# CVEs published 2021-10-21

59 CVEs were published on October 21, 2021: 1 critical, 6 high. Days are UTC.

- [CVE-2021-27746](https://cve.now/CVE-2021-27746.md): "HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability" (no CVSS, "HCL Connections")
- [CVE-2021-41169](https://cve.now/CVE-2021-41169.md): Improper Neutralization HTML tags in sulu/sulu (CVSS 6.2, sulu · sulu/sulu)
- [CVE-2021-36869](https://cve.now/CVE-2021-36869.md): WordPress Ivory Search plugin \<= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Ivory Search)
- [CVE-2021-41127](https://cve.now/CVE-2021-41127.md): Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa (CVSS 7.3, RasaHQ rasa · rasa)
- [CVE-2021-41168](https://cve.now/CVE-2021-41168.md): Hash-Collision Denial-of-Service Vulnerability in snudown (CVSS 6.5, reddit snudown)
- [CVE-2021-39354](https://cve.now/CVE-2021-39354.md): Easy Digital Downloads \<= 2.11.2 Authenticated Reflected Cross-Site Scripting (CVSS 4.8, Easy Digital Downloads)
- [CVE-2021-39321](https://cve.now/CVE-2021-39321.md): Sassy Social Share 3.3.23 PHP Object Injection (CVSS 8.8, Sassy Social Share)
- [CVE-2021-39328](https://cve.now/CVE-2021-39328.md): Simple Job Board \<= 2.9.4 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Simple Job Board)
- [CVE-2021-39352](https://cve.now/CVE-2021-39352.md): Catch Themes Demo Import \<= 1.7 Admin+ Arbitrary File Upload (CVSS 7.2, Catch Themes Demo Import)
- [CVE-2021-39356](https://cve.now/CVE-2021-39356.md): Content Staging \<= 2.0.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Content Staging)
- [CVE-2021-39357](https://cve.now/CVE-2021-39357.md): Leaky Paywall \<= 4.16.5 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Leaky Paywall)
- [CVE-2021-39348](https://cve.now/CVE-2021-39348.md): LearnPress – WordPress LMS Plugin \<= 4.1.3.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, LearnPress)
- [CVE-2021-22034](https://cve.now/CVE-2021-22034.md): Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability. (no CVSS, VMware vRealize Operations Tenant App for VMware Cloud Dire…)
- [CVE-2021-40719](https://cve.now/CVE-2021-40719.md): Adobe Connect Deserialization of Untrusted Data Remote Code Execution (CVSS 9.8, Adobe Connect)
- [CVE-2021-42716](https://cve.now/CVE-2021-42716.md): An issue was discovered in stb stb\_image.h 2.27. (no CVSS)
- [CVE-2021-35228](https://cve.now/CVE-2021-35228.md): Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388 (CVSS 5.5, SolarWinds)
- [CVE-2021-35227](https://cve.now/CVE-2021-35227.md): Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM (CVSS 4.7, SolarWinds Access Rights Manager)
- [CVE-2021-35225](https://cve.now/CVE-2021-35225.md): Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 (CVSS 5.0, SolarWinds NPM)
- [CVE-2021-41146](https://cve.now/CVE-2021-41146.md): Arbitrary command execution on Windows in qutebrowser (CVSS 8.8, qutebrowser)
- [CVE-2021-28496](https://cve.now/CVE-2021-28496.md): In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over… (CVSS 5.7, Arista Networks Arista EOS)
- [CVE-2021-29883](https://cve.now/CVE-2021-29883.md): IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization… (CVSS 4.3, IBM Transformation Extender Advanced)
- [CVE-2021-29873](https://cve.now/CVE-2021-29873.md): IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a… (CVSS 8.8, IBM FlashSystem · IBM Storwize +3)
- [CVE-2020-14263](https://cve.now/CVE-2020-14263.md): "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" (no CVSS, "HCL Traveler Companion")
- [CVE-2021-20120](https://cve.now/CVE-2021-20120.md): The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. (no CVSS, Arris SurfBoard SB8200)
- [CVE-2021-28975](https://cve.now/CVE-2021-28975.md): WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst\_servers page, for a crafted server\_host… (no CVSS)
- [CVE-2020-27304](https://cve.now/CVE-2020-27304.md): The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP… (no CVSS, civetweb\_project civetweb)
- [CVE-2021-42740](https://cve.now/CVE-2021-42740.md): The shell-quote package before 1.7.3 for Node.js allows command injection. (no CVSS, shell-quote)
- [CVE-2021-35512](https://cve.now/CVE-2021-35512.md): An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. (no CVSS)
- [CVE-2021-41792](https://cve.now/CVE-2021-41792.md): An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services… (no CVSS)
- [CVE-2021-41791](https://cve.now/CVE-2021-41791.md): An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. (no CVSS)
- [CVE-2021-41790](https://cve.now/CVE-2021-41790.md): An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. (no CVSS)
- [CVE-2021-42108](https://cve.now/CVE-2021-42108.md): Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42107](https://cve.now/CVE-2021-42107.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42106](https://cve.now/CVE-2021-42106.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42105](https://cve.now/CVE-2021-42105.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42104](https://cve.now/CVE-2021-42104.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42103](https://cve.now/CVE-2021-42103.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to… (no CVSS, Trend Micro Apex One)
- [CVE-2021-42102](https://cve.now/CVE-2021-42102.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker… (no CVSS, Trend Micro Apex One)
- [CVE-2021-42101](https://cve.now/CVE-2021-42101.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to… (no CVSS, Trend Micro Apex One)
- [CVE-2021-42011](https://cve.now/CVE-2021-42011.md): An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a… (no CVSS, Trend Micro Apex One)
- [CVE-2021-42012](https://cve.now/CVE-2021-42012.md): A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-23139](https://cve.now/CVE-2021-23139.md): A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI… (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-34736](https://cve.now/CVE-2021-34736.md): Cisco Integrated Management Controller GUI Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Computing System)
- [CVE-2021-40123](https://cve.now/CVE-2021-40123.md): Cisco Identity Services Engine File Download Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2021-40122](https://cve.now/CVE-2021-40122.md): Cisco Meeting Server Call Bridge Denial of Service Vulnerability (CVSS 5.9, Cisco Meeting Server)
- [CVE-2021-40121](https://cve.now/CVE-2021-40121.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2021-34789](https://cve.now/CVE-2021-34789.md): Cisco Tetration Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Secure Workload)
- [CVE-2021-34760](https://cve.now/CVE-2021-34760.md): Cisco TelePresence Management Suite Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco TelePresence Management Suite)
- [CVE-2021-34743](https://cve.now/CVE-2021-34743.md): Cisco Webex Software Application Authorization Bypass Vulnerability (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2021-34738](https://cve.now/CVE-2021-34738.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2021-39126](https://cve.now/CVE-2021-39126.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request… (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-1529](https://cve.now/CVE-2021-1529.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 7.8, Cisco IOS XE SD-WAN Software)
- [CVE-2021-39127](https://cve.now/CVE-2021-39127.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a… (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-42097](https://cve.now/CVE-2021-42097.md): GNU Mailman before 2.1.35 may allow remote Privilege Escalation. (no CVSS)
- [CVE-2021-42096](https://cve.now/CVE-2021-42096.md): GNU Mailman before 2.1.35 may allow remote Privilege Escalation. (no CVSS)
- [CVE-2021-41159](https://cve.now/CVE-2021-41159.md): Improper client input validation for FreeRDP gateway connections allows to overwrite memory (CVSS 5.8, FreeRDP)
- [CVE-2021-41160](https://cve.now/CVE-2021-41160.md): Improper region checks in FreeRDP allow out of bound write to memory (CVSS 5.3, FreeRDP)
- [CVE-2021-42327](https://cve.now/CVE-2021-42327.md): dp\_link\_settings\_write in drivers/gpu/drm/amd/display/amdgpu\_dm/amdgpu\_dm\_debugfs.c in the Linux kernel through 5.14.14 allows a… (no CVSS)
- [CVE-2021-42715](https://cve.now/CVE-2021-42715.md): An issue was discovered in stb stb\_image.h 1.33 through 2.27. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.