nextcloud Circlesnextcloud security-advisories
- CVE-2021-39499A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTM
- CVE-2021-39497eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function.
- CVE-2021-39496Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS
- CVE-2021-39503PHPMyWind 5.6 is vulnerable to Remote Code Execution.
- CVE-2021-37631Circle can be accessed by non-Circle members in Nextcloud Decknextcloud security-advisories
- CVE-2020-19751An issue was discovered in gpac 0.8.0.
- CVE-2020-19752The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference.
- CVE-2020-19750An issue was discovered in gpac 0.8.0.
- CVE-2021-40143Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection.org.sonatype.nexus:nexus-repository
- CVE-2021-39194Denial of service while parsing polymorphic input with tagged polymorphism style in kamlcharleskorn kaml · com.charleskorn.kaml:kaml
- CVE-2021-38705ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF).
- CVE-2021-38704Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary Ja
- CVE-2021-38707Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript
- CVE-2021-38706messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute ar
- CVE-2021-35948Session fixation on password protected public links in the ownCloud Server before 10.8.0 allows an attacker to bypass the password protectio
- CVE-2021-35946A receiver of a federated share with access to the database with ownCloud version before 10.8 could update the permissions and therefore ele
- CVE-2021-35949The shareinfo controller in the ownCloud Server before 10.8.0 allows an attacker to bypass the permission checks for upload only shares and
- CVE-2021-35947The public share controller in the ownCloud server before version 10.8.0 allows a remote attacker to see the internal path and the username
- CVE-2021-39197Cross-Site Request Forgery in better_errorsBetterErrors better_errors · better_errors
- CVE-2021-38142Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades.
- CVE-2021-38123Open Redirect vulnerability in Micro Focus Network Automation, affecting Network Automation versions 10.4x, 10.5x, 2018.05, 2018.11, 2019.05Network Automation.
- CVE-2020-19131Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop
- CVE-2021-27022A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being loggPuppet Enterprise
- CVE-2021-37731A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): PriorAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-39285A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8.
- CVE-2021-37725A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System SoftwaAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37733A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): PrioAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37729A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): PrioAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37728A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5Aruba Operating System Software
- CVE-2021-37721A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37724A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, Aruba Operating System Software
- CVE-2021-37718A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-33599Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…
- CVE-2021-37723A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, Aruba Operating System Software
- CVE-2021-37722A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37720A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37719A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-37717A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software verAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2019-5318A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba Operating System Software version(s): 6.x.x.x: all versionsAruba Operating System Software
- CVE-2021-37716A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): PriAruba SD-WAN Software and Gateways; Aruba Operating System…
- CVE-2021-38698HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access togithub.com/hashicorp/consul
- CVE-2021-37218HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access servergithub.com/hashicorp/nomad
- CVE-2021-36717Synerion TimeNet version 9.21 - Directory TraversalSynerion TimeNet version
- CVE-2021-37219HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to accegithub.com/hashicorp/consul
- CVE-2021-38615In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/sso/config/ SSO configuration endpoint allows any logged-in user (guest, stand
- CVE-2021-36696Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social me
- CVE-2021-36163Unsafe deserialization in providers using the Hessian protocolApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2021-36162Unprotected yaml deserialization cause RCEApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2021-31612The Bluetooth Classic implementation on Zhuhai Jieli AC690X devices does not properly handle the reception of an oversized LMP packet greate
- CVE-2021-31609The Bluetooth Classic implementation in Silicon Labs iWRAP 6.3.0 and earlier does not properly handle the reception of an oversized LMP pack
- CVE-2021-28139The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an L
- CVE-2021-34147The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 does not properly handle the reception of a
- CVE-2021-34148The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the recepti
- CVE-2021-34145The Bluetooth Classic implementation in the Cypress WICED BT stack through 2.9.0 for CYW20735B1 devices does not properly handle the recepti
- CVE-2021-34143The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C_DEMO_V1.0 does not properly handle the reception of continuous unsolicited
- CVE-2021-34146The Bluetooth Classic implementation in the Cypress CYW920735Q60EVB does not properly handle the reception of continuous unsolicited LMP res
- CVE-2021-34149The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand
- CVE-2021-31610The Bluetooth Classic implementation on AB32VG1 devices does not properly handle the reception of continuous unsolicited LMP responses, allo
- CVE-2021-31785The Bluetooth Classic implementation on Actions ATS2815 and ATS2819 chipsets does not properly handle the reception of multiple LMP_host_con
- CVE-2021-31786The Bluetooth Classic Audio implementation on Actions ATS2815 and ATS2819 devices does not properly handle a connection attempt from a host
- CVE-2021-31611The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle an out-of-order LMP Setup procedure
- CVE-2021-31613The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP pac
- CVE-2021-34150The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of ov
- CVE-2021-28155The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses
- CVE-2021-28135The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited L
- CVE-2021-34144The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LM
- CVE-2021-28136The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capabili
- CVE-2021-39279Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP.
- CVE-2021-39278Certain MOXA devices allow reflected XSS via the Config Import menu.
- CVE-2021-38841Remote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info page i
- CVE-2021-38840SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter
- CVE-2021-33831api/account/register in the TH Wildau COVID-19 Contact Tracing application through 2021-09-01 has Incorrect Access Control.
- CVE-2021-33484An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8.
- CVE-2021-33483An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8.
- CVE-2021-40540ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malform
- CVE-2021-33285In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute is supplied to the function ntfs_get_attribute_value, a heap buffer
- CVE-2021-33286In NTFS-3G versions < 2021.8.22, when a specially crafted unicode string is supplied in an NTFS image a heap buffer overflow can occur and a
- CVE-2021-33287In NTFS-3G versions < 2021.8.22, when specially crafted NTFS attributes are read in the function ntfs_attr_pread_i, a heap buffer overflow c
- CVE-2021-33289In NTFS-3G versions < 2021.8.22, when a specially crafted MFT section is supplied in an NTFS image a heap buffer overflow can occur and allo
- CVE-2021-35266In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode pathname is supplied in an NTFS image a heap buffer overflow can occur
- CVE-2021-35267NTFS-3G versions < 2021.8.22, a stack buffer overflow can occur when correcting differences in the MFT and MFTMirror allowing for code execu
- CVE-2021-35268In NTFS-3G versions < 2021.8.22, when a specially crafted NTFS inode is loaded in the function ntfs_inode_real_open, a heap buffer overflow
- CVE-2021-35269NTFS-3G versions < 2021.8.22, when a specially crafted NTFS attribute from the MFT is setup in the function ntfs_attr_setup_flag, a heap buf
- CVE-2021-39251A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.
- CVE-2021-39252A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.
- CVE-2021-39253A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.
- CVE-2021-39254A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resi
- CVE-2021-39255A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.
- CVE-2021-39256A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.
- CVE-2021-39257A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causin
- CVE-2021-39258A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.
- CVE-2021-39259A crafted NTFS image can trigger an out-of-bounds access, caused by an unsanitized attribute length in ntfs_inode_lookup_by_name, in NTFS-3G
- CVE-2021-39260A crafted NTFS image can cause an out-of-bounds access in ntfs_inode_sync_standard_information in NTFS-3G < 2021.8.22.
- CVE-2021-39261A crafted NTFS image can cause a heap-based buffer overflow in ntfs_compressed_pwrite in NTFS-3G < 2021.8.22.
- CVE-2021-39262A crafted NTFS image can cause an out-of-bounds access in ntfs_decompress in NTFS-3G < 2021.8.22.
- CVE-2021-39263A crafted NTFS image can trigger a heap-based buffer overflow, caused by an unsanitized attribute in ntfs_get_attribute_value, in NTFS-3G <