# CVEs published 2021-09-09

140 CVEs were published on September 9, 2021: 4 critical, 33 high. Days are UTC.

- [CVE-2020-19294](https://cve.now/CVE-2020-19294.md): A stored cross-site scripting (XSS) vulnerability in the /article/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2020-19295](https://cve.now/CVE-2020-19295.md): A reflected cross-site scripting (XSS) vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2020-19292](https://cve.now/CVE-2020-19292.md): A stored cross-site scripting (XSS) vulnerability in the /question/ask component of Jeesns 1.4.2 allows attackers to execute arbitrary web s (no CVSS)
- [CVE-2020-19293](https://cve.now/CVE-2020-19293.md): A stored cross-site scripting (XSS) vulnerability in the /article/add component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2020-19291](https://cve.now/CVE-2020-19291.md): A stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of Jeesns 1.4.2 allows attackers to execute arbitrary (no CVSS)
- [CVE-2020-19289](https://cve.now/CVE-2020-19289.md): A stored cross-site scripting (XSS) vulnerability in the /member/picture/album component of Jeesns 1.4.2 allows attackers to execute arbitra (no CVSS)
- [CVE-2020-19290](https://cve.now/CVE-2020-19290.md): A stored cross-site scripting (XSS) vulnerability in the /weibo/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2020-19288](https://cve.now/CVE-2020-19288.md): A stored cross-site scripting (XSS) vulnerability in the /localhost/u component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2020-19287](https://cve.now/CVE-2020-19287.md): A stored cross-site scripting (XSS) vulnerability in the /group/post component of Jeesns 1.4.2 allows attackers to execute arbitrary web scr (no CVSS)
- [CVE-2020-19285](https://cve.now/CVE-2020-19285.md): A stored cross-site scripting (XSS) vulnerability in the /group/apply component of Jeesns 1.4.2 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2020-19286](https://cve.now/CVE-2020-19286.md): A stored cross-site scripting (XSS) vulnerability in the /question/detail component of Jeesns 1.4.2 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2020-19284](https://cve.now/CVE-2020-19284.md): A stored cross-site scripting (XSS) vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2020-19283](https://cve.now/CVE-2020-19283.md): A reflected cross-site scripting (XSS) vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2020-19282](https://cve.now/CVE-2020-19282.md): A reflected cross-site scripting (XSS) vulnerability in Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted (no CVSS)
- [CVE-2020-19281](https://cve.now/CVE-2020-19281.md): A stored cross-site scripting (XSS) vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitra (no CVSS)
- [CVE-2020-19280](https://cve.now/CVE-2020-19280.md): Jeesns 1.4.2 contains a cross-site request forgery (CSRF) which allows attackers to escalate privileges and perform sensitive program operat (no CVSS)
- [CVE-2021-39206](https://cve.now/CVE-2021-39206.md): Incorrect Authorization with specially crafted requests (CVSS 8.6, pomerium · github.com/pomerium/pomerium)
- [CVE-2021-39204](https://cve.now/CVE-2021-39204.md): Excessive CPU usage in Pomerium (CVSS 7.5, pomerium · github.com/pomerium/pomerium)
- [CVE-2021-39162](https://cve.now/CVE-2021-39162.md): Incorrect handling of H2 GOAWAY + SETTINGS frames (CVSS 8.6, pomerium · github.com/pomerium/pomerium)
- [CVE-2021-39203](https://cve.now/CVE-2021-39203.md): Private data disclosure/privilege escalation through the block editor in Wordpress (CVSS 6.8, wordpress-develop)
- [CVE-2021-39202](https://cve.now/CVE-2021-39202.md): WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widget (CVSS 7.6, wordpress-develop)
- [CVE-2021-39201](https://cve.now/CVE-2021-39201.md): Authenticated cross-site scripting (XSS) in WordPress editor (CVSS 7.6, wordpress-develop)
- [CVE-2021-39200](https://cve.now/CVE-2021-39200.md): Information Disclosure in wp\_die() via JSONP in wordpress (CVSS 5.3, wordpress-develop)
- [CVE-2021-32724](https://cve.now/CVE-2021-32724.md): check-spelling workflow vulnerable to GITHUB\_TOKEN leakage via symlink attack (CVSS 9.9, check-spelling)
- [CVE-2021-38323](https://cve.now/CVE-2021-38323.md): RentPress \<= 6.6.4 Reflected Cross-Site Scripting (CVSS 6.1, RentPress)
- [CVE-2021-38325](https://cve.now/CVE-2021-38325.md): User Activation Email \<= 1.3.0 Reflected Cross-Site Scripting (CVSS 6.1, User Activation Email)
- [CVE-2021-38319](https://cve.now/CVE-2021-38319.md): More From Google \<= 0.0.2 Reflected Cross-Site Scripting (CVSS 6.1, More From Google)
- [CVE-2021-38317](https://cve.now/CVE-2021-38317.md): Konnichiwa! Membership \<= 0.8.3 Reflected Cross-Site Scripting (CVSS 6.1, Konnichiwa! Membership)
- [CVE-2021-38321](https://cve.now/CVE-2021-38321.md): Custom Menu Plugin \<= 1.3.3 Reflected Cross-Site Scripting (CVSS 6.1, Custom Menu Plugin)
- [CVE-2021-38320](https://cve.now/CVE-2021-38320.md): simpleSAMLphp Authentication \<= 0.7.0 Reflected Cross-Site Scripting (CVSS 6.1, simpleSAMLphp Authentication)
- [CVE-2021-38324](https://cve.now/CVE-2021-38324.md): SP Rental Manager \<= 1.5.3 Unauthenticated SQL Injection (CVSS 8.2, SP Rental Manager)
- [CVE-2021-38316](https://cve.now/CVE-2021-38316.md): WP Academic People List \<= 0.4.1 Reflected Cross-Site Scripting (CVSS 6.1, WP Academic People List)
- [CVE-2021-38322](https://cve.now/CVE-2021-38322.md): Twitter Friends Widget \<= 3.1 Reflected Cross-Site Scripting (CVSS 6.1, Twitter Friends Widget)
- [CVE-2021-38318](https://cve.now/CVE-2021-38318.md): 3D Cover Carousel \<= 1.0 Reflected Cross-Site Scripting (CVSS 6.1, 3D Cover Carousel)
- [CVE-2021-25466](https://cve.now/CVE-2021-25466.md): Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and (CVSS 6.5, Samsung Mobile Samsung Internet)
- [CVE-2021-25465](https://cve.now/CVE-2021-25465.md): An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. (CVSS 3.3, Samsung Mobile Samsung Theme)
- [CVE-2021-25464](https://cve.now/CVE-2021-25464.md): An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. (CVSS 3.3, Samsung Mobile Samsung Capture)
- [CVE-2021-25463](https://cve.now/CVE-2021-25463.md): Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. (CVSS 4.0, Samsung Mobile PENUP)
- [CVE-2021-25462](https://cve.now/CVE-2021-25462.md): NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2021-25461](https://cve.now/CVE-2021-25461.md): An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25460](https://cve.now/CVE-2021-25460.md): An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate B (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25459](https://cve.now/CVE-2021-25459.md): An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start Block (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25458](https://cve.now/CVE-2021-25458.md): NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2021-25457](https://cve.now/CVE-2021-25457.md): An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memo (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2021-25456](https://cve.now/CVE-2021-25456.md): OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary addres (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2021-25455](https://cve.now/CVE-2021-25455.md): OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through p (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2021-25454](https://cve.now/CVE-2021-25454.md): OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac (CVSS 3.1, Samsung Mobile Devices)
- [CVE-2021-25453](https://cve.now/CVE-2021-25453.md): Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2021-25452](https://cve.now/CVE-2021-25452.md): An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform p (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2021-25451](https://cve.now/CVE-2021-25451.md): A PendingIntent hijacking in NetworkPolicyManagerService prior to SMR Sep-2021 Release 1 allows attackers to get IMSI data. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2021-25450](https://cve.now/CVE-2021-25450.md): Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Sep-2021 Release 1 allows attackers to write file as system uid via rem (CVSS 4.5, Samsung Mobile Devices)
- [CVE-2021-25449](https://cve.now/CVE-2021-25449.md): An improper input validation vulnerability in libsapeextractor library prior to SMR Sep-2021 Release 1 allows attackers to execute arbitrary (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2021-28914](https://cve.now/CVE-2021-28914.md): BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow the user to set a weak password because the strength is shown in configuration too (no CVSS)
- [CVE-2021-28913](https://cve.now/CVE-2021-28913.md): BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /webif/SecurityModule to validate the so calle (no CVSS)
- [CVE-2021-28912](https://cve.now/CVE-2021-28912.md): BAB TECHNOLOGIE GmbH eibPort V3. (no CVSS)
- [CVE-2021-28911](https://cve.now/CVE-2021-28911.md): BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers access to /tmp path which contains some sensitive data ( (no CVSS)
- [CVE-2020-19267](https://cve.now/CVE-2020-19267.md): An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file. (no CVSS)
- [CVE-2020-19268](https://cve.now/CVE-2020-19268.md): A cross-site request forgery (CSRF) in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add admin (no CVSS)
- [CVE-2020-19266](https://cve.now/CVE-2020-19266.md): A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to e (no CVSS)
- [CVE-2020-19265](https://cve.now/CVE-2020-19265.md): A stored cross-site scripting (XSS) vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execut (no CVSS)
- [CVE-2020-19264](https://cve.now/CVE-2020-19264.md): A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily add users via index.php?s=/user/ApiAdminUser/itemAdd. (no CVSS)
- [CVE-2020-19263](https://cve.now/CVE-2020-19263.md): A cross-site request forgery (CSRF) in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php (no CVSS)
- [CVE-2021-28910](https://cve.now/CVE-2021-28910.md): BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 contains basic SSRF vulnerability. (no CVSS)
- [CVE-2021-28909](https://cve.now/CVE-2021-28909.md): BAB TECHNOLOGIE GmbH eibPort V3 prior version 3.9.1 allow unauthenticated attackers to access uncontrolled the login service at /webif/Secur (no CVSS)
- [CVE-2021-40284](https://cve.now/CVE-2021-40284.md): D-Link DSL-3782 EU v1.01:EU v1.03 is affected by a buffer overflow which can cause a denial of service. (no CVSS)
- [CVE-2021-38727](https://cve.now/CVE-2021-38727.md): FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items (no CVSS)
- [CVE-2021-32487](https://cve.now/CVE-2021-32487.md): In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. (no CVSS)
- [CVE-2021-32486](https://cve.now/CVE-2021-32486.md): In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. (no CVSS)
- [CVE-2021-32485](https://cve.now/CVE-2021-32485.md): In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. (no CVSS)
- [CVE-2021-32484](https://cve.now/CVE-2021-32484.md): In modem 2G RRM, there is a possible system crash due to a heap buffer overflow. (no CVSS)
- [CVE-2021-38540](https://cve.now/CVE-2021-38540.md): Apache Airflow: Variable Import endpoint missed authentication check (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2021-22239](https://cve.now/CVE-2021-22239.md): An unauthorized user was able to insert metadata when creating new issue on GitLab CE/EE 14.0 and later. (CVSS 5.0, GitLab)
- [CVE-2020-19515](https://cve.now/CVE-2020-19515.md): qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPM\\install\\modules\\database\_config.php. (no CVSS)
- [CVE-2021-38721](https://cve.now/CVE-2021-38721.md): FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability (no CVSS)
- [CVE-2021-38723](https://cve.now/CVE-2021-38723.md): FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items (no CVSS)
- [CVE-2021-38725](https://cve.now/CVE-2021-38725.md): Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php (no CVSS)
- [CVE-2020-19144](https://cve.now/CVE-2020-19144.md): Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the 'in \_TIFFmemcpy' funtion in the component 'tif\_unix (no CVSS)
- [CVE-2020-19143](https://cve.now/CVE-2020-19143.md): Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "TIFFVGetField" funtion in the component 'libtiff/t (no CVSS)
- [CVE-2021-3761](https://cve.now/CVE-2021-3761.md): OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values (CVSS 7.5, Cloudflare octorpki · github.com/cloudflare/cfrpki)
- [CVE-2021-37101](https://cve.now/CVE-2021-37101.md): There is an improper authorization vulnerability in AIS-BW50-00 9.0.6.2(H100SP10C00) and 9.0.6.2(H100SP15C00). (no CVSS, AIS-BW50-00)
- [CVE-2021-26608](https://cve.now/CVE-2021-26608.md): handysoft groupware arbitrary file download and execution vulnerability (CVSS 8.8, handysoft HShell.dll)
- [CVE-2020-7874](https://cve.now/CVE-2020-7874.md): NEXACRO14 Runtime arbitrary file download and execution vulnerability (CVSS 8.8, TOBESOFT NEXACRO14)
- [CVE-2020-7873](https://cve.now/CVE-2020-7873.md): Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary f (CVSS 8.8, Younglimwon Co. K-System WellComm)
- [CVE-2021-28494](https://cve.now/CVE-2021-28494.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, authentication i (CVSS 9.6, Arista Metamako Operating System)
- [CVE-2021-28493](https://cve.now/CVE-2021-28493.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, a user may be ab (CVSS 8.4, Arista Metamako Operating System)
- [CVE-2021-28495](https://cve.now/CVE-2021-28495.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, user authenticat (CVSS 7.2, Arista Metamako Operating System)
- [CVE-2021-28497](https://cve.now/CVE-2021-28497.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, under certain conditions, the bash shell m (CVSS 4.4, Arista Metamako Operating System)
- [CVE-2021-28499](https://cve.now/CVE-2021-28499.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text c (CVSS 6.3, Arista Metamako Operating System)
- [CVE-2021-28498](https://cve.now/CVE-2021-28498.md): In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text co (CVSS 8.7, Arista Metamako Operating System)
- [CVE-2021-39459](https://cve.now/CVE-2021-39459.md): Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code (no CVSS)
- [CVE-2021-39458](https://cve.now/CVE-2021-39458.md): Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate (no CVSS)
- [CVE-2021-20118](https://cve.now/CVE-2021-20118.md): Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local adm (no CVSS, Nessus Agent)
- [CVE-2021-20117](https://cve.now/CVE-2021-20117.md): Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local adm (no CVSS, Nessus Agent)
- [CVE-2021-38408](https://cve.now/CVE-2021-38408.md): A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the leng (no CVSS, Advantech WebAccess)
- [CVE-2021-36871](https://cve.now/CVE-2021-36871.md): WordPress WP Google Maps Pro premium plugin \<= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities (CVSS 5.5, Code Cabin WP Google Maps Pro)
- [CVE-2021-36870](https://cve.now/CVE-2021-36870.md): WordPress WP Google Maps plugin \<= 8.1.12 - Multiple Authenticated Persistent XSS vulnerabilities (CVSS 5.5, Code Cabin WP Google Maps)
- [CVE-2021-26603](https://cve.now/CVE-2021-26603.md): bandisoft ARK library heap overflow vulnerability (CVSS 8.6, bandisoft ARK)
- [CVE-2021-40223](https://cve.now/CVE-2021-40223.md): Rittal CMC PU III Web management (version V3.11.00\_2) fails to sanitize user input on several parameters of the configuration (User Configur (no CVSS)
- [CVE-2021-40222](https://cve.now/CVE-2021-40222.md): Rittal CMC PU III Web management Version affected: V3.11.00\_2. (no CVSS)
- [CVE-2021-37579](https://cve.now/CVE-2021-37579.md): Bypass deserialization checks in Apache Dubbo (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2021-36161](https://cve.now/CVE-2021-36161.md): Unprotected input value toString cause RCE (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2021-30295](https://cve.now/CVE-2021-30295.md): Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon Auto, Snapd (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30294](https://cve.now/CVE-2021-30294.md): Potential null pointer dereference in KGSL GPU auxiliary command due to improper validation of user input in Snapdragon Auto, Snapdragon Con (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-30290](https://cve.now/CVE-2021-30290.md): Possible null pointer dereference due to race condition between timeline fence signal and time line fence destroy in Snapdragon Auto, Snapdr (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-1974](https://cve.now/CVE-2021-1974.md): Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapdragon Comp (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1971](https://cve.now/CVE-2021-1971.md): Possible assertion due to lack of physical layer state validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1963](https://cve.now/CVE-2021-1963.md): Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto, Snapdragon Compute, S (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1962](https://cve.now/CVE-2021-1962.md): Buffer Overflow while processing IOCTL for getting peripheral endpoint information there is no proper validation for input maximum endpoint (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2021-1961](https://cve.now/CVE-2021-1961.md): Possible buffer overflow due to lack of offset length check while updating the buffer value in Snapdragon Auto, Snapdragon Compute, Snapdrag (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1960](https://cve.now/CVE-2021-1960.md): Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Sn (CVSS 6.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1958](https://cve.now/CVE-2021-1958.md): A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto, Snapdragon Co (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-1957](https://cve.now/CVE-2021-1957.md): Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdr (CVSS 6.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1956](https://cve.now/CVE-2021-1956.md): Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon C (CVSS 6.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1952](https://cve.now/CVE-2021-1952.md): Possible buffer over read occurs due to lack of length check of request buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1948](https://cve.now/CVE-2021-1948.md): Possible out of bound read due to lack of length check of data while parsing the beacon or probe response in Snapdragon Auto, Snapdragon Com (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1946](https://cve.now/CVE-2021-1946.md): Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snap (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1941](https://cve.now/CVE-2021-1941.md): Possible buffer over read issue due to improper length check on WPA IE string sent by peer in Snapdragon Auto, Snapdragon Compute, Snapdrago (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1935](https://cve.now/CVE-2021-1935.md): Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto, Snapdragon Comput (CVSS 7.1, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1934](https://cve.now/CVE-2021-1934.md): Possible memory corruption due to improper check when application loader object is explicitly destructed while application is unloading in S (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1933](https://cve.now/CVE-2021-1933.md): UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1909](https://cve.now/CVE-2021-1909.md): Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon (CVSS 7.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-34786](https://cve.now/CVE-2021-34786.md): Cisco BroadWorks CommPilot Application Software Vulnerabilities (CVSS 6.5, Cisco BroadWorks)
- [CVE-2021-34785](https://cve.now/CVE-2021-34785.md): Cisco BroadWorks CommPilot Application Software Vulnerabilities (CVSS 6.5, Cisco BroadWorks)
- [CVE-2021-34771](https://cve.now/CVE-2021-34771.md): Cisco IOS XR Software Unauthorized Information Disclosure Vulnerability (CVSS 5.5, Cisco IOS XR Software)
- [CVE-2021-34737](https://cve.now/CVE-2021-34737.md): Cisco IOS XR Software DHCP Version 4 Server Denial of Service Vulnerability (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2021-34728](https://cve.now/CVE-2021-34728.md): Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerabilities (CVSS 7.8, Cisco IOS XR Software)
- [CVE-2021-34722](https://cve.now/CVE-2021-34722.md): Cisco IOS XR Software Command Injection Vulnerabilities (CVSS 6.7, Cisco IOS XR Software)
- [CVE-2021-34721](https://cve.now/CVE-2021-34721.md): Cisco IOS XR Software Command Injection Vulnerabilities (CVSS 6.7, Cisco IOS XR Software)
- [CVE-2021-34720](https://cve.now/CVE-2021-34720.md): Cisco IOS XR Software IP Service Level Agreements and Two-Way Active Measurement Protocol Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2021-34719](https://cve.now/CVE-2021-34719.md): Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerabilities (CVSS 7.8, Cisco IOS XR Software)
- [CVE-2021-34718](https://cve.now/CVE-2021-34718.md): Cisco IOS XR Software Arbitrary File Read and Write Vulnerability (CVSS 8.1, Cisco IOS XR Software)
- [CVE-2021-34713](https://cve.now/CVE-2021-34713.md): Cisco IOS XR Software for ASR 9000 Series Routers Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XR Software)
- [CVE-2021-34709](https://cve.now/CVE-2021-34709.md): Cisco IOS XR Software for Cisco 8000 and Network Convergence System 540 Series Routers Image Verification Vulnerabilities (CVSS 6.0, Cisco IOS XR Software)
- [CVE-2021-34708](https://cve.now/CVE-2021-34708.md): Cisco IOS XR Software for Cisco 8000 and Network Convergence System 540 Series Routers Image Verification Vulnerabilities (CVSS 6.0, Cisco IOS XR Software)
- [CVE-2021-32836](https://cve.now/CVE-2021-32836.md): Pre-auth unsafe deserialization in ZStack (CVSS 7.5, zstackio zstack)
- [CVE-2021-32835](https://cve.now/CVE-2021-32835.md): Groovy Sandbox escape in Eclipse Keti (no CVSS, eclipse keti)
- [CVE-2021-32834](https://cve.now/CVE-2021-32834.md): Arbitrary Groovy script evaluation in Eclipse Keti (CVSS 8.2, eclipse keti)
- [CVE-2021-32833](https://cve.now/CVE-2021-32833.md): Unauthenticated file read in Emby Server (CVSS 8.6, MediaBrowser Emby.Releases)
- [CVE-2020-26300](https://cve.now/CVE-2020-26300.md): Command injection in systeminformation (CVSS 5.9, sebhildebrandt systeminformation · systeminformation)
- [CVE-2021-39296](https://cve.now/CVE-2021-39296.md): In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.