CVEs published September 9, 2021
140 CVEs were published on September 9, 2021: 4 critical, 33 high.
- Published
- 140
- Critical
- 4
- High
- 33
- Medium
- 43
- Low
- 7
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 38
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 16
- Samsung Mobile Devices
- 14
- Cisco IOS XR Software
- 11
- Arista Metamako Operating System
- 6
- wordpress-develop
- 4
- pomerium · github.com/pomerium/pomerium
- 3
- Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- 3
- Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- 2
- Cisco BroadWorks
- 2
- eclipse keti
- 2
Critical 4
- CVE-2021-32724check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attackcheck-spelling
- CVE-2021-28494In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication iArista Metamako Operating System
- CVE-2021-1946Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1933UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon ConneQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
High 33
- CVE-2021-39206Incorrect Authorization with specially crafted requestspomerium · github.com/pomerium/pomerium
- CVE-2021-39204Excessive CPU usage in Pomeriumpomerium · github.com/pomerium/pomerium
- CVE-2021-39162Incorrect handling of H2 GOAWAY + SETTINGS framespomerium · github.com/pomerium/pomerium
- CVE-2021-39202WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetwordpress-develop
- CVE-2021-39201Authenticated cross-site scripting (XSS) in WordPress editorwordpress-develop
- CVE-2021-38324SP Rental Manager <= 1.5.3 Unauthenticated SQL InjectionSP Rental Manager
- CVE-2021-3761OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength valuesCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-26608handysoft groupware arbitrary file download and execution vulnerabilityhandysoft HShell.dll
- CVE-2020-7874NEXACRO14 Runtime arbitrary file download and execution vulnerabilityTOBESOFT NEXACRO14
- CVE-2020-7873Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary fYounglimwon Co. K-System WellComm
- CVE-2021-28493In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be abArista Metamako Operating System
- CVE-2021-28495In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authenticatArista Metamako Operating System
- CVE-2021-28498In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text coArista Metamako Operating System
- CVE-2021-26603bandisoft ARK library heap overflow vulnerabilitybandisoft ARK
- CVE-2021-30295Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, SnapdQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30294Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon ConQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-30290Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, SnapdrQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-1974Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapdragon CompQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1971Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1952Possible buffer over read occurs due to lack of length check of request buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectiviQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1948Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon ComQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1941Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, SnapdragoQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1935Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1934Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1909Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-34728Cisco IOS XR Software Authenticated User Privilege Escalation VulnerabilitiesCisco IOS XR Software
- CVE-2021-34720Cisco IOS XR Software IP Service Level Agreements and Two-Way Active Measurement Protocol Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2021-34719Cisco IOS XR Software Authenticated User Privilege Escalation VulnerabilitiesCisco IOS XR Software
- CVE-2021-34718Cisco IOS XR Software Arbitrary File Read and Write VulnerabilityCisco IOS XR Software
- CVE-2021-34713Cisco IOS XR Software for ASR 9000 Series Routers Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2021-32836Pre-auth unsafe deserialization in ZStackzstackio zstack
- CVE-2021-32834Arbitrary Groovy script evaluation in Eclipse Ketieclipse keti
- CVE-2021-32833Unauthenticated file read in Emby ServerMediaBrowser Emby.Releases
Medium, low and unrated 103
- CVE-2020-19294A stored cross-site scripting (XSS) vulnerability in the /article/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary we
- CVE-2020-19295A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web
- CVE-2020-19292A stored cross-site scripting (XSS) vulnerability in the /question/ask component of Jeesns 1.4.2 allows attackers to execute arbitrary web s
- CVE-2020-19293A stored cross-site scripting (XSS) vulnerability in the /article/add component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc
- CVE-2020-19291A stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of Jeesns 1.4.2 allows attackers to execute arbitrary
- CVE-2020-19289A stored cross-site scripting (XSS) vulnerability in the /member/picture/album component of Jeesns 1.4.2 allows attackers to execute arbitra
- CVE-2020-19290A stored cross-site scripting (XSS) vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web
- CVE-2020-19288A stored cross-site scripting (XSS) vulnerability in the /localhost/u component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc
- CVE-2020-19287A stored cross-site scripting (XSS) vulnerability in the /group/post component of Jeesns 1.4.2 allows attackers to execute arbitrary web scr
- CVE-2020-19285A stored cross-site scripting (XSS) vulnerability in the /group/apply component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc
- CVE-2020-19286A stored cross-site scripting (XSS) vulnerability in the /question/detail component of Jeesns 1.4.2 allows attackers to execute arbitrary we
- CVE-2020-19284A stored cross-site scripting (XSS) vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web
- CVE-2020-19283A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web
- CVE-2020-19282A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2020-19281A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitra
- CVE-2020-19280Jeesns 1.4.2 contains a cross-site request forgery (CSRF) which allows attackers to escalate privileges and perform sensitive program operat
- CVE-2021-39203Private data disclosure/privilege escalation through the block editor in Wordpresswordpress-develop
- CVE-2021-39200Information Disclosure in wp_die() via JSONP in wordpresswordpress-develop
- CVE-2021-38323RentPress <= 6.6.4 Reflected Cross-Site ScriptingRentPress
- CVE-2021-38325User Activation Email <= 1.3.0 Reflected Cross-Site ScriptingUser Activation Email
- CVE-2021-38319More From Google <= 0.0.2 Reflected Cross-Site ScriptingMore From Google
- CVE-2021-38317Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site ScriptingKonnichiwa! Membership
- CVE-2021-38321Custom Menu Plugin <= 1.3.3 Reflected Cross-Site ScriptingCustom Menu Plugin
- CVE-2021-38320simpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site ScriptingsimpleSAMLphp Authentication
- CVE-2021-38316WP Academic People List <= 0.4.1 Reflected Cross-Site ScriptingWP Academic People List
- CVE-2021-38322Twitter Friends Widget <= 3.1 Reflected Cross-Site ScriptingTwitter Friends Widget
- CVE-2021-383183D Cover Carousel <= 1.0 Reflected Cross-Site Scripting3D Cover Carousel
- CVE-2021-25466Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and Samsung Mobile Samsung Internet
- CVE-2021-25465An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack.Samsung Mobile Samsung Theme
- CVE-2021-25464An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak.Samsung Mobile Samsung Capture
- CVE-2021-25463Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview.Samsung Mobile PENUP
- CVE-2021-25462NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2021-25461An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow.Samsung Mobile Devices
- CVE-2021-25460An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BSamsung Mobile Devices
- CVE-2021-25459An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockSamsung Mobile Devices
- CVE-2021-25458NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption.Samsung Mobile Devices
- CVE-2021-25457An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memoSamsung Mobile Devices
- CVE-2021-25456OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary addresSamsung Mobile Devices
- CVE-2021-25455OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pSamsung Mobile Devices
- CVE-2021-25454OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac Samsung Mobile Devices
- CVE-2021-25453Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information.Samsung Mobile Devices
- CVE-2021-25452An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform pSamsung Mobile Devices
- CVE-2021-25451A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data.Samsung Mobile Devices
- CVE-2021-25450Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via remSamsung Mobile Devices
- CVE-2021-25449An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrarySamsung Mobile Devices
- CVE-2021-28914BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration too
- CVE-2021-28913BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so calle
- CVE-2021-28912BAB TECHNOLOGIE GmbH eibPort V3.
- CVE-2021-28911BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data (
- CVE-2020-19267An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- CVE-2020-19268A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add admin
- CVE-2020-19266A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to e
- CVE-2020-19265A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execut
- CVE-2020-19264A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd.
- CVE-2020-19263A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php
- CVE-2021-28910BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability.
- CVE-2021-28909BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/Secur
- CVE-2021-40284D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service.
- CVE-2021-38727FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items
- CVE-2021-32487In modem 2G RRM, there is a possible system crash due to a heap buffer overflow.
- CVE-2021-32486In modem 2G RRM, there is a possible system crash due to a heap buffer overflow.
- CVE-2021-32485In modem 2G RRM, there is a possible system crash due to a heap buffer overflow.
- CVE-2021-32484In modem 2G RRM, there is a possible system crash due to a heap buffer overflow.
- CVE-2021-38540Apache Airflow: Variable Import endpoint missed authentication checkApache Software Foundation Apache Airflow · apache-airflow
- CVE-2021-22239An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later.GitLab
- CVE-2020-19515qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\install\modules\database_config.php.
- CVE-2021-38721FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability
- CVE-2021-38723FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items
- CVE-2021-38725Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php
- CVE-2020-19144Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in _TIFFmemcpy' funtion in the component 'tif_unix
- CVE-2020-19143Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/t
- CVE-2021-37101There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00).AIS-BW50-00
- CVE-2021-28497In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell mArista Metamako Operating System
- CVE-2021-28499In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text cArista Metamako Operating System
- CVE-2021-39459Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code
- CVE-2021-39458Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate
- CVE-2021-20118Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local admNessus Agent
- CVE-2021-20117Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local admNessus Agent
- CVE-2021-38408A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the lengAdvantech WebAccess
- CVE-2021-36871WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilitiesCode Cabin WP Google Maps Pro
- CVE-2021-36870WordPress WP Google Maps plugin <= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilitiesCode Cabin WP Google Maps
- CVE-2021-40223Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configur
- CVE-2021-40222Rittal CMC PU III Web management Version affected: V3.11.00_2.
- CVE-2021-37579Bypass deserialization checks in Apache DubboApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2021-36161Unprotected input value toString cause RCEApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2021-1963Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, SQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1962Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2021-1961Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1960Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, SnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1958A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon CoQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-1957Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in SnapdrQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1956Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon CQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-34786Cisco BroadWorks CommPilot Application Software VulnerabilitiesCisco BroadWorks
- CVE-2021-34785Cisco BroadWorks CommPilot Application Software VulnerabilitiesCisco BroadWorks
- CVE-2021-34771Cisco IOS XR Software Unauthorized Information Disclosure VulnerabilityCisco IOS XR Software
- CVE-2021-34737Cisco IOS XR Software DHCP Version 4 Server Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2021-34722Cisco IOS XR Software Command Injection VulnerabilitiesCisco IOS XR Software
- CVE-2021-34721Cisco IOS XR Software Command Injection VulnerabilitiesCisco IOS XR Software
- CVE-2021-34709Cisco IOS XR Software for Cisco 8000 and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesCisco IOS XR Software
- CVE-2021-34708Cisco IOS XR Software for Cisco 8000 and Network Convergence System 540 Series Routers Image Verification VulnerabilitiesCisco IOS XR Software
- CVE-2021-32835Groovy Sandbox escape in Eclipse Ketieclipse keti
- CVE-2020-26300Command injection in systeminformationsebhildebrandt systeminformation · systeminformation
- CVE-2021-39296In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.