CVEs published September 13, 2021
66 CVEs were published on September 13, 2021: 3 critical, 14 high. 1 is now in CISA KEV.
- Published
- 66
- Critical
- 3
- High
- 14
- Medium
- 4
- Low
- 0
- Unrated
- 45
- Now in CISA KEV
- 1
- Fix available
- 21
Most affected products
- Geutebrück E2 Series · Geutebrück Encoder G-Code
- 12
- Micro Focus NetIQ Access Manager
- 4
- Per page add to head
- 2
- Book appointment online
- 1
- Comment Link Remove and Other Comment Tools
- 1
- Custom Post View Generator
- 1
- Daily Prayer Time
- 1
- Email Artillery
- 1
- Fileviewer
- 1
- fiznool/body-parser-xml · body-parser-xml
- 1
Critical 3
- CVE-2021-33543UDP Technology/Geutebrück camera devices: Authentication BypassGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-40870An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922.
- CVE-2021-40866Certain NETGEAR smart switches are affected by a remote admin password change by an unauthenticated attacker via the (disabled by default) /
High 14
- CVE-2021-3666Prototype Pollution in fiznool/body-parser-xmlfiznool/body-parser-xml · body-parser-xml
- CVE-2021-33554UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33553UDP Technology/Geutebrück camera devices: Command injection in command parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33552UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33551UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33550UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33549UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33548UDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33547UDP Technology/Geutebrück camera devices: Buffer overflow in profile parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33546UDP Technology/Geutebrück camera devices: Buffer overflow in name parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33545UDP Technology/Geutebrück camera devices: Buffer overflow in counter parameter leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-33544UDP Technology/Geutebrück camera devices: command injection leading to RCEGeutebrück E2 Series · Geutebrück Encoder G-Code
- CVE-2021-22528Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1Micro Focus NetIQ Access Manager
- CVE-2021-40867Certain NETGEAR smart switches are affected by an authentication hijacking race-condition vulnerability by an unauthenticated attacker who u
Medium, low and unrated 49
- CVE-2020-20672An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file.
- CVE-2020-20671A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account.
- CVE-2020-20670An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTM
- CVE-2021-41033In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerable to man-in-the-middThe Eclipse Foundation Eclipse Equinox
- CVE-2021-41054tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the combination of data, O
- CVE-2021-32139The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file
- CVE-2021-32138The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the
- CVE-2021-40824A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) beforg.matrix.android:matrix-android-sdk2
- CVE-2021-33362Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or exec
- CVE-2021-40823A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix hommatrix-js-sdk
- CVE-2021-24728Paid Member Subscriptions < 2.4.2 - Authenticated SQL InjectionMembership & Content Restriction – Paid Member Subscriptions
- CVE-2021-24727Block and Stop Bad Bots < 6.60 - Authenticated SQL InjectionsWP Block and Stop Bad Bots Crawlers and Spiders and Anti Sp…
- CVE-2021-24726WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL InjectionWP Simple Booking Calendar
- CVE-2021-24725Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRFComment Link Remove and Other Comment Tools
- CVE-2021-24724Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site ScriptingTimetable and Event Schedule by MotoPress
- CVE-2021-24623WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)WordPress Advanced Ticket System, Elite Support Helpdesk
- CVE-2021-24621WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed CodeWP Courses LMS
- CVE-2021-24620Simple eCommerce <= 2.2.5 - Arbitrary File UploadWordPress Simple Ecommerce Shopping Cart Plugin- Sell produ…
- CVE-2021-24619Per Page Add to Head <= 1.4.4 - Authenticated Stored XSSPer page add to head
- CVE-2021-24614Book appointment Online < 1.39 - Authenticated Stored Cross-Site Scripting (XSS)Book appointment online
- CVE-2021-24605Custom Post View Generator <= 0.4.6 - Reflected Cross-Site ScriptingCustom Post View Generator
- CVE-2021-24586Per Page Add to Head < 1.4.4 - CSRF to Stored XSSPer page add to head
- CVE-2021-24560Software License Manager < 4.4.8 - Reflected Cross-Site ScriptingSoftware License Manager
- CVE-2021-24523Daily Prayer Time < 2021.08.10 - Authenticated Stored XSSDaily Prayer Time
- CVE-2021-24510MF Gig Calendar < 1.2 - Reflected Cross-Site Scripting (XSS)MF Gig Calendar
- CVE-2021-24508Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSSSmash Balloon Social Post Feed
- CVE-2021-24493Shopp eCommerce <= 1.4 - Unauthenticated Arbitrary File UploadShopp
- CVE-2021-24491Fileviewer <= 2.2 - Arbitrary File Upload/Deletion via CSRFFileviewer
- CVE-2021-24490Email Artillery <= 4.1 - Arbitrary File UploadEmail Artillery
- CVE-2021-24431Language Bar Flags <= 1.0.8 - CSRF to Stored XSSLanguage Bar Flags
- CVE-2021-38833SQL injection vulnerability in PHPGurukul Apartment Visitors Management System (AVMS) v.
- CVE-2021-29643PRTG Network Monitor before 21.3.69.1333 allows stored XSS via an unsanitized string imported from a User Object in a connected Active Direc
- CVE-2021-32132The abst_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the
- CVE-2021-32135The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the
- CVE-2021-32137Heap buffer overflow in the URL_GetProtocolType function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute ar
- CVE-2021-32134The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in t
- CVE-2021-32136Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary c
- CVE-2021-22526Open Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1Micro Focus NetIQ Access Manager
- CVE-2021-22524Denial of service vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1Micro Focus NetIQ Access Manager
- CVE-2021-22527Information leakage vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1Micro Focus NetIQ Access Manager
- CVE-2020-27970Yandex Browser before 20.10.0 allows remote attackers to spoof the address barYandex Browser Lite for Android
- CVE-2020-27969Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofingYandex Browser for Android
- CVE-2021-40214Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.
- CVE-2021-33361Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-33363Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-33364Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-33365Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-33366Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- CVE-2021-39212Issue when Configuring the ImageMagick Security PolicyImageMagick