CVEs published September 23, 2021
104 CVEs were published on September 23, 2021: 7 critical, 23 high. 3 are now in CISA KEV.
- Published
- 104
- Critical
- 7
- High
- 23
- Medium
- 43
- Low
- 2
- Unrated
- 29
- Now in CISA KEV
- 3
- Fix available
- 1
Most affected products
- Cisco IOS XE Software
- 17
- VMware vCenter Server, VMware Cloud Foundation
- 15
- IBM Jazz for Service Management
- 12
- AVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- 6
- Cisco IOS
- 5
- Cisco IOS XE SD-WAN Software
- 5
- IBM Edge
- 4
- IBM Security Verify Bridge
- 4
- https://github.com/concrete5/concrete5
- 3
- IBM Sterling File Gateway
- 3
Critical 7
- CVE-2021-21913An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03.D-Link
- CVE-2021-22941Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely comproCitrix ShareFile storage zones controller
- CVE-2021-22005The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-1619Cisco IOS XE Software NETCONF and RESTCONF Authentication Bypass VulnerabilityCisco IOS XE Software
- CVE-2021-34770Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution VulnerabilityCisco IOS XE Software
- CVE-2021-34727Cisco IOS XE SD-WAN Software Buffer Overflow VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2021-22945When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freedhttps://github.com/curl/curl
High 23
- CVE-2021-41088Remote code execution via the web UI backend of Elvishelves elvish · github.com/elves/elvish
- CVE-2020-4690IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound autheIBM Security Guardium
- CVE-2021-32987AVEVA SuiteLink Server Null Pointer DereferenceAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-32999AVEVA SuiteLink Server Improper Handling of Exceptional ConditionsAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-32979AVEVA SuiteLink Server Null Pointer DereferenceAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-32971AVEVA SuiteLink Server Null Pointer DereferenceAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-32959AVEVA SuiteLink Server Buffer OverflowAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-32963AVEVA SuiteLink Server Null Pointer DereferenceAVEVA Software AVEVA System Platform · AVEVA Software AV… +4
- CVE-2021-1621Cisco IOS XE Software Interface Queue Wedge Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-1620Cisco IOS and IOS XE Software IKEv2 AutoReconnect Feature Denial of Service VulnerabilityCisco IOS
- CVE-2021-1615Cisco Embedded Wireless Controller Software for Catalyst Access Points Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-1611Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers EoGRE Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-1419Cisco Access Points SSH Management Privilege Escalation VulnerabilityCisco Wireless LAN Controller
- CVE-2021-1565Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2021-34769Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2021-34768Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service VulnerabilitiesCisco IOS XE Software
- CVE-2021-34767Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers IPv6 Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-34740Cisco Aironet Access Points WLAN Control Protocol Packet Buffer Leak Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2021-34714Multiple Cisco Operating Systems Unidirectional Link Detection Denial of Service VulnerabilityCisco IOS
- CVE-2021-34699Cisco IOS and IOS XE Software TrustSec CLI Parser Denial of Service VulnerabilityCisco IOS
- CVE-2021-1624Cisco IOS XE Software Rate Limiting Network Address Translation Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-1623Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Simple Network Management Protocol Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2021-1622Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Common Open Policy Service Denial of Service VulnerabilityCisco IOS XE Software
Medium, low and unrated 74
- CVE-2020-19951A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the appli
- CVE-2020-19950A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web script
- CVE-2020-19949A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts
- CVE-2021-38877IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29905IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29904IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read IBM Jazz for Service Management
- CVE-2021-29833IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29832IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29816IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to cross-site request forgery which could allow anIBM Jazz for Service Management
- CVE-2021-29815IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29814IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29813IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29812IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-29810IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2020-24327Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function.
- CVE-2021-38870IBM Aspera Cloud is vulnerable to stored cross-site scripting.IBM Aspera
- CVE-2021-38864IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation.IBM Security Verify Bridge
- CVE-2021-20563IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information.IBM Sterling File Gateway
- CVE-2021-20485IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical erIBM Sterling File Gateway
- CVE-2021-20484IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2021-20435IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive informatiIBM Security Verify Bridge
- CVE-2021-20434IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user.IBM Security Verify Bridge
- CVE-2020-4941IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks agaiIBM Edge
- CVE-2021-38863IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user.IBM Security Verify Bridge
- CVE-2021-29800IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting.IBM Jazz for Service Management
- CVE-2021-20377IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returnedIBM Security Guardium
- CVE-2020-4809IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.IBM Edge
- CVE-2020-4805IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.IBM Edge
- CVE-2020-4803IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system.IBM Edge
- CVE-2021-22276free@home System Access Point FW integrity check can be bypassed.ABB System Access Point · Busch-Jaeger System Access Point
- CVE-2021-26794Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file.
- CVE-2021-36823WordPress Absolutely Glamorous Custom Admin plugin <= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerabilityCusmin AGCA - Absolutely Glamorous Custom Admin
- CVE-2021-36873WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityWebence iQ Block Country
- CVE-2021-36872WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityHector Cabrera WordPress Popular Posts
- CVE-2021-3824OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL.OpenVPN Access Server
- CVE-2021-26750DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U.
- CVE-2021-22948Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniqid() PHP function.https://github.com/revive-adserver/revive-adserver
- CVE-2021-22953A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of diskhttps://github.com/concrete5/concrete5
- CVE-2021-22952A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to UniFi Talk application
- CVE-2021-22950Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for dhttps://github.com/concrete5/concrete5
- CVE-2021-22949A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of dhttps://github.com/concrete5/concrete5
- CVE-2021-22020The vCenter Server contains a denial-of-service vulnerability in the Analytics service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22019The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22018The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22017Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22016The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22014The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure).VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22013The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API.VMware vCenter Server
- CVE-2021-22012The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API.VMware vCenter Server
- CVE-2021-22011vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22010The vCenter Server contains a denial-of-service vulnerability in VPXD service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22009The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22008The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22007The vCenter Server contains a local information disclosure vulnerability in the Analytics service.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-22006The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-21993The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server ContentVMware vCenter Server, VMware Cloud Foundation
- CVE-2021-33035Buffer overflow from a crafted DBF fileApache Software Foundation Apache OpenOffice
- CVE-2021-1616Cisco IOS XE Software H.323 Application Level Gateway Bypass VulnerabilityCisco IOS XE Software
- CVE-2021-1612Cisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2021-1589Cisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure VulnerabilityCisco SD-WAN vManage
- CVE-2021-1546Cisco SD-WAN Software Information Disclosure VulnerabilityCisco SD-WAN Solution
- CVE-2021-34729Cisco IOS XE SD-WAN Software Command Injection VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2021-34726Cisco SD-WAN Software Command Injection VulnerabilityCisco SD-WAN Solution
- CVE-2021-34725Cisco IOS XE SD-WAN Software Command Injection VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2021-34724Cisco IOS XE SD-WAN Software Privilege Escalation VulnerabilityCisco IOS XE SD-WAN Software
- CVE-2021-34705Cisco IOS and IOS XE Software FXO Interface Destination Pattern Bypass VulnerabilityCisco IOS
- CVE-2021-34712Cisco SD-WAN vManage Software Cypher Query Language Injection VulnerabilityCisco SD-WAN vManage
- CVE-2021-34723Cisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityCisco IOS XE Software
- CVE-2021-34703Cisco IOS and IOS XE Software Link Layer Discovery Protocol Denial of Service VulnerabilityCisco IOS
- CVE-2021-34697Cisco IOS XE Software Protection Against Distributed Denial of Service Attacks Feature VulnerabilityCisco IOS XE Software
- CVE-2021-34696Cisco ASR 900 and ASR 920 Series Aggregation Services Routers Access Control List Bypass VulnerabilityCisco IOS XE Software
- CVE-2021-1625Cisco IOS XE Software Zone-Based Policy Firewall ICMP and UDP Inspection VulnerabilityCisco IOS XE Software
- CVE-2021-22015The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories.VMware vCenter Server, VMware Cloud Foundation
- CVE-2021-41381Payara Micro Community 5.2021.6 and below allows Directory Traversal.