CVEs published in September 2021
2,096 vulnerabilities, 219 critical, 26 exploited.
- apple ios, macos, watchos +1 more +3 moreA logic issue was addressed with improved state management. This issue is fixed in iOS 14.7,...7.5 High
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur...3.3 Low
- apple ios, iphone os +1 moreThis issue was addressed with improved checks. This issue is fixed in iOS 14.7. Joining a...8.8 High
- adobe creative cloud, creative cloud (desktop component) +1 moreAdobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalation7.3 High
- adobe mediumMedium by Adobe file parsing buffer overflow vulnerability could lead to arbitrary code execution8.8 High
- solarwinds orion platform, patch manager +1 moreInsecure Deserialization of untrusted data causing Remote code execution vulnerability.8.9 High
- xen, debian linux, fedoraproject fedora +2 moreAnother race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned...7.8 High
- sha2 project sha2Incorrect hash in sha29.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, csrb31024 firmware +95 more +97 morePossible out of bounds read due to incorrect validation of incoming buffer length in Snapdragon...5.5 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8096au firmware, aqt1000 firmware +91 more +93 moreLack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto,...6.2 Medium
- qualcomm, inc. snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8053 firmware +106 more +108 moreBuffer over read could occur due to incorrect check of buffer size while flashing emmc devices in...4.6 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, qualcomm aqt1000 firmware, qca6390 firmware +82 more +84 moreIncorrect pointer argument passed to trusted application TA could result in un-intended memory...7.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +169 more +171 moreInteger underflow can occur due to improper handling of incoming RTCP packets in Snapdragon Auto,...9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +153 more +155 moreInteger underflow can occur when the RTCP length is lesser than than the actual blocks present in...9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +180 more +182 morePossible buffer underflow due to lack of check for negative indices values when processing user...9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +153 more +155 moreLoop with unreachable exit condition may occur due to improper handling of unsupported input in...7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +265 more +267 moreImproper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead...9.1 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm apq8053 firmware, apq8064au firmware +124 more +126 moreImproper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to...9.1 Critical
- deskproDeskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site...5.4 Medium
- smartertools smartermailSmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize...5.4 Medium
- sqlite-web project sqlite-webCross-site Request Forgery (CSRF)7.6 High
- fortinet fortisandboxAn insufficient session expiration vulnerability in FortiSandbox versions 3.2.1 and below may...5.6 Medium
- fortinet fortiwebA Improper neutralization of special elements used in a command ('Command Injection') in Fortinet...8.8 High
- fortinet fortiwebA stack-based buffer overflow in Fortinet FortiWeb version 6.3.14 and below, 6.2.4 and below...8.0 High
- atlassian data center, jira, jira server +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...5.3 Medium
- atlassian data center, jira, jira server +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers...4.3 Medium
- artifex ghostscript, fedoraproject fedora +1 moreA trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript...9.9 Critical
- atlassian jira server, jira data center +1 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the...5.5 Medium
- libgdThe GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds read because of the lack...6.5 Medium
- saltstack salt, debian linux, fedoraproject fedora +2 moreExposure of Resource to Wrong Sphere in salt7.5 High
- phpwcmsphpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php.6.1 Medium
- bluecms project bluecmsBlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php.9.8 Critical
rebbernpmImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdownNo score- cloudflare octorpki, debian linux +1 moreOctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values7.5 High
- parse-community parse-serverParse Server - Arbitrary Code Execution via Malicious Version Tags7.7 High
- parse-community parse-serverParse Server - Unreviewed Code Execution via Malicious Version Tags7.7 High
ezsystems/ezpublish-legacyPackagistContent object state fetch functions open to SQL injectionNo score- poly cx5100 firmware, cx5500 firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** A command-injection vulnerability in an authenticated Telnet...7.2 High
- zeroxracer project zeroxracerA lack of target address verification in the destroycontract() function of 0xRACER 1.0 allows...7.5 High
- rtb1 project rtb1A lack of target address verification in the BurnMe() function of Rob The Bank 1.0 allows...7.5 High
- tokensale project tokensaleA lack of target address verification in the selfdestructs() function of ICOVO 1.0 allows...7.5 High
- tokenerc20 project tokenerc20The time check operation of PepeAuctionSale 1.0 can be rendered ineffective by assigning a large...7.5 High
- proofofdiligencetoken project proofofdiligencetokenAn issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows...7.5 High
- nextcloud server, kiteworks security-advisories +1 morePreview generation used third-party library not suited for user-generated content in Nextcloud server9.3 Critical
- nextcloud server, kiteworks security-advisories +1 moreExceptions may have logged Encryption-at-Rest key content in Nextcloud server5.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreBypass of Two Factor Authentication in Nextcloud server8.1 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Text app can disclose existence of folders in "File Drop" link share5.3 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreLack of ratelimit on Richdocuments OCS endpoint in nextcloud5.3 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 moreFile Drop can be bypassed using Richdocuments app in nextcloud7.5 High
- eyoucmsEyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url...6.1 Medium
- Show moreLoading…