Archive
September 2021
Vulnerabilities first published in this month (UTC), newest first.
1,922 results · Feed
-
Unscored —
There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. Due to the improper ver…
-
Unscored —
There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when pr…
-
Unscored —
There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). This vulnerability…
-
Unscored —
Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versio…
-
Unscored —
Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) pr…
-
High 8.8
Countdown and CountUp, WooCommerce Sales Timer <= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Countdown and CountUp, WooCommerce Sales Timers WordPress plugin is vulnerable to Cross-Site Request Forgery via the save_theme function found in the ~/includes/admin/coundown_theme_page.php file due to a missing nonce check which allows attackers to inje…
-
Unscored —
An infinite loop in Open Robotics ros_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 al…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains …
-
Unscored —
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains …
-
Unscored —
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988…
-
Unscored —
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains …
-
Unscored —
A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains …
-
Unscored —
A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700), NX 1980 Series (All versions < V1988…
-
Unscored —
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021M…
-
Unscored —
A vulnerability has been identified in NX 1980 Series (All versions < V1984), Solid Edge SE2021 (All versions < SE2021M…
-
Unscored —
RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sen…
-
High 7.6
Arbitrary Code Execution in Web Interface of F-Secure Internet Gatekeeper
A vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. An authenticated user can modify settings through the web user interface in a way that could lead to an arbitrary code execution on the F-Secure Internet Gatekeeper serv…
-
Medium 5.4
Denial of Service Vulnerability in Web Interface of F-Secure Internet Gatekeeper
A denial-of-service (DoS) vulnerability was discovered in the web user interface of F-Secure Internet Gatekeeper. The vulnerability occurs because of an attacker can trigger assertion via malformed HTTP packet to web interface. An unauthenticated attacker cou…
-
High 8.8
Cross-Site Request Forgery in GilaCMS
A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.
-
Medium 5.4
Cross-site Scripting in GilaCMS
A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.
-
Medium 5.4
Cross-site Scripting in GilaCMS
A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
-
Unscored —
An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extensi…
-
Unscored —
GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controller…
-
Unscored —
Kingdee KIS Professional Edition has a privilege escalation vulnerability. Attackers can use the vulnerability to gain …
-
Unscored —
Beijing Wuzhi Internet Technology Co., Ltd. Wuzhi CMS 4.0.1 is an open source content management system. The five finge…
-
Unscored —
There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use …
-
High 7.5
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted docume…
-
Medium 4.2
XSS via blocked watched word in error message
Discourse is an open source discussion platform. There is a cross-site scripting (XSS) vulnerability in versions 2.7.7 and earlier of the `stable` branch, versions 2.8.0.beta6 and earlier of the `beta` branch, and versions 2.8.0.beta6 and earlier of the `test…
-
High 7.5
Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky
Rucky is a USB HID Rubber Ducky Launch Pad for Android. Versions 2.2 and earlier for release builds and versions 425 and earlier for nightly builds suffer from use of a weak cryptographic algorithm (RSA/ECB/PKCS1Padding). The issue will be patched in v2.3 for…
-
Critical 9.1CVE-2021-41097 Scanner template
Prototype pollution in aurelia-path
aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollution vulnerability in aurelia-path before version 1.1.7. The vulnerability exposes Aurelia application that uses `aurelia-path` package to par…
-
Medium 6.5CVE-2021-20035 Exploited
Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker t…
KEV Apr 16, 2025 -
Unscored —
An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversa…
-
Unscored —
The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.
-
Low 3.1
Cross-site Scripting (XSS)
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
-
Unscored —
Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote co…
-
Unscored —
A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v…
-
Unscored —
The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password manage…
-
High 7.4
Out of bounds write in Netop Vision Pro
Out of bounds write vulnerability in the JPEG parsing code of Netop Vision Pro up to and including 9.7.2 allows an adjacent unauthenticated attacker to write to arbitrary memory potentially leading to a Denial of Service (DoS).
-
Medium 6.5
Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter. An authenticated attacker can send a malformed POST request to achieve server-side denial of service.
-
Medium 6.1
Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScr…