Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x0b
-
High 7.5
AVEVA SuiteLink Server Improper Handling of Exceptional Conditions
Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing command 0x07
-
High 8.1
AVEVA SuiteLink Server Buffer Overflow
Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06
-
High 7.5
AVEVA SuiteLink Server Null Pointer Dereference
Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
-
Critical 9.8
Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attack…
KEV Mar 25, 2022 -
Unscored —
Vulnerability in the generation of session IDs in revive-adserver < 5.3.0, based on the cryptographically insecure uniq…
-
Unscored —
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, a…
-
Unscored —
A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained ac…
-
Unscored —
Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be…
-
Unscored —
A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience…
-
Unscored —
The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this…
-
Unscored —
The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. A malicious actor with net…
-
Unscored —
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A …
-
Medium 5.3
Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mal…
KEV Jan 10, 2022 -
Unscored —
The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An atta…
-
Unscored —
The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrast…
-
Unscored —
The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance mana…
-
Unscored —
The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API.…
-
Unscored —
vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious ac…
-
Unscored —
The vCenter Server contains a denial-of-service vulnerability in VPXD service. A malicious actor with network access to…
-
Unscored —
The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. A malicious actor…
-
Unscored —
The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. A malicious actor wi…
-
Unscored —
The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated use…
-
Unscored —CVE-2021-22006 Public exploit
The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. A malicio…
-
Critical 9.8
The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with net…
KEV Nov 3, 2021 -
Unscored —
The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in v…
-
Unscored —CVE-2021-33035 EPSS 51%
Buffer overflow from a crafted DBF file
Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefull…
-
High 7.4
Cisco IOS XE Software Interface Queue Wedge Denial of Service Vulnerability
A vulnerability in the Layer 2 punt code of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a queue wedge on an interface that receives specific Layer 2 frames, resulting in a denial of service (DoS) condition. This vulnerabil…
-
High 7.7
Cisco IOS and IOS XE Software IKEv2 AutoReconnect Feature Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange Version 2 (IKEv2) support for the AutoReconnect feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to exhaust the free IP addresses from the assigned local pool. T…
-
Critical 9.8
Cisco IOS XE Software NETCONF and RESTCONF Authentication Bypass Vulnerability
A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Install, manipulate, or d…
-
Medium 4.7
Cisco IOS XE Software H.323 Application Level Gateway Bypass Vulnerability
A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass the ALG. This vulnerability is due to insufficient data valid…
-
High 8.6
Cisco Embedded Wireless Controller Software for Catalyst Access Points Denial of Service Vulnerability
A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller (EWC) Software for Catalyst Access Points (APs) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected AP. This v…
-
Medium 5.5
Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file system. An attacker cou…
-
High 8.6
Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers EoGRE Denial of Service Vulnerability
A vulnerability in Ethernet over GRE (EoGRE) packet processing of Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9800 Family Wireless Controller, Embedded Wireless Controller, and Embedded Wireless on Catalyst 9000 Series Switches could allo…
-
Medium 6.5
Cisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure Vulnerability
A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain unauthorized access to user credentials. This vulnerability exists because access to API endpoints is not properly restrict…
-
High 7.8
Cisco Access Points SSH Management Privilege Escalation Vulnerability
A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authenticated user to modify files on the affected device and possibly gain escalated privileges. The vulnerability is due to improper checking …
-
Medium 5.5
Cisco SD-WAN Software Information Disclosure Vulnerability
A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive information. This vulnerability is due to improper protections on file access through the CLI. An attacker could exploit this vulnerability by…
-
High 8.6
Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service Vulnerabilities
Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE Software for Cisco Catalyst 9000 Family Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of s…