CVEs published September 10, 2021
50 CVEs were published on September 10, 2021: 4 critical, 3 high.
- Published
- 50
- Critical
- 4
- High
- 3
- Medium
- 31
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- QNAP Systems NVR Storage Expansion
- 2
- QNAP Systems QTS · QNAP Systems QuTScloud +1
- 2
- Advance Search
- 1
- Border Loading Bar
- 1
- btcpayserver/btcpayserver
- 1
- Bug Library
- 1
- Custom Website Data
- 1
- DJ EmailPublish
- 1
- Dropdown and scrollable Text
- 1
- Edit Comments XT
- 1
Critical 4
- CVE-2021-34346Stack Based Overflow Vulnerability in NVR Storage ExpansionQNAP Systems NVR Storage Expansion
- CVE-2021-34345Stack Based Overflow Vulnerability in NVR Storage ExpansionQNAP Systems NVR Storage Expansion
- CVE-2021-34344Stack Buffer Overflow Vulnerability in QUSBCam2QNAP Systems QUSBCam2
- CVE-2021-28813Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitchQNAP Systems QSW-M2116P-2T2S · QNAP Systems QuNetSwitch
High 3
Medium, low and unrated 43
- CVE-2021-24040Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicioFacebook ParlAI · parlai
- CVE-2021-40347An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5.postorius
- CVE-2021-3145In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication.
- CVE-2021-40864The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields.
- CVE-2021-3646Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2021-37422Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases.
- CVE-2021-37423Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover.
- CVE-2021-37414Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication.
- CVE-2021-38357SMS OVH <= 0.1 Reflected Cross-Site ScriptingSMS OVH
- CVE-2021-38358MoolaMojo <= 0.7.4.1 Reflected Cross-Site ScriptingMoolaMojo
- CVE-2021-38359WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site ScriptingWordPress InviteBox Plugin
- CVE-2021-38354GNU-Mailman Integration <= 1.0.6 Reflected Cross-Site ScriptingGNU-Mailman Integration
- CVE-2021-38327YouTube Video Inserter <= 1.2.1.0 Reflected Cross-Site ScriptingYouTube Video Inserter
- CVE-2021-38339Simple Matted Thumbnails <= 1.01 Reflected Cross-Site ScriptingSimple Matted Thumbnails
- CVE-2021-38347Custom Website Data <= 2.2 Reflected Cross-Site ScriptingCustom Website Data
- CVE-2021-38355Bug Library <= 2.0.3 Reflected Cross-Site ScriptingBug Library
- CVE-2021-38336Edit Comments XT <= 1.0 Reflected Cross-Site ScriptingEdit Comments XT
- CVE-2021-40373playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core_main_config, and then execut
- CVE-2021-38335Wise Agent Capture Forms <= 1.0 Reflected Cross-Site ScriptingWise Agent Capture Forms
- CVE-2021-38329DJ EmailPublish <= 1.7.2 Reflected Cross-Site ScriptingDJ EmailPublish
- CVE-2021-38328Notices <= 6.1 Reflected Cross-Site ScriptingNotices
- CVE-2021-38338Border Loading Bar <= 1.0.1 Reflected Cross-Site ScriptingBorder Loading Bar
- CVE-2021-38331WP-T-Wap <= 1.13.2 Reflected Cross-Site ScriptingWP-T-Wap
- CVE-2021-38333WP Scrippets <= 1.5.1 Reflected Cross-Site ScriptingWP Scrippets
- CVE-2021-38352Feedify – Web Push Notifications <= 2.1.8 Reflected Cross-Site ScriptingFeedify – Web Push Notifications
- CVE-2021-38341WooCommerce Payment Gateway Per Category <= 2.0.10 Reflected Cross-Site ScriptingWooCommerce Payment Gateway Per Category
- CVE-2021-38340Wordpress Simple Shop <= 1.2 Reflected Cross-Site ScriptingWordpress Simple Shop
- CVE-2021-38349Integration of Moneybird for WooCommerce <= 2.1.1 Reflected Cross-Site ScriptingIntegration of Moneybird for WooCommerce
- CVE-2021-38353Dropdown and scrollable Text <= 2.0 Reflected Cross-Site ScriptingDropdown and scrollable Text
- CVE-2021-38326Post Title Counter <= 1.1 Reflected Cross-Site ScriptingPost Title Counter
- CVE-2021-38348Advance Search <= 1.1.2 Reflected Cross-Site ScriptingAdvance Search
- CVE-2021-38332On Page SEO + Whatsapp Chat Button <= 1.0.1 Reflected Cross-Site ScriptingOn Page SEO + Whatsapp Chat Button
- CVE-2021-38337RSVPMaker Excel <= 1.1 Reflected Cross-Site ScriptingRSVPMaker Excel
- CVE-2021-38330Yet Another bol.com Plugin <= 1.4 Reflected Cross-Site ScriptingYet Another bol.com Plugin
- CVE-2021-38334WP Design Maps & Places <= 1.2 Reflected Cross-Site ScriptingWP Design Maps & Places
- CVE-2021-38350spideranalyse <= 0.0.1 Reflected Cross-Site Scriptingspideranalyse
- CVE-2021-38351OSD Subscribe <= 1.2.3 Reflected Cross-Site ScriptingOSD Subscribe
- CVE-2021-33011All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be ableJTEKT Corporation TOYOPUC products
- CVE-2021-35976The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-previe
- CVE-2021-3645Prototype Pollution in viking04/mergeviking04/merge · @viking04/merge
- CVE-2021-34343Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloudQNAP Systems QTS · QNAP Systems QuTScloud +1
- CVE-2018-19957Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2021-40839The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack rencode