CVEs published September 14, 2021
100 CVEs were published on September 14, 2021: 7 critical, 5 high. 1 is now in CISA KEV.
- Published
- 100
- Critical
- 7
- High
- 5
- Medium
- 22
- Low
- 2
- Unrated
- 64
- Now in CISA KEV
- 1
- Fix available
- 22
Most affected products
- BIG-IP
- 15
- BIG-IP Advanced WAF and BIG-IP ASM
- 7
- Siemens SINEMA Remote Connect Server
- 6
- Atlassian Jira Server · Atlassian Jira Data Center
- 5
- SAP SE SAP Business One
- 4
- SAP SE SAP Contact Center
- 4
- IBM Security Secret Server
- 3
- Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8
- 3
- Siemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1
- 3
- Siemens Teamcenter
- 3
Critical 7
- CVE-2021-35493TIBCO WebFOCUS Cross Site Scripting vulnerabilitiesTIBCO Software TIBCO WebFOCUS Client · TIBCO Software TI… +1
- CVE-2021-33672Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chaSAP SE SAP Contact Center
- CVE-2021-38163SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administraSAP SE SAP NetWeaver
- CVE-2021-37535SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary authSAP SE SAP NetWeaver Application Server Java
- CVE-2021-38176Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed inSAP SE SAP S/4HANA · SAP SE SAP LT Replication Server +3
- CVE-2021-37531SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a noSAP SE SAP NetWeaver Knowledge Management XML Forms
- CVE-2021-27391A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versionsSiemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +4
High 5
- CVE-2021-38177SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends cSAP SE SAP CommonCryptoLib
- CVE-2021-33673Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them.SAP SE SAP Contact Center
- CVE-2021-38162SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7SAP SE SAP Web Dispatcher
- CVE-2021-33737A vulnerability has been identified in SIMATIC CP 343-1 (incl.Siemens SIMATIC CP 343-1 · Siemens SIMATIC CP 443-1 +1
- CVE-2021-39123Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability vAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 88
- CVE-2021-23029On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-SideBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23026BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and BIG-IP & BIG-IQ
- CVE-2021-23027On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability BIG-IP
- CVE-2021-23025On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated rBIG-IP
- CVE-2021-23028On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are BIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23030On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1BIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23031On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befoBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23036On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can causeBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23034On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual seBIG-IP
- CVE-2021-23037On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists iBIG-IP
- CVE-2021-23032On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS systBIG-IP DNS
- CVE-2021-39391Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated bgithub.com/beego/beego/v2
- CVE-2021-23038On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a stoBIG-IP
- CVE-2021-23035On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked respBIG-IP
- CVE-2021-23033On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, aBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23039On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is configBIG-IP
- CVE-2021-23045On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.xBIG-IP
- CVE-2020-21082A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal
- CVE-2020-21081A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a
- CVE-2021-23044On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x andBIG-IP
- CVE-2020-21050Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
- CVE-2020-21049An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted P
- CVE-2020-21048An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
- CVE-2021-41077The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is
- CVE-2021-23042On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when aBIG-IP
- CVE-2021-23040On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1BIG-IP AFM
- CVE-2021-23043On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an uBIG-IP
- CVE-2021-23046On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from AcceBIG-IP Guided Configuration
- CVE-2021-23041On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, BIG-IP
- CVE-2021-23047On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP APBIG-IP APM
- CVE-2021-29841IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting.IBM Financial Transaction Manager
- CVE-2021-20582IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters.IBM Security Secret Server
- CVE-2021-20569IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation.IBM Security Secret Server
- CVE-2021-20508IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message IBM Security Secret Server
- CVE-2021-23049On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, BIG-IP
- CVE-2021-23048On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.xBIG-IP
- CVE-2021-23050On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3BIG-IP Advanced WAF and BIG-IP ASM; NGINX App Protect
- CVE-2021-23053On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP AdvanBIG-IP Advanced WAF and BIG-IP ASM
- CVE-2021-23052On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IPBIG-IP APM
- CVE-2021-23051On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIGBIG-IP
- CVE-2021-36581Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload.
- CVE-2021-36582In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell f
- CVE-2021-32202In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation pa
- CVE-2021-38174When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-33688SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database.SAP SE SAP Business One
- CVE-2021-33686Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informaSAP SE SAP Business One
- CVE-2021-33674Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.SAP SE SAP Contact Center
- CVE-2021-33685SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are outSAP SE SAP Business One
- CVE-2021-38175SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gatherSAP SE SAP Analysis for Microsoft Office
- CVE-2021-33675Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs.SAP SE SAP Contact Center
- CVE-2021-33679The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script SAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2021-38164SAP ERP Financial Accounting (RFOPENPOSTING_FR) versions - SAP_APPL - 600, 602, 603, 604, 605, 606, 616, SAP_FIN - 617, 618, 700, 720, 730, SAP SE SAP ERP Financial Accounting
- CVE-2021-37532SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conteSAP SE SAP Business One
- CVE-2021-21489SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resultiSAP SE SAP NetWeaver Enterprise Portal
- CVE-2021-38150When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP SAP SE SAP Business Client
- CVE-2021-40357A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.10), Teamcenter Active Workspace V5.0 (All versSiemens Teamcenter Active Workspace
- CVE-2021-40356A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter Siemens Teamcenter
- CVE-2021-40355A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter Siemens Teamcenter
- CVE-2021-40354A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.8), Teamcenter V13.0 (All versions < V13.0.0.7), Teamcenter Siemens Teamcenter
- CVE-2021-37206A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsSiemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1
- CVE-2021-37203A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).Siemens NX 1980 Series · Siemens Solid Edge SE2021
- CVE-2021-37202A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).Siemens NX 1980 Series · Siemens Solid Edge SE2021
- CVE-2021-37201A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1).Siemens SINEC NMS
- CVE-2021-37200A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1).Siemens SINEC NMS
- CVE-2021-37193A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37192A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37190A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37191A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37186A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATIC RTU3010C (All versiSiemens LOGO! CMR2020 · Siemens LOGO! CMR2040 +4
- CVE-2021-37184A vulnerability has been identified in Industrial Edge Management (All versions < V1.3).Siemens Industrial Edge Management
- CVE-2021-37183A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37181A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions),Siemens Cerberus DMS · Siemens Desigo CC Compact +1
- CVE-2021-37177A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2).Siemens SINEMA Remote Connect Server
- CVE-2021-37176A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions).Siemens Simcenter Femap
- CVE-2021-37175A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCSiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8
- CVE-2021-37174A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCSiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8
- CVE-2021-37173A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCSiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8
- CVE-2021-33720A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsSiemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1
- CVE-2021-33719A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 relays with CPU variantsSiemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1
- CVE-2021-33716A vulnerability has been identified in SIMATIC CP 1543-1 (incl.Siemens SIMATIC CP 1543-1 · Siemens SIMATIC CP 1545-1
- CVE-2021-31891A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on DebSiemens Desigo CC · Siemens GMA-Manager +2
- CVE-2021-25665A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1).Siemens Simcenter STAR-CCM+ Viewer
- CVE-2019-10941A vulnerability has been identified in SINEMA Server (All versions < V14 SP3).Siemens SINEMA Server
- CVE-2021-39125Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumerAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2019-20101Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access ContAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-39118Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an eAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-39124The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote attAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-41072squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153.