CVEs published September 30, 2021
51 CVEs were published on September 30, 2021: 8 critical, 7 high.
- Published
- 51
- Critical
- 8
- High
- 7
- Medium
- 6
- Low
- 2
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- 13
- Fortinet FortiManager
- 2
- IBM Cloud Pak for Security
- 2
- Adobe Acrobat Reader
- 1
- Apache Software Foundation Apache DB ddlutils · org.apache.…
- 1
- IBM Sterling Order Management
- 1
- parse-community parse-server · parse-server
- 1
- shuup
- 1
- wireapp wire-server
- 1
Critical 8
- CVE-2021-41301ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized ActorECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41300ECOA BAS controller - Insufficiently Protected Credentials-2ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41299ECOA BAS controller - Use of Hard-coded CredentialsECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41296ECOA BAS controller - Weak Password RequirementsECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41294ECOA BAS controller - Path Traversal-4ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41292ECOA BAS controller - Broken AuthenticationECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41290ECOA BAS controller - Path Traversal-1ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41616Apache ddlutils 1.0 readobject vulnerabilityApache Software Foundation Apache DB ddlutils · org.apache.…
High 7
- CVE-2021-41109LiveQuery publishes user session tokensparse-community parse-server · parse-server
- CVE-2021-41302ECOA BAS controller - Missing Encryption of Sensitive DataECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41298ECOA BAS controller - Improper Access ControlECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41297ECOA BAS controller - Insufficiently Protected Credentials-1ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41295ECOA BAS controller - Cross-Site Request Forgery (CSRF)ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41293ECOA BAS controller - Path Traversal-3ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
- CVE-2021-41291ECOA BAS controller - Path Traversal-1ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5
Medium, low and unrated 36
- CVE-2020-20799JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via
- CVE-2020-20797FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.
- CVE-2020-20796FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.
- CVE-2020-20746A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbitrary code or cause a
- CVE-2021-41324Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal file
- CVE-2021-41101CORS `Access-Control-Allow-Origin` settings are too lenientwireapp wire-server
- CVE-2021-33583REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.
- CVE-2021-41325Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile paramete
- CVE-2021-41323Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells fil
- CVE-2021-41288Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
- CVE-2021-35199NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.
- CVE-2021-35198NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.
- CVE-2021-35205NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.
- CVE-2021-35200NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.
- CVE-2021-35201NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
- CVE-2021-35202NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.
- CVE-2021-35203NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.
- CVE-2021-35204NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.
- CVE-2020-20665rudp v0.6 was discovered to contain a memory leak in the component main.c.
- CVE-2020-20664libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.
- CVE-2020-20663libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.
- CVE-2020-20662libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.
- CVE-2021-29894IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allowIBM Cloud Pak for Security
- CVE-2021-20578IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to imprIBM Cloud Pak for Security
- CVE-2021-20554IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting.IBM Sterling Order Management
- CVE-2021-24017An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and Fortinet FortiManager
- CVE-2021-24016An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attackFortinet FortiManager
- CVE-2021-21089Adobe Acrobat Reader DC URI Parsing Out-Of-Bounds ReadAdobe Acrobat Reader
- CVE-2021-41729BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the serve
- CVE-2021-25963Shuup - Reflected XSS in Error Pageshuup
- CVE-2021-41827Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access.
- CVE-2021-41828Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.
- CVE-2021-41829Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key.
- CVE-2020-18683Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling.
- CVE-2020-18685Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites relat
- CVE-2020-18684Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number.