CVEs published September 27, 2021
115 CVEs were published on September 27, 2021: 4 critical, 21 high. 1 is now in CISA KEV.
- Published
- 115
- Critical
- 4
- High
- 21
- Medium
- 20
- Low
- 1
- Unrated
- 69
- Now in CISA KEV
- 1
- Fix available
- 31
Most affected products
- MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- 8
- StylemixThemes uListing
- 6
- Adobe Experience Manager
- 4
- Adobe Premiere
- 4
- PostX – Gutenberg Blocks for Post Grid
- 4
- Adobe Digital Editions
- 3
- gilacms/gila
- 3
- openvpn-monitor
- 3
- QNAP Systems QVR
- 3
- Zoom Client for Meetings for Windows
- 3
Critical 4
- CVE-2021-41097Prototype pollution in aurelia-pathaurelia path · aurelia-path
- CVE-2021-36879WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerabilityStylemixThemes uListing
- CVE-2021-34351Command Injection Vulnerability in QVRQNAP Systems QVR
- CVE-2021-34348Command Injection Vulnerability in QVRQNAP Systems QVR
High 21
- CVE-2021-41098Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRubysparklemotion nokogiri · nokogiri
- CVE-2021-41096Use of a Broken or Risky Cryptographic Algorithm in com.mayank.ruckymayankmetha Rucky
- CVE-2021-36134Out of bounds write in Netop Vision Pro
- CVE-2021-40700Adobe Premiere Elements TIFF Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Premiere
- CVE-2021-40709Adobe Photoshop Buffer Overflow leads to Arbitrary Code ExecutionAdobe Photoshop
- CVE-2021-40701Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Premiere
- CVE-2021-40703Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Not a product
- CVE-2021-39825Adobe Photoshop Elements Edit 2021 TTF Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Photoshop Elements
- CVE-2021-40702Adobe Premiere Elements psd Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Premiere
- CVE-2021-39824Adobe Premiere Elements png Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe Premiere
- CVE-2021-28613Adobe Creative Cloud Arbitrary File Overwrite VulnerabilityAdobe Creative Cloud
- CVE-2021-39818Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe InCopy
- CVE-2021-39826Adobe Digital Editions Command Execution VulnerabilityAdobe Digital Editions
- CVE-2021-39819Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code ExecutionAdobe InCopy
- CVE-2021-39823svg-native-viewer Heap Buffer overflow VulnerabilityAdobe SVG Native Viewer
- CVE-2021-36880WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerabilityStylemixThemes uListing
- CVE-2021-36874WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerabilityStylemixThemes uListing
- CVE-2021-34409Zoom Client Installer Local Privilege EscalationZoom Video Communications Zoom Client for Meetings for M… +1
- CVE-2021-3828Inefficient Regular Expression Complexity in nltk/nltknltk/nltk · nltk
- CVE-2021-34570Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTSPhoenix Contact AXC F · Phoenix Contact RFC +1
- CVE-2021-34349Command Injection Vulnerability in QVRQNAP Systems QVR
Medium, low and unrated 90
- CVE-2020-20693A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.gilacms/gila
- CVE-2020-20695A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a craftedgilacms/gila
- CVE-2020-20696A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTgilacms/gila
- CVE-2020-20691An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploadi
- CVE-2020-20692GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.php.
- CVE-2021-37274Kingdee KIS Professional Edition has a privilege escalation vulnerability.
- CVE-2020-24930Beijing Wuzhi Internet Technology Co., Ltd.
- CVE-2021-37270There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0.
- CVE-2021-41095XSS via blocked watched word in error messagediscourse
- CVE-2021-20035Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary coSonicWall SMA100
- CVE-2021-20034An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete aSonicWall SMA100
- CVE-2021-41558The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.
- CVE-2021-23445Cross-site Scripting (XSS)datatables.net
- CVE-2021-37761Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution.
- CVE-2021-41753A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remo
- CVE-2021-40329The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.Ping Identity PingFederate
- CVE-2021-40712Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOSAdobe Experience Manager
- CVE-2021-40714Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameterAdobe Experience Manager
- CVE-2021-39828Adobe Digital Editions Installer flaw leads to Local Privilege EscalationAdobe Digital Editions
- CVE-2021-40713Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle AttackAdobe Experience Manager
- CVE-2021-39827Adobe Digital Editions Installer flaw leads to Arbitrary File System WriteAdobe Digital Editions
- CVE-2021-40711Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code ExecutionAdobe Experience Manager
- CVE-2021-36845YITH Maintenance Mode (WordPress plugin) <= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilitiesYITH Maintenance Mode
- CVE-2021-36841YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability.YITH Maintenance Mode
- CVE-2021-36875WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerabilityStylemix Directory Listings WordPress plugin – uListing
- CVE-2021-36877WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerabilityStylemixThemes uListing
- CVE-2021-36876WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesStylemixThemes uListing
- CVE-2021-24671MX Time Zone Clocks < 3.4.1 - Contributor+ Cross-Site ScriptingMX Time Zone Clocks
- CVE-2021-24670CoolClock < 4.3.5 - Contributor+ Stored Cross-Site ScriptingCoolClock – a Javascript Analog Clock
- CVE-2021-24666Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL InjectionPodlove Podcast Publisher
- CVE-2021-24661PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Private Content DisclosurePostX – Gutenberg Blocks for Post Grid
- CVE-2021-24660PostX Gutenberg Blocks Saved Templates Addon < 2.4.10 - Contributor+ Stored Cross-Site ScriptingPostX – Gutenberg Blocks for Post Grid
- CVE-2021-24659PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site ScriptingPostX – Gutenberg Blocks for Post Grid
- CVE-2021-24652PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access ControlsPostX – Gutenberg Blocks for Post Grid
- CVE-2021-24643WP Map Block < 1.2.3 - Contributor+ Stored Cross-Site ScriptingWP Map Block – Gutenberg Map Block for Google Map and OpenS…
- CVE-2021-24634Recipe Card Blocks < 2.8.3 - Contributor+ Stored Cross-Site ScriptingRecipe Card Blocks by WPZOOM
- CVE-2021-24633Countdown Block < 1.1.2 - Missing Authorisation in AJAX actionCountdown Block
- CVE-2021-24632Recipe Card Blocks < 2.8.1 - Reflected Cross-Site ScriptingRecipe Card Blocks by WPZOOM
- CVE-2021-24610TranslatePress < 2.0.9 - Authenticated Stored Cross-Site ScriptingTranslate Multilingual sites – TranslatePress
- CVE-2021-24569Cookie Notice & Compliance for GDPR / CCPA < 2.1.2 - Admin+ Stored Cross-Site ScriptingCookie Notice & Compliance for GDPR / CCPA
- CVE-2021-36878WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerabilityStylemixThemes uListing
- CVE-2021-37539Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.
- CVE-2021-26587A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce.HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200;…
- CVE-2021-34413All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerabZoom Plugin for Microsoft Outlook for MacOS
- CVE-2021-34416The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-prZoom On-Premise Meeting Connector Controller, Zoom On-Premi…
- CVE-2021-34415The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt fielZoom On-Premise Meeting Connector Controller
- CVE-2021-34414The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premiZoom on-premise Meeting Connector Controller, Zoom on-premi…
- CVE-2021-34412During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch InternetZoom Client for Meetings for Windows
- CVE-2021-34411During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet ExploreZoom Rooms for Conference Room for Windows
- CVE-2021-34410A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0.Zoom Plugin for Microsoft Outlook for Mac
- CVE-2021-34408The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged Zoom Client for Meetings for Windows
- CVE-2021-33907The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .mZoom Client for Meetings for Windows
- CVE-2021-37786Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exception
- CVE-2021-22272ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.mybuildings.abb.com · my.busch-jaeger.de
- CVE-2021-36218An issue was discovered in SKALE sgxwallet 1.58.3.
- CVE-2021-36219An issue was discovered in SKALE sgxwallet 1.58.3.
- CVE-2021-3822Inefficient Regular Expression Complexity in josdejong/jsoneditorjosdejong/jsoneditor · jsoneditor
- CVE-2021-3820Inefficient Regular Expression Complexity in pksunkara/inflectpksunkara/inflect · i
- CVE-2021-3819Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-3818Reliance on Cookies without Validation and Integrity Checking in getgrav/gravgetgrav/grav
- CVE-2021-3799Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admingetgrav/grav-plugin-admin
- CVE-2021-23243In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used.OPPO Android Phone with Qualcomm chipset
- CVE-2021-40109A SSRF issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40108An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40106An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40105An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40104An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-0660In ccu, there is a possible out of bounds read due to incorrect error handling.MT6779, MT6853, MT6873, MT6885
- CVE-2021-0612In m4u, there is a possible memory corruption due to a use after free.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0611In m4u, there is a possible memory corruption due to a use after free.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0610In memory management driver, there is a possible memory corruption due to an integer overflow.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0425In memory management driver, there is a possible side channel information disclosure.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0424In memory management driver, there is a possible system crash due to a missing bounds check.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0423In memory management driver, there is a possible information disclosure due to uninitialized data.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0422In memory management driver, there is a possible system crash due to a missing bounds check.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-0421In memory management driver, there is a possible information disclosure due to a missing bounds check.MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582_90, MT65…
- CVE-2021-40103An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40098An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-40097An issue was discovered in Concrete CMS through 8.5.5.
- CVE-2021-23054On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected croBIG-IP APM
- CVE-2021-20317A flaw was found in the Linux kernel.kernel
- CVE-2021-41580The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token.passport-oauth2
- CVE-2021-38299Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control.web-auth/webauthn-framework
- CVE-2021-41385The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server co
- CVE-2021-41329Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their vie
- CVE-2021-40981ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PRO
- CVE-2021-40349e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring.
- CVE-2021-31605furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket.openvpn-monitor
- CVE-2021-31604furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.openvpn-monitor
- CVE-2021-31606furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.openvpn-monitor