# CVEs published 2021-09-27

115 CVEs were published on September 27, 2021: 4 critical, 21 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-20693](https://cve.now/CVE-2020-20693.md): A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts. (no CVSS, gilacms/gila)
- [CVE-2020-20695](https://cve.now/CVE-2020-20695.md): A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a… (no CVSS, gilacms/gila)
- [CVE-2020-20696](https://cve.now/CVE-2020-20696.md): A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or… (no CVSS, gilacms/gila)
- [CVE-2020-20691](https://cve.now/CVE-2020-20691.md): An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and… (no CVSS)
- [CVE-2020-20692](https://cve.now/CVE-2020-20692.md): GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $\_GET parameter in /src/core/controllers/cm.php. (no CVSS)
- [CVE-2021-37274](https://cve.now/CVE-2021-37274.md): Kingdee KIS Professional Edition has a privilege escalation vulnerability. (no CVSS)
- [CVE-2020-24930](https://cve.now/CVE-2020-24930.md): Beijing Wuzhi Internet Technology Co., Ltd. (no CVSS)
- [CVE-2021-37270](https://cve.now/CVE-2021-37270.md): There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. (no CVSS)
- [CVE-2021-41098](https://cve.now/CVE-2021-41098.md): Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby (CVSS 7.5, sparklemotion nokogiri · nokogiri)
- [CVE-2021-41095](https://cve.now/CVE-2021-41095.md): XSS via blocked watched word in error message (CVSS 4.2, discourse)
- [CVE-2021-41096](https://cve.now/CVE-2021-41096.md): Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky (CVSS 7.5, mayankmetha Rucky)
- [CVE-2021-41097](https://cve.now/CVE-2021-41097.md): Prototype pollution in aurelia-path (CVSS 9.1, aurelia path · aurelia-path)
- [CVE-2021-20035](https://cve.now/CVE-2021-20035.md): Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co (CVSS 6.5, KEV, SonicWall SMA100)
- [CVE-2021-20034](https://cve.now/CVE-2021-20034.md): An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete… (no CVSS, SonicWall SMA100)
- [CVE-2021-41558](https://cve.now/CVE-2021-41558.md): The set\_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility\_hook bypass via set\_config. (no CVSS)
- [CVE-2021-23445](https://cve.now/CVE-2021-23445.md): Cross-site Scripting (XSS) (CVSS 3.1, datatables.net)
- [CVE-2021-37761](https://cve.now/CVE-2021-37761.md): Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution. (no CVSS)
- [CVE-2021-41753](https://cve.now/CVE-2021-41753.md): A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a… (no CVSS)
- [CVE-2021-40329](https://cve.now/CVE-2021-40329.md): The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. (no CVSS, Ping Identity PingFederate)
- [CVE-2021-36134](https://cve.now/CVE-2021-36134.md): Out of bounds write in Netop Vision Pro (CVSS 7.4)
- [CVE-2021-40712](https://cve.now/CVE-2021-40712.md): Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS (CVSS 6.5, Adobe Experience Manager)
- [CVE-2021-40714](https://cve.now/CVE-2021-40714.md): Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter (CVSS 6.1, Adobe Experience Manager)
- [CVE-2021-40700](https://cve.now/CVE-2021-40700.md): Adobe Premiere Elements TIFF Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-40709](https://cve.now/CVE-2021-40709.md): Adobe Photoshop Buffer Overflow leads to Arbitrary Code Execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-40701](https://cve.now/CVE-2021-40701.md): Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-39828](https://cve.now/CVE-2021-39828.md): Adobe Digital Editions Installer flaw leads to Local Privilege Escalation (CVSS 5.8, Adobe Digital Editions)
- [CVE-2021-40703](https://cve.now/CVE-2021-40703.md): Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Not a product)
- [CVE-2021-39825](https://cve.now/CVE-2021-39825.md): Adobe Photoshop Elements Edit 2021 TTF Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop Elements)
- [CVE-2021-40713](https://cve.now/CVE-2021-40713.md): Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack (CVSS 5.9, Adobe Experience Manager)
- [CVE-2021-39827](https://cve.now/CVE-2021-39827.md): Adobe Digital Editions Installer flaw leads to Arbitrary File System Write (CVSS 6.5, Adobe Digital Editions)
- [CVE-2021-40702](https://cve.now/CVE-2021-40702.md): Adobe Premiere Elements psd Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-39824](https://cve.now/CVE-2021-39824.md): Adobe Premiere Elements png Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-40711](https://cve.now/CVE-2021-40711.md): Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code Execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2021-28613](https://cve.now/CVE-2021-28613.md): Adobe Creative Cloud Arbitrary File Overwrite Vulnerability (CVSS 7.4, Adobe Creative Cloud)
- [CVE-2021-39818](https://cve.now/CVE-2021-39818.md): Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe InCopy)
- [CVE-2021-39826](https://cve.now/CVE-2021-39826.md): Adobe Digital Editions Command Execution Vulnerability (CVSS 8.6, Adobe Digital Editions)
- [CVE-2021-39819](https://cve.now/CVE-2021-39819.md): Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe InCopy)
- [CVE-2021-39823](https://cve.now/CVE-2021-39823.md): svg-native-viewer Heap Buffer overflow Vulnerability (CVSS 7.8, Adobe SVG Native Viewer)
- [CVE-2021-36845](https://cve.now/CVE-2021-36845.md): YITH Maintenance Mode (WordPress plugin) \<= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 6.9, YITH Maintenance Mode)
- [CVE-2021-36841](https://cve.now/CVE-2021-36841.md): YITH Maintenance Mode (WordPress plugin) \<= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability. (CVSS 6.9, YITH Maintenance Mode)
- [CVE-2021-36875](https://cve.now/CVE-2021-36875.md): WordPress uListing plugin \<= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2021-36880](https://cve.now/CVE-2021-36880.md): WordPress uListing plugin \<= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability (CVSS 8.6, StylemixThemes uListing)
- [CVE-2021-36874](https://cve.now/CVE-2021-36874.md): WordPress uListing plugin \<= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1, StylemixThemes uListing)
- [CVE-2021-36877](https://cve.now/CVE-2021-36877.md): WordPress uListing plugin \<= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StylemixThemes uListing)
- [CVE-2021-36876](https://cve.now/CVE-2021-36876.md): WordPress uListing plugin \<= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, StylemixThemes uListing)
- [CVE-2021-36879](https://cve.now/CVE-2021-36879.md): WordPress uListing plugin \<= 2.0.5 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, StylemixThemes uListing)
- [CVE-2021-24671](https://cve.now/CVE-2021-24671.md): MX Time Zone Clocks \< 3.4.1 - Contributor+ Cross-Site Scripting (no CVSS, MX Time Zone Clocks)
- [CVE-2021-24670](https://cve.now/CVE-2021-24670.md): CoolClock \< 4.3.5 - Contributor+ Stored Cross-Site Scripting (no CVSS, CoolClock – a Javascript Analog Clock)
- [CVE-2021-24666](https://cve.now/CVE-2021-24666.md): Podlove Podcast Publisher \< 3.5.6 - Unauthenticated SQL Injection (no CVSS, Podlove Podcast Publisher)
- [CVE-2021-24661](https://cve.now/CVE-2021-24661.md): PostX Gutenberg Blocks Saved Templates Addon \< 2.4.10 - Private Content Disclosure (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24660](https://cve.now/CVE-2021-24660.md): PostX Gutenberg Blocks Saved Templates Addon \< 2.4.10 - Contributor+ Stored Cross-Site Scripting (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24659](https://cve.now/CVE-2021-24659.md): PostX Gutenberg Blocks for Post Grid \< 2.4.10 - Contributor+ Stored Cross-Site Scripting (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24652](https://cve.now/CVE-2021-24652.md): PostX Gutenberg Blocks for Post Grid \< 2.4.10 - Missing Access Controls (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24643](https://cve.now/CVE-2021-24643.md): WP Map Block \< 1.2.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, WP Map Block – Gutenberg Map Block for Google Map and OpenS…)
- [CVE-2021-24634](https://cve.now/CVE-2021-24634.md): Recipe Card Blocks \< 2.8.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, Recipe Card Blocks by WPZOOM)
- [CVE-2021-24633](https://cve.now/CVE-2021-24633.md): Countdown Block \< 1.1.2 - Missing Authorisation in AJAX action (no CVSS, Countdown Block)
- [CVE-2021-24632](https://cve.now/CVE-2021-24632.md): Recipe Card Blocks \< 2.8.1 - Reflected Cross-Site Scripting (no CVSS, Recipe Card Blocks by WPZOOM)
- [CVE-2021-24610](https://cve.now/CVE-2021-24610.md): TranslatePress \< 2.0.9 - Authenticated Stored Cross-Site Scripting (no CVSS, Translate Multilingual sites – TranslatePress)
- [CVE-2021-24569](https://cve.now/CVE-2021-24569.md): Cookie Notice & Compliance for GDPR / CCPA \< 2.1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Cookie Notice & Compliance for GDPR / CCPA)
- [CVE-2021-36878](https://cve.now/CVE-2021-36878.md): WordPress uListing plugin \<= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StylemixThemes uListing)
- [CVE-2021-37539](https://cve.now/CVE-2021-37539.md): Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. (no CVSS)
- [CVE-2021-26587](https://cve.now/CVE-2021-26587.md): A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. (no CVSS, HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200;…)
- [CVE-2021-34413](https://cve.now/CVE-2021-34413.md): All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU)… (no CVSS, Zoom Plugin for Microsoft Outlook for MacOS)
- [CVE-2021-34416](https://cve.now/CVE-2021-34416.md): The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom… (no CVSS, Zoom On-Premise Meeting Connector Controller, Zoom On-Premi…)
- [CVE-2021-34415](https://cve.now/CVE-2021-34415.md): The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt… (no CVSS, Zoom On-Premise Meeting Connector Controller)
- [CVE-2021-34414](https://cve.now/CVE-2021-34414.md): The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom… (no CVSS, Zoom on-premise Meeting Connector Controller, Zoom on-premi…)
- [CVE-2021-34412](https://cve.now/CVE-2021-34412.md): During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch… (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-34411](https://cve.now/CVE-2021-34411.md): During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet… (no CVSS, Zoom Rooms for Conference Room for Windows)
- [CVE-2021-34410](https://cve.now/CVE-2021-34410.md): A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before… (no CVSS, Zoom Plugin for Microsoft Outlook for Mac)
- [CVE-2021-34409](https://cve.now/CVE-2021-34409.md): Zoom Client Installer Local Privilege Escalation (CVSS 7.8, Zoom Video Communications Zoom Client for Meetings for M… +1)
- [CVE-2021-34408](https://cve.now/CVE-2021-34408.md): The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a… (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-33907](https://cve.now/CVE-2021-33907.md): The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign… (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-37786](https://cve.now/CVE-2021-37786.md): Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of… (no CVSS)
- [CVE-2021-22272](https://cve.now/CVE-2021-22272.md): ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase. (CVSS 6.5, mybuildings.abb.com · my.busch-jaeger.de)
- [CVE-2021-36218](https://cve.now/CVE-2021-36218.md): An issue was discovered in SKALE sgxwallet 1.58.3. (no CVSS)
- [CVE-2021-36219](https://cve.now/CVE-2021-36219.md): An issue was discovered in SKALE sgxwallet 1.58.3. (no CVSS)
- [CVE-2021-3828](https://cve.now/CVE-2021-3828.md): Inefficient Regular Expression Complexity in nltk/nltk (CVSS 7.5, nltk/nltk · nltk)
- [CVE-2021-3822](https://cve.now/CVE-2021-3822.md): Inefficient Regular Expression Complexity in josdejong/jsoneditor (CVSS 5.3, josdejong/jsoneditor · jsoneditor)
- [CVE-2021-3820](https://cve.now/CVE-2021-3820.md): Inefficient Regular Expression Complexity in pksunkara/inflect (CVSS 5.3, pksunkara/inflect · i)
- [CVE-2021-3819](https://cve.now/CVE-2021-3819.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 4.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3818](https://cve.now/CVE-2021-3818.md): Reliance on Cookies without Validation and Integrity Checking in getgrav/grav (CVSS 6.3, getgrav/grav)
- [CVE-2021-3799](https://cve.now/CVE-2021-3799.md): Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin (CVSS 5.4, getgrav/grav-plugin-admin)
- [CVE-2021-23243](https://cve.now/CVE-2021-23243.md): In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. (no CVSS, OPPO Android Phone with Qualcomm chipset)
- [CVE-2021-40109](https://cve.now/CVE-2021-40109.md): A SSRF issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40108](https://cve.now/CVE-2021-40108.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40106](https://cve.now/CVE-2021-40106.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40105](https://cve.now/CVE-2021-40105.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40104](https://cve.now/CVE-2021-40104.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-0660](https://cve.now/CVE-2021-0660.md): In ccu, there is a possible out of bounds read due to incorrect error handling. (no CVSS, MT6779, MT6853, MT6873, MT6885)
- [CVE-2021-0612](https://cve.now/CVE-2021-0612.md): In m4u, there is a possible memory corruption due to a use after free. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0611](https://cve.now/CVE-2021-0611.md): In m4u, there is a possible memory corruption due to a use after free. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0610](https://cve.now/CVE-2021-0610.md): In memory management driver, there is a possible memory corruption due to an integer overflow. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0425](https://cve.now/CVE-2021-0425.md): In memory management driver, there is a possible side channel information disclosure. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0424](https://cve.now/CVE-2021-0424.md): In memory management driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0423](https://cve.now/CVE-2021-0423.md): In memory management driver, there is a possible information disclosure due to uninitialized data. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0422](https://cve.now/CVE-2021-0422.md): In memory management driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0421](https://cve.now/CVE-2021-0421.md): In memory management driver, there is a possible information disclosure due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-40103](https://cve.now/CVE-2021-40103.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40098](https://cve.now/CVE-2021-40098.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40097](https://cve.now/CVE-2021-40097.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-23054](https://cve.now/CVE-2021-23054.md): On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected… (no CVSS, BIG-IP APM)
- [CVE-2021-20317](https://cve.now/CVE-2021-20317.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-34570](https://cve.now/CVE-2021-34570.md): Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS (CVSS 7.5, Phoenix Contact AXC F · Phoenix Contact RFC +1)
- [CVE-2021-41580](https://cve.now/CVE-2021-41580.md): The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. (no CVSS, passport-oauth2)
- [CVE-2021-38299](https://cve.now/CVE-2021-38299.md): Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. (no CVSS, web-auth/webauthn-framework)
- [CVE-2021-41385](https://cve.now/CVE-2021-41385.md): The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295\_0302 allows an authenticated user to obtain access to server… (no CVSS)
- [CVE-2021-41329](https://cve.now/CVE-2021-41329.md): Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their… (no CVSS)
- [CVE-2021-40981](https://cve.now/CVE-2021-40981.md): ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable… (no CVSS)
- [CVE-2021-40349](https://cve.now/CVE-2021-40349.md): e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring. (no CVSS)
- [CVE-2021-31605](https://cve.now/CVE-2021-31605.md): furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. (no CVSS, openvpn-monitor)
- [CVE-2021-31604](https://cve.now/CVE-2021-31604.md): furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. (no CVSS, openvpn-monitor)
- [CVE-2021-34351](https://cve.now/CVE-2021-34351.md): Command Injection Vulnerability in QVR (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-34349](https://cve.now/CVE-2021-34349.md): Command Injection Vulnerability in QVR (CVSS 7.2, QNAP Systems QVR)
- [CVE-2021-34348](https://cve.now/CVE-2021-34348.md): Command Injection Vulnerability in QVR (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-31606](https://cve.now/CVE-2021-31606.md): furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. (no CVSS, openvpn-monitor)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.