CVEs published September 16, 2021
48 CVEs were published on September 16, 2021: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 48
- Critical
- 1
- High
- 2
- Medium
- 8
- Low
- 1
- Unrated
- 36
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- Apache Software Foundation Apache HTTP Server
- 4
- IBM DB2 for Linux, UNIX and Windows
- 3
- Xiaomi Router AX3600
- 3
- Enbra AT-WMBUS-16-2 · Enbra ER-AM DN +1
- 2
- NetMotion Mobility
- 2
- adamhathcock sharpcompress · SharpCompress
- 1
- Apache Software Foundation Apache Jena · org.apache.jena:je…
- 1
- Apache Software Foundation Apache Tomcat · tomcat +1
- 1
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- Enbra EWM
- 1
Critical 1
High 2
Medium, low and unrated 45
- CVE-2021-41314Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the a
- CVE-2020-21535fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c.
- CVE-2020-21534fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c.
- CVE-2020-21533fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c.
- CVE-2020-21530fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.
- CVE-2021-40670SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.
- CVE-2021-40669SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.
- CVE-2021-29842IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames dIBM WebSphere Application Server
- CVE-2021-29825IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACIBM DB2 for Linux, UNIX and Windows
- CVE-2021-29763IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to IBM DB2 for Linux, UNIX and Windows
- CVE-2021-29752IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specifIBM DB2 for Linux, UNIX and Windows
- CVE-2021-41079Apache Tomcat DoS with unexpected TLS packetApache Software Foundation Apache Tomcat · tomcat +1
- CVE-2021-39275ap_escape_quotes buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2021-39239XML External Entity (XXE) vulnerabilityApache Software Foundation Apache Jena · org.apache.jena:je…
- CVE-2021-36160mod_proxy_uwsgi out of bound readApache Software Foundation Apache HTTP Server
- CVE-2021-34798NULL pointer dereference in httpd coreApache Software Foundation Apache HTTP Server
- CVE-2021-39208WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal.adamhathcock sharpcompress · SharpCompress
- CVE-2021-27340OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter.
- CVE-2021-27341OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parame
- CVE-2021-34576Observable discrepancy in Kaden PICOFLUX AiR leaks water consumptionKaden PICOFLUX AiR
- CVE-2021-34573Incorrect calculation in Enbra EWM does not report backflows or no flow eventsEnbra AT-WMBUS-16-2 · Enbra ER-AM DN +1
- CVE-2021-34572Insufficient Verification of Data Authenticity in Enbra EWM (replay attack)Enbra EWM
- CVE-2021-34571Hard-coded Credentials in Enbra Wireless M-Bus devicesEnbra AT-WMBUS-16-2 · Enbra ER-AM DN +1
- CVE-2020-14124There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM versXiaomi Router AX3600
- CVE-2020-14119There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on Xiaomi Router AX3600
- CVE-2020-14109There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on XiaomXiaomi Router AX3600
- CVE-2020-14130Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app AffectXiaomi community app
- CVE-2021-40067The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default.NetMotion Mobility
- CVE-2021-40066The access controls on the Mobility read-only API improperly validate user access permissions.NetMotion Mobility
- CVE-2020-21529fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.
- CVE-2020-21531fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.
- CVE-2020-21532fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.
- CVE-2020-21594libde265 v1.0.4 contains a heap buffer overflow in the put_epel_hv_fallback function, which can be exploited via a crafted a file.
- CVE-2020-21595libde265 v1.0.4 contains a heap buffer overflow in the mc_luma function, which can be exploited via a crafted a file.
- CVE-2020-21596libde265 v1.0.4 contains a global buffer overflow in the decode_CABAC_bit function, which can be exploited via a crafted a file.
- CVE-2020-21597libde265 v1.0.4 contains a heap buffer overflow in the mc_chroma function, which can be exploited via a crafted a file.
- CVE-2020-21598libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploited via a crafted a fi
- CVE-2020-21599libde265 v1.0.4 contains a heap buffer overflow in the de265_image::available_zscan function, which can be exploited via a crafted a file.
- CVE-2020-21600libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_pred_avg_16_fallback function, which can be exploited via a crafted a fi
- CVE-2020-21601libde265 v1.0.4 contains a stack buffer overflow in the put_qpel_fallback function, which can be exploited via a crafted a file.
- CVE-2020-21602libde265 v1.0.4 contains a heap buffer overflow in the put_weighted_bipred_16_fallback function, which can be exploited via a crafted a file
- CVE-2020-21603libde265 v1.0.4 contains a heap buffer overflow in the put_qpel_0_0_fallback_16 function, which can be exploited via a crafted a file.
- CVE-2020-21604libde265 v1.0.4 contains a heap buffer overflow fault in the _mm_loadl_epi64 function, which can be exploited via a crafted a file.
- CVE-2020-21605libde265 v1.0.4 contains a segmentation fault in the apply_sao_internal function, which can be exploited via a crafted a file.
- CVE-2020-21606libde265 v1.0.4 contains a heap buffer overflow fault in the put_epel_16_fallback function, which can be exploited via a crafted a file.