CVEs published September 24, 2021
25 CVEs were published on September 24, 2021: 0 critical, 3 high. 1 is now in CISA KEV.
- Published
- 25
- Critical
- 0
- High
- 3
- Medium
- 0
- Low
- 0
- Unrated
- 22
- Now in CISA KEV
- 1
- Fix available
- 3
Most affected products
- GitHub Enterprise Server
- 2
- Apache Software Foundation Apache Druid · org.apache.druid:…
- 1
- Oracle Linux
- 1
- Ping Identity PingAccess
- 1
- ZTE Axon 30 Pro Message Service App
- 1
High 3
Medium, low and unrated 22
- CVE-2021-21742There is an information leak vulnerability in the message service app of a ZTE mobile phone.ZTE Axon 30 Pro Message Service App
- CVE-2020-20514A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all u
- CVE-2020-20508Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hi
- CVE-2021-40654An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt.
- CVE-2021-41504An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older.
- CVE-2021-39246Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion address
- CVE-2021-22868Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2021-22869Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control groupGitHub Enterprise Server
- CVE-2021-28130Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web.
- CVE-2021-40309A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0.
- CVE-2021-40310OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss
- CVE-2021-40099An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40100An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40102An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-41586In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
- CVE-2021-41587In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other re
- CVE-2021-41588In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects.
- CVE-2021-36749Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)Apache Software Foundation Apache Druid · org.apache.druid:…
- CVE-2021-41584Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configura
- CVE-2021-31923Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.Ping Identity PingAccess
- CVE-2021-41583vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated
- CVE-2021-41581x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read.