Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Unscored —
A vulnerability has been identified in LOGO! CMR2020 (All versions < V2.2), LOGO! CMR2040 (All versions < V2.2), SIMATI…
-
Unscored —
A vulnerability has been identified in Industrial Edge Management (All versions < V1.3). An unauthenticated attacker co…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software al…
-
Unscored —
A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by t…
-
Unscored —
A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). …
-
Unscored —
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All version…
-
Unscored —
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All version…
-
Unscored —
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All version…
-
High 7.5
A vulnerability has been identified in SIMATIC CP 343-1 (incl. SIPLUS variants) (All versions), SIMATIC CP 343-1 Advanc…
-
Unscored —
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 rel…
-
Unscored —
A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions < V8.80), SIPROTEC 5 rel…
-
Unscored —
A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545…
-
Unscored —
A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions wi…
-
Critical 9.8
A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions >= V2.6.3), APOGEE MEC (PPC) (P2 Et…
-
Unscored —
A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2021.2.1). The starview+.exe applica…
-
Unscored —
A vulnerability has been identified in SINEMA Server (All versions < V14 SP3). Missing authentication for functionality…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames o…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via…
-
Medium 5.3
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full na…
-
High 7.5
Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the applica…
-
Unscored —
The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.1…
-
Unscored —
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2…
-
Unscored —
An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a c…
-
Unscored —
A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account.
-
Unscored —
An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary c…
-
Unscored —
In all released versions of Eclipse Equinox, at least until version 4.21 (September 2021), installation can be vulnerab…
-
Unscored —
tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the c…
-
Unscored —
The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereferenc…
-
Unscored —
The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a…
-
Medium 5.9
Logic error in Matrix SDK for Android
A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted …
-
Unscored —
Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a deni…
-
Medium 5.9
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were ori…
-
High 7.6
Prototype Pollution in fiznool/body-parser-xml
body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
Unscored —
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and…
-
Unscored —
Block and Stop Bad Bots < 6.60 - Authenticated SQL Injections
The StopBadBots WordPress plugin before 6.60 did not validate or escape the order and orderby GET parameter in some of its admin dashboard pages, leading to Authenticated SQL Injections
-
Unscored —
WP Simple Booking Calendar <= 2.0.6 (before 07/12/2021) - Authenticated SQL Injection
The WP Simple Booking Calendar WordPress plugin before 2.0.6 did not escape, validate or sanitise the orderby parameter in its Search Calendars action, before using it in a SQL statement, leading to an authenticated SQL injection issue
-
Unscored —
Comment Link Remove and Other Comment Tools < 2.1.6 - Arbitrary Comment Deletion via CSRF
The Comment Link Remove and Other Comment Tools WordPress plugin before 2.1.6 does not have CSRF check in its 'Delete comments easily', which could allow attackers to make logged in admin delete arbitrary comments
-
Unscored —
Timetable and Event Schedule by MotoPress < 2.3.19 - Author+ Stored Cross-Site Scripting
The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters, which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related even…
-
Unscored —
WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)
The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks eve…