Skip to content
OpenAdvisories

Archive

September 2021

Vulnerabilities first published in this month (UTC), newest first.

← August 2021 2021 / September October 2021 →
  1. 1115
  2. 253
  3. 327
  4. 41
  5. 54
  6. 637
  7. 7126
  8. 8276
  9. 9140
  10. 1050
  11. 112
  12. 122
  13. 1366
  14. 14102
  15. 15154
  16. 1648
  17. 1750
  18. 184
  19. 192
  20. 20171
  21. 2130
  22. 2237
  23. 23105
  24. 2425
  25. 25 
  26. 262
  27. 27115
  28. 2851
  29. 2976
  30. 3051
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-22941 Exploited · Ransomware Public exploit EPSS 54%

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…

    KEV Mar 25, 2022
  • Critical 9.8
    CVE-2021-22005 Exploited · Ransomware Public exploit EPSS 100%

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…

    Virtualization
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-36260 Exploited Public exploit EPSS 100%

    A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation…

    KEV Jan 10, 2022
  • Critical 9.0
    CVE-2021-40438 Exploited · Ransomware Public exploit EPSS 100%

    mod_proxy SSRF

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV Dec 1, 2021
  • Critical 9.8
    CVE-2021-33045 Exploited Public exploit EPSS 100%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…

    KEV Aug 21, 2024
  • Critical 9.8
    CVE-2021-33044 Exploited Public exploit EPSS 100%

    The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can b…

    KEV Aug 21, 2024
  • Critical 9.9
    CVE-2021-33690 Public exploit EPSS 69%

    Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Comp…

    SAP_SE SAP NetWeaver Development Infrastructure (Component Build Service)
  • Critical 9.8
    CVE-2021-38647 Exploited · Ransomware Public exploit EPSS 100%

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    Microsoft Azure Stack Hub Open Management Infrastructure Azure Automation Update Management
    KEV Nov 3, 2021
  • Critical 9.9
    CVE-2021-38163 Exploited Public exploit EPSS 37%

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…

    SAP_SE SAP NetWeaver (Visual Composer 7.0 RT)
    KEV Jun 9, 2022
  • Critical 9.8
    CVE-2021-33543 Public exploit EPSS 81%

    UDP Technology/Geutebrück camera devices: Authentication Bypass

    Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. This can lead to manipulation of the device and denial of service.

    Geutebrück Encoder G-Code E2 Series
  • Critical 9.8
    CVE-2021-40870 Exploited Public exploit EPSS 93%

    An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous…

    KEV Jan 18, 2022
  • Critical 9.9
    CVE-2021-32724 Public exploit

    check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

    check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`…

    check-spelling check-spelling check-spelling/check-spelling GitHub Actions
  • Critical 9.8
    CVE-2021-38540 Public exploit EPSS 81%

    Apache Airflow: Variable Import endpoint missed authentication check

    The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclo…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2021-40539 Exploited · Ransomware Public exploit EPSS 99%

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with result…

    KEV Nov 3, 2021