CVEs published September 21, 2021
30 CVEs were published on September 21, 2021: 0 critical, 4 high.
- Published
- 30
- Critical
- 0
- High
- 4
- Medium
- 4
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 7
Most affected products
- AMD PSP Driver
- 1
- Android
- 1
- edge.js
- 1
- FrankEnderman Butter
- 1
- http4s · org.http4s:http4s-client_2.12 +8
- 1
- IBM Jazz for Service Management
- 1
- IBM PowerVM Hypervisor
- 1
- in-toto-golang · github.com/in-toto/in-toto-golang
- 1
- jointjs
- 1
- jsuites
- 1
High 4
- CVE-2021-41086Clipboard-based XSS in jsuitesjsuites
- CVE-2021-41084Response Splitting from unsanitized headers in http4shttp4s · org.http4s:http4s-client_2.12 +8
- CVE-2021-39230Error in JPNS kernel of ButterFrankEnderman Butter
- CVE-2021-29831IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Injection (XXE) attack wIBM Jazz for Service Management
Medium, low and unrated 26
- CVE-2021-41382Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.
- CVE-2020-23273Heap-buffer overflow in the randomize_iparp function in edit_packet.c.
- CVE-2020-23269An issue was discovered in gpac 0.8.0.
- CVE-2020-23266An issue was discovered in gpac 0.8.0.
- CVE-2020-23267An issue was discovered in gpac 0.8.0.
- CVE-2021-41087Improperly Implemented path matching for in-toto-golangin-toto-golang · github.com/in-toto/in-toto-golang
- CVE-2020-19554Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.
- CVE-2020-19553Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/lib
- CVE-2020-19551Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code execution
- CVE-2021-40847The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code executio
- CVE-2021-23444Prototype Pollutionjointjs
- CVE-2021-23443Cross-site Scripting (XSS)edge.js
- CVE-2021-40868In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.
- CVE-2021-29795IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls frIBM PowerVM Hypervisor
- CVE-2021-41525An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNet inventory agent an
- CVE-2021-41531Invalid RPKI data could disable Route Origin Validation on RTR clients.NLnet Labs Routinator
- CVE-2021-37741ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities.
- CVE-2021-37419Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF.
- CVE-2021-37420Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
- CVE-2021-37424ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.
- CVE-2021-28960Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input comman
- CVE-2021-0869In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-26333AMD Chipset Driver Information Disclosure VulnerabilityAMD PSP Driver
- CVE-2021-31917A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0).Red Hat DataGrid and Infinispan
- CVE-2021-20829Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to eWESEEK GROWI
- CVE-2021-20037SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalatiSonicWall Global VPN Client