LiveActive security incident?Get immediate response
CVE archive

September 2021

Browse CVE records published in September 2021, with severity, affected products, CWE, KEV, and source-backed vulnerability context.

Search all CVEsKnown exploited

Showing 50 of 1832 matching CVEs · Page 12 of 37.

Low · CVSS 3.1

CVE-2021-23445: Cross-site Scripting (XSS)

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.

Published Sep 27, 2021 · Updated Sep 16, 2024

High · CVSS 7.8

CVE-2021-40715: Adobe Premiere Pro 2021 EXR File Parsing Leads to Memory Corruption

Adobe Premiere Pro version 15.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .exr file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.

Published Sep 29, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.5

CVE-2021-39852: Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Null pointer dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 29, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.2

CVE-2021-36096: Support Bundle includes S/Mime and PGP secret or PIN

Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions.

Published Sep 6, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.3

CVE-2021-34705: Cisco IOS and IOS XE Software FXO Interface Destination Pattern Bypass Vulnerability

A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured destination patterns and dial arbitrary numbers. This vulnerability is due to insufficient validation of dial strings at Foreign Exchange Office (FXO) interfaces. An attacker could exploit this vulnerability by sending a malformed dial string to an affected device via either the ISDN protocol or SIP. A successful exploit could allow the attacker to conduct toll fraud, resulting in unexpected financial impact to affected customers.

Published Sep 23, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.4

CVE-2021-29817: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site script...

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204343.

Published Sep 20, 2021 · Updated Sep 16, 2024

High · CVSS 7.6

CVE-2021-23404: Cross-site Request Forgery (CSRF)

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.

Published Sep 8, 2021 · Updated Sep 16, 2024

High · CVSS 8.8

CVE-2021-28553: Adobe Acrobat Reader use-after-free vulnerability could lead to arbitrary code execution

Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 2, 2021 · Updated Sep 16, 2024

Critical · CVSS 9.9

CVE-2021-36783: Rancher: Failure to properly sanitize credentials in cluster template answers

A Insufficiently Protected Credentials vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners and Project Members to read credentials, passwords and API tokens that have been stored in cleartext and exposed via API endpoints. This issue affects: SUSE Rancher Rancher versions prior to 2.6.4; Rancher versions prior to 2.5.13.

Published Sep 7, 2022 · Updated Sep 16, 2024

Critical · CVSS 9.1

CVE-2021-36024: Magento Commerce Improper Neutralization of Special Elements Used In A Command

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.

Published Sep 1, 2021 · Updated Sep 16, 2024

Medium · CVSS 6.4

CVE-2021-29800: IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-s...

IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Published Sep 23, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.3

CVE-2021-36095: User enumeration issue using "lost password" feature

Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.

Published Sep 6, 2021 · Updated Sep 16, 2024

Medium · CVSS 4.3

CVE-2021-28557: Adobe Acrobat Reader out-of-bounds read in PDFLibTool could lead to information exposure

Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to leak sensitive system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 2, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.6

CVE-2021-23438: Prototype Pollution

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Published Sep 1, 2021 · Updated Sep 16, 2024

High · CVSS 8

CVE-2021-25960: SuiteCRM - CSV Injection in Accounts Module

In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure.

Published Sep 29, 2021 · Updated Sep 16, 2024

High · CVSS 7.8

CVE-2021-40710: Adobe Premiere Pro 2021 SVG File Parsing Leads to Memory Corruption

Adobe Premiere Pro version 15.4 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .svg file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.

Published Sep 29, 2021 · Updated Sep 16, 2024

Low · CVSS 3.3

CVE-2021-39858: Adobe Acrobat Pro DC PostScript File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of arbitrary memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 29, 2021 · Updated Sep 16, 2024

High · CVSS 7.8

CVE-2021-39836: Adobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution Vulnerability

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 29, 2021 · Updated Sep 16, 2024

Critical · CVSS 9.8

CVE-2021-37913: HGiga OAKlouds - Command Injection-2

The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote attackers can use this vulnerability to perform command injection and execute arbitrary commands in the system without logging in.

Published Sep 15, 2021 · Updated Sep 16, 2024

Critical · CVSS 9.8

CVE-2021-41301: ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files using an HTTP GET request. This will enable the unauthenticated attacker to remotely disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Published Sep 30, 2021 · Updated Sep 16, 2024

Medium · CVSS 6.1

CVE-2021-39846: Adobe Acrobat Reader /Parent Property Recursive Stack Overflow

Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a stack overflow vulnerability due to insecure handling of a crafted PDF file, potentially resulting in memory corruption in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted PDF file in Acrobat Reader.

Published Sep 29, 2021 · Updated Sep 16, 2024

Medium · CVSS 6.4

CVE-2021-29808: IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site...

IBM Jazz for Service Management and IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204269.

Published Sep 20, 2021 · Updated Sep 16, 2024

Medium · CVSS 5.6

CVE-2021-23436: Prototype Pollution

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

Published Sep 1, 2021 · Updated Sep 16, 2024

High · CVSS 8.8

CVE-2021-21105: Adobe Illustrator memory corruption vulnerability could lead to remote code execution

Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Published Sep 8, 2021 · Updated Sep 16, 2024

Low · CVSS 3.7

CVE-2021-28566: Magento Commerce information disclosure during upload action leveraging a specially crafted file

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Published Sep 8, 2021 · Updated Sep 16, 2024

High · CVSS 7.5

CVE-2021-3053: PAN-OS: Exceptional Condition Denial-of-Service (DoS)

An improper handling of exceptional conditions vulnerability exists in the Palo Alto Networks PAN-OS dataplane that enables an unauthenticated network-based attacker to send specifically crafted traffic through the firewall that causes the service to crash. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.9; PAN-OS 10.0 versions earlier than PAN-OS 10.0.5. This issue does not affect Prisma Access.

Published Sep 8, 2021 · Updated Sep 16, 2024