CVEs published September 28, 2021
51 CVEs were published on September 28, 2021: 0 critical, 7 high.
- Published
- 51
- Critical
- 0
- High
- 7
- Medium
- 6
- Low
- 0
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Dell CPG BIOS
- 4
- Siemens Solid Edge SE2021
- 4
- Dell NetWorker
- 2
- Dell SupportAssist Client Consumer
- 2
- F-Secure Internet Gatekeeper
- 2
- FusionCompute
- 2
- Siemens NX 1953 Series · Siemens NX 1980 Series +1
- 2
- Siemens NX 1980 Series · Siemens Solid Edge SE2021
- 2
- ArcSight Enterprise Security Manager (ESM).
- 1
- Directory and Resource Administrator
- 1
High 7
- CVE-2021-36297SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll filDell SupportAssist Client Consumer
- CVE-2021-36286Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability thaDell SupportAssist Client Consumer
- CVE-2021-36283Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2021-21522Dell BIOS contains a Credentials Management issue.Dell CPG BIOS
- CVE-2021-41104web_server allows OTA update without checking user defined basic auth username & passwordesphome
- CVE-2021-34636Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site ScriptingWpDevArt Countdown and CountUp, WooCommerce Sales Timers
- CVE-2021-33601Arbitrary Code Execution in Web Interface of F-Secure Internet GatekeeperF-Secure Internet Gatekeeper
Medium, low and unrated 44
- CVE-2020-20125EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms_web\espcms_load.php.
- CVE-2020-20124Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \attachment\admin\index.php.
- CVE-2020-20122Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.
- CVE-2020-20120ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" topthink/thinkphp
- CVE-2021-41106File reference keys leads to incorrect hashes on HMAC algorithmslcobucci jwt · lcobucci/jwt
- CVE-2021-36285Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability.Dell CPG BIOS
- CVE-2021-36284Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability.Dell CPG BIOS
- CVE-2021-21570Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability.Dell NetWorker
- CVE-2021-21569Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability.Dell NetWorker
- CVE-2021-38303A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360.
- CVE-2021-30086Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an attacker to obtain use
- CVE-2021-37267Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie i
- CVE-2021-37271Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information
- CVE-2021-37273A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0.
- CVE-2021-41318In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input.
- CVE-2021-36366Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards.
- CVE-2021-36365Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh.
- CVE-2021-36364Nagios XI before 5.8.5 incorrectly allows backup_xi.sh wildcards.
- CVE-2021-36363Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.
- CVE-2021-29367A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted WPG file.
- CVE-2021-29365Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop_W component.
- CVE-2021-29366A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted R
- CVE-2021-29364A buffer overflow vulnerability in Formats!ReadRAS_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE f
- CVE-2021-29363A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE fi
- CVE-2021-29362A buffer overflow vulnerability in FORMATS!ReadRAS_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE fi
- CVE-2021-29361A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RL
- CVE-2021-29360A buffer overflow vulnerability in FORMATS!Read_Utah_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RL
- CVE-2021-29358A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of service (DOS) via a crafte
- CVE-2021-37105There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0.FusionCompute
- CVE-2021-37106There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default FusionCompute
- CVE-2021-37104There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3).HUAWEI P40
- CVE-2021-38124Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versions 7.0.2 through 7.5.ArcSight Enterprise Security Manager (ESM).
- CVE-2021-22535Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all Directory and Resource Administrator
- CVE-2021-37146An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers
- CVE-2021-41539A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).Siemens Solid Edge SE2021
- CVE-2021-41540A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).Siemens Solid Edge SE2021
- CVE-2021-41538A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 Siemens NX 1953 Series · Siemens NX 1980 Series +1
- CVE-2021-41537A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).Siemens Solid Edge SE2021
- CVE-2021-41536A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8).Siemens Solid Edge SE2021
- CVE-2021-41535A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988), Solid Edge SE2021 Siemens NX 1953 Series · Siemens NX 1980 Series +1
- CVE-2021-41534A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).Siemens NX 1980 Series · Siemens Solid Edge SE2021
- CVE-2021-41533A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021MP8).Siemens NX 1980 Series · Siemens Solid Edge SE2021
- CVE-2021-36165RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and passw
- CVE-2021-33600Denial of Service Vulnerability in Web Interface of F-Secure Internet GatekeeperF-Secure Internet Gatekeeper