CVEs published in September 2021
2,096 vulnerabilities, 219 critical, 26 exploited.
- prasathmani tiny file managerA Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6...6.5 Medium
- prasathmani tiny file managerA Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and...8.8 High
- prasathmani tiny file managerA Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager...5.4 Medium
- glpi-project glpiIP restriction on GLPI API Bypass with custom header injection6.8 Medium
- glpi-project glpiDisclosure of GLPI and server information in telemetry endpoint5.3 Medium
- glpi-project glpiAutologin cookie accessible by scripts6.5 Medium
- autodesk navisworksA maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to...7.8 High
- autodesk navisworksA maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to...7.8 High
- autodesk navisworksA Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may...7.8 High
- autodesk navisworksA maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to...7.8 High
- it-economics techradarThe TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.6.1 Medium
- semver-regex project semver-regex, sindresorhus sindresorhus/semver-regex +1 moreInefficient Regular Expression Complexity in sindresorhus/semver-regex7.5 High
- webuzoA Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an...6.1 Medium
- metinfoMetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.9.8 Critical
- metinfoMetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.8.8 High
- ureport project ureportRemote code execution in UReport9.8 Critical
- ureport project ureportUReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the...9.8 Critical
- ureport project ureportServer-Side Request Forgery in UReport5.3 Medium
- kliqqi cmsPligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue...9.8 Critical
- mylittletools mylittlebackupThe management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute...9.8 Critical
- glpi-project glpiBypassable CSRF protection8.8 High
- drupal core, drupal +1 moreDrupal core access bypass vulnerability7.5 High
- drupal core, drupal +1 moreIncorrect Authorization in Drupal core6.5 Medium
- drupal core, drupal +1 moreUnrestricted Upload of File with Dangerous Type in Drupal core9.8 Critical
- drupal core, drupal +1 moreCross-Site Request Forgery in Drupal core6.5 Medium
- drupal entity embedThe Entity Embed module provides a filter to allow embedding entities in content fields. In...6.1 Medium
- autodesk fbx reviewA user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer...7.8 High
- autodesk fbx reviewA Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote...7.8 High
- laiketuiCross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary...8.8 High
- s-cmsCross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute...5.4 Medium
- wenkucms project wenkucmsCross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code...6.1 Medium
- ari-soft ari adminerCross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code...5.4 Medium
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...8.8 High
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...6.5 Medium
- jflyfox jfinal cmsCommand Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary...8.8 High
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...8.1 High
- jflyfox jfinal cmsCross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute...5.4 Medium
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...6.5 Medium
- jflyfox jfinal cmsImproper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain...6.5 Medium
- pimcoreObservable Response Discrepancy in Lost Password Service5.3 Medium
- nagios xiIn Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative...5.4 Medium
- gonitro nitro pro, nitro pro +1 moreAn exploitable return of stack variable address vulnerability exists in the JavaScript...8.8 High
- hestiacp hestiacp/hestiacp, control panel +1 moreUse of Wrong Operator in String Comparison in hestiacp/hestiacp4.8 Medium
- pdftron webviewer uiPDFTron’s WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents,...6.1 Medium
- prismjs prism, prismjs/prism +1 moreInefficient Regular Expression Complexity in prismjs/prism7.5 High
- zenitel alphacom xe audio serverThe web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not...8.8 High
- axiossystems assystAssyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application...7.7 High
- vuelidate vuelidate/vuelidate, vuelidate project vuelidate +1 moreInefficient Regular Expression Complexity in vuelidate/vuelidate7.5 High
- vmware fusion, workstation, esxi, workstation, and fusion +1 more +3 moreVMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation ...8.4 High
- yourls, yourls yourls/yourls +1 moreCross-site Scripting (XSS) - Stored in yourls/yourls8.8 High
- Show moreLoading…