Skip to content
OpenAdvisories

Archive

30 September 2021

Vulnerabilities first published on this day (UTC), newest first.

← August 2021 2021 / September /30 October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

51 results · Feed

  • Critical 9.8
    CVE-2021-41292

    ECOA BAS controller - Broken Authentication

    ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can remotely bypass authentication and disclose sensitive information and circumvent physical access controls in smart homes and buil…

    ECOA RiskTerminator RiskBuster Terminator E6L45 RiskBuster System TRANE 1.0
  • High 7.5
    CVE-2021-41291 Scanner template EPSS 83%

    ECOA BAS controller - Path Traversal-1

    ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device.

    ECOA RiskBuster System RB 3.0.0 Graphic Control Software RiskTerminator
  • Critical 9.8
    CVE-2021-41290

    ECOA BAS controller - Path Traversal-1

    ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, unauthenticated attackers can remotely set arbitrary values for location and content type and gain the possibility to execute arbitrary code …

    ECOA RiskBuster Terminator E6L45 RiskBuster System TRANE 1.0 SmartHome II E9246
  • Critical 9.8
    CVE-2021-41616

    Apache ddlutils 1.0 readobject vulnerability

    Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was ins…

    Apache Software Foundation Apache DB ddlutils org.apache.ddlutils:ddlutils Maven
  • Medium 6.1
    CVE-2021-25963

    Shuup - Reflected XSS in Error Page

    In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.

    shuup shuup shuup PyPI
  • Unscored —
    CVE-2021-41827

    Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials…

  • Unscored —
    CVE-2021-41828

    Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.

  • Unscored —
    CVE-2021-41829

    Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain…

  • Unscored —
    CVE-2020-18683

    Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefine…

  • Unscored —
    CVE-2020-18685

    Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecke…

  • Unscored —
    CVE-2020-18684

    Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port …