CVEs published September 17, 2021
50 CVEs were published on September 17, 2021: 2 critical, 16 high. 1 is now in CISA KEV.
- Published
- 50
- Critical
- 2
- High
- 16
- Medium
- 9
- Low
- 0
- Unrated
- 23
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- bytecodealliance wasmtime · wasmtime
- 3
- Delta Electronics DOPSoft
- 3
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 3
- J’s Communication Co. RevoWorks Browser
- 2
- McAfee Endpoint Security (ENS) for WIndows
- 2
- pi-hole/adminlte
- 2
- @cookiex/deep
- 1
- ActiveFusions Co. Order Status Batch Change Plug-in
- 1
- AITpro BulletProof Security
- 1
- Apache Software Foundation Apache Shiro · org.apache.shiro:…
- 1
Critical 2
- CVE-2021-38412Digi PortServer TS 16 Improper AuthenticationDigi International PortServer TS
- CVE-2021-1976A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
High 16
- CVE-2021-38404Delta Electronics DOPSoft 2 Heap-based Buffer OverflowDelta Electronics DOPSoft
- CVE-2021-38402Delta Electronics DOPSoft 2 Stack-Based Buffer OverflowDelta Electronics DOPSoft
- CVE-2021-38406Delta Electronics DOPSoft 2 Out-of-Bounds WriteDelta Electronics DOPSoft
- CVE-2021-31844Local Privilege Escalation in McAfee DLP Endpoint for WindowsMcAfee Data Loss Prevention (DLP) Endpoint for Windows
- CVE-2021-31845Remote Code Execution in McAfee DLP DiscoverMcAfee Data Loss Prevention (DLP) Discover
- CVE-2021-31843Improper access control vulnerability in McAfee ENS for WindowsMcAfee Endpoint Security (ENS) for WIndows
- CVE-2021-23442Prototype Pollution@cookiex/deep
- CVE-2021-30261Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in SQualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…
- CVE-2021-30260Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configuratQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1947Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity,Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2021-1939Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-3810Inefficient Regular Expression Complexity in cdr/code-servercdr/code-server · code-server
- CVE-2021-3804Inefficient Regular Expression Complexity in nervjs/taronervjs/taro · @tarojs/helper
- CVE-2021-3803Inefficient Regular Expression Complexity in fb55/nth-checkfb55/nth-check · nth-check
- CVE-2021-3805Prototype Pollution in mariocasciaro/object-pathmariocasciaro/object-path · object-path
- CVE-2021-3807Inefficient Regular Expression Complexity in chalk/ansi-regexchalk/ansi-regex · ansi-regex
Medium, low and unrated 32
- CVE-2021-41392static/main-preload.js in Boost Note through 0.22.0 allows remote command execution.
- CVE-2021-41391In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XS
- CVE-2021-41390In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Inj
- CVE-2021-41387seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root.
- CVE-2020-21548Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel_encode_highcolor function in tosixel.c.
- CVE-2020-21547Libsixel 1.8.2 contains a heap-based buffer overflow in the dither_func_fs function in tosixel.c.
- CVE-2021-39218Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtimebytecodealliance wasmtime · wasmtime
- CVE-2021-39219Wrong type for `Linker`-define functions when used across two `Engine`sbytecodealliance wasmtime · wasmtime
- CVE-2021-39216Use after free passing `externref`s to Wasm in Wasmtimebytecodealliance wasmtime · wasmtime
- CVE-2021-41383setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp_server f
- CVE-2021-41380RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data.
- CVE-2020-12083An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64).
- CVE-2020-12082A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-6
- CVE-2020-12080A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6.
- CVE-2021-40825nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability.
- CVE-2021-38304Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially
- CVE-2019-9060An issue was discovered in CMS Made Simple 2.2.8.
- CVE-2021-41317XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.
- CVE-2021-41315The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility.
- CVE-2021-41316The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility.
- CVE-2021-39227Fix prototype pollution in the zrender merge and clone helper methodsecomfe zrender · zrender
- CVE-2021-39228Memory Safety Issue when using patch or merge on state and assign the result back to statetremor-rs tremor-runtime · tremor-script
- CVE-2021-31842XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a loMcAfee Endpoint Security (ENS) for WIndows
- CVE-2021-39327BulletProof Security <= 5.1 Sensitive Information DisclosureAITpro BulletProof Security
- CVE-2021-41303Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2021-3812Cross-site Scripting (XSS) - Reflected in pi-hole/adminltepi-hole/adminlte
- CVE-2021-3811Cross-site Scripting (XSS) - Reflected in pi-hole/adminltepi-hole/adminlte
- CVE-2021-20828Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to inActiveFusions Co. Order Status Batch Change Plug-in
- CVE-2021-20825Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remoshiro8 Co. List (order management) item change plug-in
- CVE-2021-20791Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access restriction and to exchanJ’s Communication Co. RevoWorks Browser
- CVE-2021-20790Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary commJ’s Communication Co. RevoWorks Browser
- CVE-2021-41326In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.