Security Vulnerabilities - CVEs Published In 2021
The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled, attackers with both network access to the API and valid credentials can read and write data to it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v12.14.
CVSS Score
6.8
EPSS Score
0.006
Published
2021-09-16
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in the Email Template feature. The affected versions of Jira Server or Data Center are before version 8.13.12, and from version 8.14.0 before 8.19.1.
CVSS Score
7.2
EPSS Score
0.026
Published
2021-09-16
An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.
CVSS Score
9.8
EPSS Score
0.016
Published
2021-09-15
An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later changed to a PHP file.
CVSS Score
7.2
EPSS Score
0.017
Published
2021-09-15
CVE-2021-33044
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Known exploited
CVSS Score
9.8
EPSS Score
1.0
Published
2021-09-15
CVE-2021-33045
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets.
Known exploited
CVSS Score
9.8
EPSS Score
0.996
Published
2021-09-15
Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemanager.config.js.
CVSS Score
7.5
EPSS Score
0.012
Published
2021-09-15
An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score
9.8
EPSS Score
0.018
Published
2021-09-15
An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.
CVSS Score
7.2
EPSS Score
0.017
Published
2021-09-15
An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later changed to a PHP file.
CVSS Score
7.2
EPSS Score
0.017
Published
2021-09-15