CVEs published September 15, 2021
153 CVEs were published on September 15, 2021: 10 critical, 59 high. 9 are now in CISA KEV.
- Published
- 153
- Critical
- 10
- High
- 59
- Medium
- 36
- Low
- 0
- Unrated
- 48
- Now in CISA KEV
- 9
- Fix available
- 91
Most affected products
- Microsoft Windows
- 34
- Autodesk Navisworks
- 4
- glpi-project glpi
- 4
- Microsoft Azure Automation State Configuration, DSC Exte… +8
- 4
- SAP SE SAP Cloud Connector
- 4
- Microsoft 365 Apps for Enterprise
- 3
- SAP SE SAP Business One
- 3
- Autodesk FBX Review
- 2
- Elastic Enterprise Search
- 2
- HGiga OAKlouds OAKSv2 · HGiga OAKlouds OAKSv3
- 2
Critical 10
- CVE-2021-33045The identity authentication bypass vulnerability found in some Dahua products during the login process.Some Dahua IP Camera, Video Intercom, NVR, XVR devices
- CVE-2021-33044The identity authentication bypass vulnerability found in some Dahua products during the login process.Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Ther…
- CVE-2021-37913HGiga OAKlouds - Command Injection-2HGiga OAKlouds OAKSv2 · HGiga OAKlouds OAKSv3
- CVE-2021-37912HGiga OAKlouds - Command Injection-1HGiga OAKlouds OAKSv2 · HGiga OAKlouds OAKSv3
- CVE-2021-37909CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input ValidationCHANGING TSSServiSignAdapter
- CVE-2021-33701DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1SAP SE DMIS Mobile Plug-In · SAP SE SAP S/4HANA
- CVE-2021-33698SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the prSAP SE SAP Business One
- CVE-2021-33690Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service vSAP SE SAP NetWeaver Development Infrastructure
- CVE-2021-38647Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityMicrosoft Azure Automation State Configuration, DSC Exte… +8
- CVE-2021-3751Out-of-bounds Write in bfabiszewski/libmobibfabiszewski/libmobi
High 59
- CVE-2021-33705The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request ForgerSAP SE SAP NetWeaver Enterprise Portal
- CVE-2021-33700SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the vSAP SE SAP Business One
- CVE-2021-39215Authentication Bypass: Forged Tokens Allow Access to Arbitrary Roomsjitsi-meet
- CVE-2021-3795Inefficient Regular Expression Complexity in sindresorhus/semver-regexsindresorhus/semver-regex · semver-regex
- CVE-2021-39209Bypassable CSRF protectionglpi-project glpi
- CVE-2021-21798An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.Nitro Pro
- CVE-2021-3801Inefficient Regular Expression Complexity in prismjs/prismprismjs/prism · prismjs
- CVE-2021-30137Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling.
- CVE-2021-3794Inefficient Regular Expression Complexity in vuelidate/vuelidatevuelidate/vuelidate · @vuelidate/validators
- CVE-2021-3785Cross-site Scripting (XSS) - Stored in yourls/yourlsyourls/yourls
- CVE-2021-27662KT-1 Capture-replayJohnson Controls KT-1
- CVE-2021-40444Microsoft MSHTML Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-40447Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38671Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38667Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38661HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2021-38660Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Excel 2013 Service Pack
- CVE-2021-38659Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2021-38658Microsoft Office Graphics Remote Code Execution VulnerabilityMicrosoft Office 2013 Service Pack · Microsoft Office
- CVE-2021-38656Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2021-38655Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2013… +2
- CVE-2021-38654Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2021-38653Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2021-38652Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2021-38650Microsoft Office Spoofing VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 201… +1
- CVE-2021-38651Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-38649Open Management Infrastructure Elevation of Privilege VulnerabilityMicrosoft Azure Automation State Configuration, DSC Exte… +8
- CVE-2021-38648Open Management Infrastructure Elevation of Privilege VulnerabilityMicrosoft Azure Automation State Configuration, DSC Exte… +8
- CVE-2021-38646Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 201… +1
- CVE-2021-38645Open Management Infrastructure Elevation of Privilege VulnerabilityMicrosoft Azure Automation State Configuration, DSC Exte… +8
- CVE-2021-38644Microsoft MPEG-2 Video Extension Remote Code Execution VulnerabilityMicrosoft MPEG-2 Video Extension
- CVE-2021-38639Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38638Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38634Microsoft Windows Update Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38633Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38630Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38628Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38626Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 Service Pack
- CVE-2021-38625Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 Service Pack
- CVE-2021-36975Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36974Windows SMB Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36973Windows Redirected Drive Buffering System Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36968Windows DNS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36966Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36967Windows WLAN AutoConfig Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36965Windows WLAN AutoConfig Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-36964Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36963Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36960Windows SMB Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36955Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36954Windows Bind Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36952Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2021-26435Windows Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows
- CVE-2021-26434Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2021-3780Cross-site Scripting (XSS) - Stored in chocobozzz/peertubechocobozzz/peertube · peertube
- CVE-2021-3777Inefficient Regular Expression Complexity in daaku/nodejs-tmpldaaku/nodejs-tmpl · tmpl
- CVE-2021-3706Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminltepi-hole/adminlte
- CVE-2021-3778Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-3796Use After Free in vim/vimvim/vim
Medium, low and unrated 84
- CVE-2020-21483An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later ch
- CVE-2020-21482A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a crafted payload in the
- CVE-2020-21481An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later chan
- CVE-2020-21480An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2021-40881An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
- CVE-2021-40639Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemana
- CVE-2020-21322An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.feehi/cms
- CVE-2020-21321emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articl
- CVE-2016-20012OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH s
- CVE-2021-40862HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties
- CVE-2021-33704The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be SAP SE SAP Business One
- CVE-2021-33694SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to SAP SE SAP Cloud Connector
- CVE-2021-33691NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site ScriptinSAP SE SAP NetWeaver Development Infrastructure
- CVE-2021-33693SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that coulSAP SE SAP Cloud Connector
- CVE-2021-33697Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated attSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2021-33695Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.SAP SE SAP Cloud Connector
- CVE-2021-33692SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup.SAP SE SAP Cloud Connector
- CVE-2021-33696SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled inputSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2021-29773IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details causeIBM Security Guardium
- CVE-2021-29750IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infoIBM QRadar SIEM
- CVE-2021-20433IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks againstIBM Security Guardium
- CVE-2021-28901Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to in
- CVE-2021-39205DOM-based XSS/Content Spoofing via Prototype Pollutionjitsi-meet
- CVE-2021-40964A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with
- CVE-2021-40965A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to u
- CVE-2021-40966A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that co
- CVE-2021-39213IP restriction on GLPI API Bypass with custom header injectionglpi-project glpi
- CVE-2021-39211Disclosure of GLPI and server information in telemetry endpointglpi-project glpi
- CVE-2021-39210Autologin cookie accessible by scriptsglpi-project glpi
- CVE-2021-40156A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsingAutodesk Navisworks
- CVE-2021-40155A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing Autodesk Navisworks
- CVE-2021-27046A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciouslyAutodesk Navisworks
- CVE-2021-27045A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing Autodesk Navisworks
- CVE-2021-37412The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.
- CVE-2021-40238A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is
- CVE-2020-21127MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
- CVE-2020-21126MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
- CVE-2020-21124UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
- CVE-2020-21125An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.com.bstek.ureport:ureport2-core
- CVE-2020-21122UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.com.bstek.ureport:ureport2-console
- CVE-2020-21121Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php fi
- CVE-2021-39392The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardco
- CVE-2021-40157A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review verAutodesk FBX Review
- CVE-2021-27044A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted Autodesk FBX Review
- CVE-2020-19159Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=memb
- CVE-2020-19158Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parame
- CVE-2020-19157Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '
- CVE-2020-19156Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Con
- CVE-2020-19155Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary co
- CVE-2020-19151Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template
- CVE-2020-19154Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFi
- CVE-2020-19148Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter i
- CVE-2020-19150Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of servic
- CVE-2020-19147Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' funct
- CVE-2020-19146Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' para
- CVE-2021-39189Observable Response Discrepancy in Lost Password Servicepimcore · pimcore/pimcore
- CVE-2021-38156In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.
- CVE-2021-3797Use of Wrong Operator in String Comparison in hestiacp/hestiacphestiacp/hestiacp
- CVE-2021-39307PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the exe
- CVE-2021-40845The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts
- CVE-2020-3960VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x beforeVMware ESXi, Workstation, and Fusion
- CVE-2021-3783Cross-site Scripting (XSS) - Reflected in yourls/yourlsyourls/yourls
- CVE-2021-22148Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as Elastic Enterprise Search
- CVE-2021-22149Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alteElastic Enterprise Search
- CVE-2021-22147Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots.Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2020-35340A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the runnin
- CVE-2021-40448Microsoft Accessibility Insights for Android Information Disclosure VulnerabilityMicrosoft Accessibility Insights for Android
- CVE-2021-40440Microsoft Dynamics Business Central Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 Business Central 2020 Release Wave 2…
- CVE-2021-38669Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge
- CVE-2021-38657Microsoft Office Graphics Component Information Disclosure VulnerabilityMicrosoft 365 Apps for Enterprise
- CVE-2021-38637Windows Storage Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-38636Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-38635Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-38632Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-38629Windows Ancillary Function Driver for WinSock Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-38624Windows Key Storage Provider Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-36972Windows SMB Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36969Windows Redirected Drive Buffering SubSystem Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36962Windows Installer Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-36961Windows Installer Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-36959Windows Authenticode Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-36956Azure Sphere Information Disclosure VulnerabilityMicrosoft Azure Sphere
- CVE-2021-26437Visual Studio Code Spoofing VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-41061In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154_security component allows attackers to break encryption by triggeri