CVEs published September 22, 2021
24 CVEs were published on September 22, 2021: 1 critical, 2 high. 1 is now in CISA KEV.
- Published
- 24
- Critical
- 1
- High
- 2
- Medium
- 4
- Low
- 1
- Unrated
- 16
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- McAfee Agent for Windows
- 3
- Saturday Drive Ninja Forms
- 2
- VMware vCenter Server, VMware Cloud Foundation
- 2
- ansible
- 1
- Apache Software Foundation Apache Kafka · org.apache.kaf… +3
- 1
- leo
- 1
- LINE client for iOS
- 1
- Mattermost · github.com/mattermost/mattermost-server/v5 +1
- 1
- Octopus Deploy Halibut · Halibut
- 1
- Telefication
- 1
Critical 1
High 2
Medium, low and unrated 21
- CVE-2020-23481CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web
- CVE-2020-23478Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/leo
- CVE-2020-23469gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.
- CVE-2021-21992The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-21991The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-34647Ninja Forms <= 3.5.7 Sensitive Information DisclosureSaturday Drive Ninja Forms
- CVE-2021-34648Ninja Forms <= 3.5.7 Unprotected REST-API to Email InjectionSaturday Drive Ninja Forms
- CVE-2021-37860Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary webMattermost · github.com/mattermost/mattermost-server/v5 +1
- CVE-2019-6288Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.
- CVE-2021-40684Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint
- CVE-2021-41011LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditioLINE client for iOS
- CVE-2021-40875Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure.
- CVE-2021-37927Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.
- CVE-2021-31836Improper Privilege Management in MA for WindowsMcAfee Agent for Windows
- CVE-2021-37925Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.
- CVE-2021-39404MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.
- CVE-2021-39339Telefication <= 1.8.0 Open Proxy and Server-Side Request ForgeryTelefication
- CVE-2021-38153Timing Attack Vulnerability for Apache Kafka Connect and ClientsApache Software Foundation Apache Kafka · org.apache.kaf… +3
- CVE-2021-38112In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote
- CVE-2021-31819In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already tOctopus Deploy Halibut · Halibut
- CVE-2021-3583A flaw was found in Ansible, where a user's controller is vulnerable to template injection.ansible