CVEs published in September 2021
2,096 vulnerabilities, 219 critical, 26 exploited.
- speed test project teste7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information...5.3 Medium
- openvpn-monitor project openvpn-monitorfurlongm openvpn-monitor command injection7.5 High
- openvpn-monitor project openvpn-monitorfurlongm openvpn-monitor allows CSRF to disconnect an arbitrary client6.5 Medium
- qnap qvrCommand Injection Vulnerability in QVR9.8 Critical
- qnap qvrCommand Injection Vulnerability in QVR7.2 High
- qnap qvrCommand Injection Vulnerability in QVR9.8 Critical
harfbuzzOSS-FuzzHeap-buffer-overflow in OT::MathValueRecord::copyNo scoresleuthkitOSS-FuzzNegative-size-param in ntfs_attr_walk_specialNo scoreuwebsocketsOSS-FuzzContainer-overflow in std::__1::__function::__func<LLVMFuzzerTestOneInput::$_0, std::__1::allocator<LLNo scorelibtsmOSS-FuzzGlobal-buffer-overflow in vte_write_debugNo score- openvpn-monitor project openvpn-monitorfurlongm openvpn-monitor allows Authorization Bypass to disconnect arbitrary clients7.5 High
- btcpayserver btcpayserver/btcpayserver, btcpay server +1 moreCross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver3.8 Low
openexrOSS-FuzzHeap-use-after-free in dispatch_print_errorNo score- openbsd openssh, fedoraproject fedora, netapp active iq unified manager +14 more +16 moresshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used,...7.0 High
harfbuzzOSS-FuzzHeap-buffer-overflow in OT::MathGlyphConstruction::subsetNo scoreopenexrOSS-FuzzStack-buffer-overflow in dispatch_print_errorNo scorejsoupOSS-FuzzUncaught exception in org.jsoup.parser.HtmlTreeBuilderState$18.processNo score- zte axon 30 pro message serviceThere is an information leak vulnerability in the message service app of a ZTE mobile phone. Due...5.5 Medium
- maccmsA Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html...8.1 High
- shopkit project shopkitShopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account...6.1 Medium
- opennmsOpenNMS Stored XSS via SNMP Agent Data7.1 High
- opennmsOpenNMS Stored XSS via SNMP Trap Alerts7.1 High
- d-link dir-605 router, dlink dir-605l, dir-605l firmware +2 moreAn informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker...7.5 High
- dlink dir-615 firmwareAn information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user...6.5 Medium
- dlink dcs-5000l firmware, dcs-932l firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and...8.0 High
- d-link dcs-5000l firmware, dcs-932l firmware +1 more** UNSUPPORTED WHEN ASSIGNED ** DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by...8.0 High
- oracle linux, engineered systems utilities +1 moreVulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7...7.8 High
- torproject tor browserTor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can...6.1 Medium
- github enterprise serverUnsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server4.3 Medium
- github enterprise serverImproper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group9.8 Critical
- drweb security spaceDr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL...7.8 High
- os4ed opensisA SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0....8.8 High
- os4ed opensisOpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability...5.4 Medium
- concretecms concrete cmsAn issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP...7.2 High
- concretecms concrete cmsAn issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when...5.4 Medium
- concretecms concrete cmsAn issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR...9.1 Critical
- gradleIn Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can...7.5 High
- gradleIn Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can...7.5 High
- gradleIn Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary...8.1 High
- zeroize derive project deriveMemory flaw in zeroize_derive9.8 Critical
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)6.5 Medium
- gradleGradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information...7.5 High
- ping identity pingaccessPing Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.5.3 Medium
- eduvpn vpn-user-portalvpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian...6.5 Medium
- openbsd libresslx509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0...5.5 Medium
ghostnpmMember account takeover6.5 Medium- elv elvishRemote code execution via the web UI backend of Elvish8.0 High
- yzmcmsA cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers...8.8 High
- yzmcmsA cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3...4.8 Medium
- yzmcmsA cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows...4.8 Medium
- Show moreLoading…