Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2021

96 records · 30 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-37415
    99Now

    Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    zohocorp · manageengine servicedesk plusSep 1, 2021

  • CVE-2021-39378
    46Plan

    A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database.

    CriticalCVSS 9.8Proof of conceptEPSS 22%

    os4ed · opensisSep 1, 2021

  • CVE-2021-35215
    56Plan

    ActionPluginBaseView Deserialization of Untrusted Data RCE

    HighCVSS 8.8Proof of conceptEPSS 69%

    solarwinds · orion platformSep 1, 2021

  • CVE-2021-35216
    59Plan

    Deserialization of Untrusted Data in Resource Controls Remote Code Execution

    HighCVSS 8.8No exploitEPSS 81%

    solarwinds · patch managerSep 1, 2021

  • CVE-2021-35218
    58Plan

    Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 76%

    solarwinds · orion platformSep 1, 2021

  • CVE-2021-40378
    37Monitor

    An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.

    HighCVSS 8.1Proof of conceptEPSS 15%

    comprotech · ip70 firmwareSep 1, 2021

  • CVE-2021-40379
    36Monitor

    An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.

    HighCVSS 7.5Proof of conceptEPSS 21%

    comprotech · ip70 firmwareSep 1, 2021

  • CVE-2021-40380
    37Monitor

    An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.

    HighCVSS 7.5Proof of conceptEPSS 22%

    comprotech · ip70 firmwareSep 1, 2021

  • CVE-2021-40381
    37Monitor

    An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.

    HighCVSS 7.5Proof of conceptEPSS 22%

    comprotech · ip70 firmwareSep 1, 2021

  • CVE-2021-40382
    37Monitor

    An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices.

    HighCVSS 7.5Proof of conceptEPSS 22%

    comprotech · ip70 firmwareSep 1, 2021

  • CVE-2021-34746
    44Plan

    Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability

    CriticalCVSS 9.8No exploitEPSS 17%

    cisco · enterprise nfv infrastructure softwareSep 1, 2021

  • CVE-2021-28550
    81Now

    Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution

    HighCVSS 8.8KEVWeaponizedEPSS 51%

    adobe · acrobat dcSep 2, 2021

  • CVE-2021-28558
    38Monitor

    Adobe Acrobat Reader heap-based buffer overflow could lead to arbitrary code execution

    HighCVSS 8.8No exploitEPSS 10%

    adobe · acrobat dcSep 2, 2021

  • CVE-2021-28560
    55Plan

    Adobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code execution

    HighCVSS 8.8No exploitEPSS 66%

    adobe · acrobat dcSep 2, 2021

  • CVE-2021-38314
    30Monitor

    Gutenberg Template Library & Redux Framework <= 4.2.11 Sensitive Information Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 28%

    redux · gutenberg template library \& redux frameworkSep 2, 2021

  • CVE-2021-40531
    49Plan

    Sketch before 75 allows library feeds to be used to bypass file quarantine.

    CriticalCVSS 9.8Proof of conceptEPSS 32%

    sketch · sketchSep 6, 2021

  • CVE-2021-40539
    99Now

    Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resultant remote code execu

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    zohocorp · manageengine adselfservice plusSep 7, 2021

  • CVE-2020-11264
    43Plan

    Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapd

    CriticalCVSS 9.8No exploitEPSS 13%

    qualcomm · apq8053 firmwareSep 8, 2021

  • CVE-2020-11301
    33Monitor

    Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto

    HighCVSS 7.5No exploitEPSS 11%

    qualcomm · apq8009 firmwareSep 8, 2021

  • CVE-2021-30721
    33Monitor

    A path handling issue was addressed with improved validation.

    MediumCVSS 6.5No exploitEPSS 24%

    apple · mac os xSep 8, 2021

  • CVE-2021-30761
    68This week

    A memory corruption issue was addressed with improved state management.

    HighCVSS 8.8KEVWeaponizedEPSS 10%

    apple · iphone osSep 8, 2021

  • CVE-2021-30762
    68This week

    A use after free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 10%

    apple · iphone osSep 8, 2021

  • CVE-2021-35217
    57Plan

    Insecure Deserialization of untrusted data causing Remote code execution vulnerability.

    HighCVSS 8.8No exploitEPSS 72%

    solarwinds · patch managerSep 8, 2021

  • CVE-2021-30657
    73This week

    A logic issue was addressed with improved state management.

    MediumCVSS 5.5KEVWeaponizedEPSS 68%

    apple · mac os xSep 8, 2021

  • CVE-2021-30661
    66This week

    A use after free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 4%

    apple · safariSep 8, 2021

  • CVE-2021-30663
    66This week

    An integer overflow was addressed with improved input validation.

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    apple · safariSep 8, 2021

  • CVE-2021-30665
    66This week

    A memory corruption issue was addressed with improved state management.

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    apple · ipadosSep 8, 2021

  • CVE-2021-30666
    66This week

    A buffer overflow issue was addressed with improved memory handling.

    HighCVSS 8.8KEVWeaponizedEPSS 2%

    apple · iphone osSep 8, 2021

  • CVE-2021-30713
    63This week

    A permissions issue was addressed with improved validation.

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    apple · mac os xSep 8, 2021

  • CVE-2021-40346
    48Plan

    An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, a

    HighCVSS 7.5Proof of conceptEPSS 58%

    haproxy · haproxySep 8, 2021

  • CVE-2021-38408
    42Plan

    A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the leng

    CriticalCVSS 9.8No exploitEPSS 11%

    advantech · webaccessSep 9, 2021

  • CVE-2020-7873
    39Monitor

    Download of code without integrity check vulnerability in ActiveX control of Younglimwon Co., Ltd allows the attacker to cause a arbitrary f

    CriticalCVSS 9.8No exploitEPSS 0%

    ksystem · k-system wellcommSep 9, 2021

  • CVE-2021-38540
    63This week

    Apache Airflow: Variable Import endpoint missed authentication check

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    apache · airflowSep 9, 2021

  • CVE-2021-24040
    44Plan

    Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio

    CriticalCVSS 9.8Proof of conceptEPSS 17%

    facebook · parlaiSep 10, 2021

  • CVE-2021-40870
    97Now

    An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922.

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    aviatrix · controllerSep 13, 2021

  • CVE-2021-33543
    63This week

    UDP Technology/Geutebrück camera devices: Authentication Bypass

    CriticalCVSS 9.8WeaponizedEPSS 81%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33544
    57Plan

    UDP Technology/Geutebrück camera devices: command injection leading to RCE

    HighCVSS 7.2WeaponizedEPSS 95%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33548
    46Plan

    UDP Technology/Geutebrück camera devices: Command injection in preserve parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 59%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33549
    49Plan

    UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 68%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33550
    46Plan

    UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 59%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33551
    43Plan

    UDP Technology/Geutebrück camera devices: Command injection in environment.lang parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 51%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33552
    43Plan

    UDP Technology/Geutebrück camera devices: Command injection in date parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 51%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33553
    43Plan

    UDP Technology/Geutebrück camera devices: Command injection in command parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 51%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-33554
    46Plan

    UDP Technology/Geutebrück camera devices: Command injection in appfile.filename parameter leading to RCE

    HighCVSS 7.2WeaponizedEPSS 59%

    geutebrueck · g-cam ebc-2110 firmwareSep 13, 2021

  • CVE-2021-37200
    41Plan

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1).

    HighCVSS 7.7No exploitEPSS 37%

    siemens · sinec network management systemSep 14, 2021

  • CVE-2021-38163
    76This week

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administra

    HighCVSS 8.8KEVWeaponizedEPSS 36%

    sap · netweaverSep 14, 2021

  • CVE-2021-36952
    46Plan

    Visual Studio Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 51%

    microsoft · visual studio 2017Sep 15, 2021

  • CVE-2021-36955
    62This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    microsoft · windows 10 1507Sep 15, 2021

  • CVE-2021-38645
    62This week

    Open Management Infrastructure Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    microsoft · azure automation state configurationSep 15, 2021

  • CVE-2021-38646
    63This week

    Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    microsoft · 365 appsSep 15, 2021

  • CVE-2021-38647
    99Now

    Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · azure automation state configurationSep 15, 2021

  • CVE-2021-38648
    64This week

    Open Management Infrastructure Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 11%

    microsoft · azure automation state configurationSep 15, 2021

  • CVE-2021-38649
    59Plan

    Open Management Infrastructure Elevation of Privilege Vulnerability

    HighCVSS 7.0KEVWeaponizedEPSS 2%

    microsoft · azure automation state configurationSep 15, 2021

  • CVE-2021-40444
    94Now

    Microsoft MSHTML Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 97%

    microsoft · windows 10 1507Sep 15, 2021

  • CVE-2021-21798
    37Monitor

    An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

    HighCVSS 7.8No exploitEPSS 21%

    gonitro · nitro proSep 15, 2021

  • CVE-2021-38156
    49Plan

    In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.

    MediumCVSS 5.4Proof of conceptEPSS 92%

    nagios · nagios xiSep 15, 2021

  • CVE-2021-33690
    60This week

    Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service v

    CriticalCVSS 9.9Proof of conceptEPSS 69%

    sap · netweaver development infrastructureSep 15, 2021

  • CVE-2021-33044
    99Now

    The identity authentication bypass vulnerability found in some Dahua products during the login process.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    dahuasecurity · ipc-hum7xxx firmwareSep 15, 2021

  • CVE-2021-33045
    99Now

    The identity authentication bypass vulnerability found in some Dahua products during the login process.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    dahuasecurity · ipc-hum7xxx firmwareSep 15, 2021

  • CVE-2021-34798
    49Plan

    NULL pointer dereference in httpd core

    HighCVSS 7.5No exploitEPSS 64%

    apache · http serverSep 16, 2021

  • CVE-2021-36160
    49Plan

    mod_proxy_uwsgi out of bound read

    HighCVSS 7.5No exploitEPSS 62%

    apache · http serverSep 16, 2021

  • CVE-2021-39275
    51Plan

    ap_escape_quotes buffer overflow

    CriticalCVSS 9.8No exploitEPSS 39%

    apache · http serverSep 16, 2021

  • CVE-2021-40438
    96Now

    A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    resf · rocky linuxSep 16, 2021

  • CVE-2021-41314
    39Monitor

    Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the a

    HighCVSS 8.8No exploitEPSS 13%

    netgear · gc108p firmwareSep 16, 2021

  • CVE-2021-41303
    62This week

    Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

    CriticalCVSS 9.8No exploitEPSS 76%

    apache · shiroSep 17, 2021

  • CVE-2021-39327
    60This week

    BulletProof Security <= 5.1 Sensitive Information Disclosure

    MediumCVSS 5.3WeaponizedEPSS 71%

    ait-pro · bulletproof securitySep 17, 2021

  • CVE-2021-38406
    84Now

    Delta Electronics DOPSoft 2 Out-of-Bounds Write

    HighCVSS 7.8KEVWeaponizedEPSS 76%

    deltaww · dopsoftSep 17, 2021

  • CVE-2021-40847
    35Monitor

    The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code executio

    HighCVSS 8.1No exploitEPSS 10%

    netgear · r6400v2 firmwareSep 21, 2021

  • CVE-2021-36260
    99Now

    A command injection vulnerability in the web server of some Hikvision product.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    hikvision · ds-2cd2026g2-iu\/sl firmwareSep 22, 2021

  • CVE-2021-37925
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusSep 22, 2021

  • CVE-2021-40875
    44Plan

    Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure.

    HighCVSS 7.5Proof of conceptEPSS 47%

    gurock · testrailSep 22, 2021

  • CVE-2021-33035
    46Plan

    Buffer overflow from a crafted DBF file

    HighCVSS 7.8No exploitEPSS 50%

    apache · openofficeSep 23, 2021

  • CVE-2021-22005
    99Now

    The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service.

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · cloud foundationSep 23, 2021

  • CVE-2021-22015
    40Plan

    The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories.

    HighCVSS 7.8WeaponizedEPSS 1%

    vmware · cloud foundationSep 23, 2021

  • CVE-2021-22017
    66This week

    Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization.

    MediumCVSS 5.3KEVWeaponizedEPSS 49%

    vmware · vcenter serverSep 23, 2021

  • CVE-2021-22941
    85Now

    Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compro

    CriticalCVSS 9.8KEVWeaponizedEPSS 53%

    citrix · sharefile storagezones controllerSep 23, 2021

  • CVE-2021-41381
    46Plan

    Payara Micro Community 5.2021.6 and below allows Directory Traversal.

    HighCVSS 7.5Proof of conceptEPSS 52%

    payara · micro communitySep 23, 2021

  • CVE-2021-36749
    50Plan

    Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)

    MediumCVSS 6.5Proof of conceptEPSS 80%

    apache · druidSep 24, 2021

  • CVE-2021-40655
    86Now

    An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT.

    HighCVSS 7.5KEVWeaponizedEPSS 86%

    dlink · dir-605l firmwareSep 24, 2021

  • CVE-2021-37539
    67This week

    Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.

    CriticalCVSS 9.8No exploitEPSS 92%

    zohocorp · manageengine admanager plusSep 27, 2021

  • CVE-2021-20034
    60This week

    An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete a

    CriticalCVSS 9.1Proof of conceptEPSS 81%

    sonicwall · sma 200 firmwareSep 27, 2021

  • CVE-2021-20035
    57Plan

    Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co

    MediumCVSS 6.5KEVWeaponizedEPSS 4%

    sonicwall · sma 200 firmwareSep 27, 2021

  • CVE-2021-40651
    31Monitor

    OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arb

    MediumCVSS 6.5Proof of conceptEPSS 17%

    os4ed · opensisSep 29, 2021

  • CVE-2021-39836
    52Plan

    Adobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 69%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39837
    51Plan

    Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 65%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39838
    51Plan

    Adobe Acrobat Reader DC AcroForm buttonGetCaption Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 65%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39839
    51Plan

    Adobe Acrobat Reader DC AcroForm getItemAt Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 65%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39840
    46Plan

    Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 50%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39841
    35Monitor

    Adobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39842
    36Monitor

    Adobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free Vulnerability

    HighCVSS 7.8No exploitEPSS 17%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39843
    54Plan

    Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability

    HighCVSS 7.8No exploitEPSS 76%

    adobe · acrobatSep 29, 2021

  • CVE-2021-39863
    35Monitor

    Adobe Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution

    HighCVSS 7.8Proof of conceptEPSS 13%

    adobe · acrobat dcSep 29, 2021

  • CVE-2021-41826
    28Monitor

    PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.

    MediumCVSS 6.1Proof of conceptEPSS 12%

    place · placeos authenticationSep 29, 2021

  • CVE-2021-41291
    55Plan

    ECOA BAS controller - Path Traversal-1

    HighCVSS 7.5Proof of conceptEPSS 82%

    ecoa · ecs router controller-ecs firmwareSep 30, 2021

  • CVE-2021-41293
    36Monitor

    ECOA BAS controller - Path Traversal-3

    HighCVSS 7.5Proof of conceptEPSS 19%

    ecoa · ecs router controller-ecs firmwareSep 30, 2021

  • CVE-2021-41288
    63This week

    Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.

    CriticalCVSS 9.8No exploitEPSS 79%

    zohocorp · manageengine opmanagerSep 30, 2021