# CVEs published 2021-09-01

115 CVEs were published on September 1, 2021: 14 critical, 40 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-31797](https://cve.now/CVE-2021-31797.md): The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race condition, leading (no CVSS)
- [CVE-2021-39115](https://cve.now/CVE-2021-39115.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administrators" access to ex (CVSS 7.2, Atlassian Jira Service Desk Server · Atlassian Jira Service…)
- [CVE-2021-39119](https://cve.now/CVE-2021-39119.md): Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving updates on the issue (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-20349](https://cve.now/CVE-2020-20349.md): WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module. (no CVSS)
- [CVE-2020-20347](https://cve.now/CVE-2020-20347.md): WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module. (no CVSS)
- [CVE-2020-20348](https://cve.now/CVE-2020-20348.md): WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module. (no CVSS)
- [CVE-2020-20345](https://cve.now/CVE-2020-20345.md): WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain (no CVSS)
- [CVE-2020-20344](https://cve.now/CVE-2020-20344.md): WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module (no CVSS)
- [CVE-2020-20343](https://cve.now/CVE-2020-20343.md): WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add\_post component that allows attacke (no CVSS)
- [CVE-2021-40385](https://cve.now/CVE-2021-40385.md): An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. (no CVSS)
- [CVE-2021-40387](https://cve.now/CVE-2021-40387.md): An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. (no CVSS)
- [CVE-2021-39186](https://cve.now/CVE-2021-39186.md): Improper Input Validation in GlobalNewFiles (CVSS 4.3, miraheze GlobalNewFiles)
- [CVE-2021-39181](https://cve.now/CVE-2021-39181.md): Unsafe Deserialization of User Data Using XStream (CVSS 8.8, OpenOLAT)
- [CVE-2020-20341](https://cve.now/CVE-2020-20341.md): YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab\_image() function. (no CVSS)
- [CVE-2020-20340](https://cve.now/CVE-2020-20340.md): A SQL injection vulnerability in the 4.edu.php\\conn\\function.php component of S-CMS v1.0 allows attackers to access sensitive database infor (no CVSS)
- [CVE-2021-39185](https://cve.now/CVE-2021-39185.md): Default CORS config allows any origin with credentials (CVSS 9.1, http4s · org.http4s:http4s-server\_2.13.0-M5 +5)
- [CVE-2021-23438](https://cve.now/CVE-2021-23438.md): Prototype Pollution (CVSS 5.6, mpath)
- [CVE-2021-30355](https://cve.now/CVE-2021-30355.md): Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user to elevate privilege (no CVSS, Amazon Kindle e-reader)
- [CVE-2021-30354](https://cve.now/CVE-2021-30354.md): Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buffer Overflow in func (no CVSS, Amazon Kindle e-reader)
- [CVE-2021-23436](https://cve.now/CVE-2021-23436.md): Prototype Pollution (CVSS 5.6, immer)
- [CVE-2021-34435](https://cve.now/CVE-2021-34435.md): In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. (no CVSS, The Eclipse Foundation Eclipse Theia · @theia/mini-browser)
- [CVE-2021-40379](https://cve.now/CVE-2021-40379.md): An issue was discovered on Compro IP70 2.08\_7130218, IP570 2.08\_7130520, IP60, and TN540 devices. (no CVSS)
- [CVE-2021-40380](https://cve.now/CVE-2021-40380.md): An issue was discovered on Compro IP70 2.08\_7130218, IP570 2.08\_7130520, IP60, and TN540 devices. (no CVSS)
- [CVE-2021-40381](https://cve.now/CVE-2021-40381.md): An issue was discovered on Compro IP70 2.08\_7130218, IP570 2.08\_7130520, IP60, and TN540 devices. (no CVSS)
- [CVE-2021-40382](https://cve.now/CVE-2021-40382.md): An issue was discovered on Compro IP70 2.08\_7130218, IP570 2.08\_7130520, IP60, and TN540 devices. (no CVSS)
- [CVE-2021-40378](https://cve.now/CVE-2021-40378.md): An issue was discovered on Compro IP70 2.08\_7130218, IP570 2.08\_7130520, IP60, and TN540 devices. (no CVSS)
- [CVE-2021-29853](https://cve.now/CVE-2021-29853.md): IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some me (CVSS 4.3, IBM Planning Analytics Local)
- [CVE-2021-29852](https://cve.now/CVE-2021-29852.md): IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Planning Analytics Local)
- [CVE-2021-29851](https://cve.now/CVE-2021-29851.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. (CVSS 4.3, IBM Planning Analytics Local)
- [CVE-2021-39817](https://cve.now/CVE-2021-39817.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36079](https://cve.now/CVE-2021-36079.md): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36075](https://cve.now/CVE-2021-36075.md): Adobe Bridge Buffer Overflow leads to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36077](https://cve.now/CVE-2021-36077.md): Adobe Bridge SVG File Memory Corruption Could Lead To Application Denial Of Service (CVSS 5.5, Adobe Bridge)
- [CVE-2021-36073](https://cve.now/CVE-2021-36073.md): Adobe Bridge SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-39847](https://cve.now/CVE-2021-39847.md): XMP Toolkit SDK Stack-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36078](https://cve.now/CVE-2021-36078.md): Adobe Bridge PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-39816](https://cve.now/CVE-2021-39816.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36071](https://cve.now/CVE-2021-36071.md): Adobe Bridge PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-36076](https://cve.now/CVE-2021-36076.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36074](https://cve.now/CVE-2021-36074.md): Adobe Bridge PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-36069](https://cve.now/CVE-2021-36069.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36067](https://cve.now/CVE-2021-36067.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36065](https://cve.now/CVE-2021-36065.md): Adobe Photoshop Heap-Based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-36072](https://cve.now/CVE-2021-36072.md): Adobe Bridge SGI File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36070](https://cve.now/CVE-2021-36070.md): Adobe Media Encoder Improper Memory Access When Parsing SVG Files Could Lead To Remote Code Execution (CVSS 7.8, Adobe Media Encoder)
- [CVE-2021-36063](https://cve.now/CVE-2021-36063.md): Adobe Connect Reflected Cross-site Scripting via 'isTabletDeviceHTML' parameter (CVSS 5.4, Adobe Connect)
- [CVE-2021-36066](https://cve.now/CVE-2021-36066.md): Adobe Photoshop U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-36068](https://cve.now/CVE-2021-36068.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36058](https://cve.now/CVE-2021-36058.md): XMP Toolkit SDK Integer Overflow Vulnerability Could Result In Application Denial Of Service (CVSS 5.5, Adobe XMP Toolkit)
- [CVE-2021-36061](https://cve.now/CVE-2021-36061.md): Adobe Connect Violation of Secure Design Principles Vulnerability Can Lead To Editing Or Deleting Recordings (CVSS 5.4, Adobe Connect)
- [CVE-2021-36064](https://cve.now/CVE-2021-36064.md): XMP Toolkit SDK SVG\_Adapter ParseFullNS Buffer Underflow (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36056](https://cve.now/CVE-2021-36056.md): XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 5.5, Adobe XMP Toolkit)
- [CVE-2021-36062](https://cve.now/CVE-2021-36062.md): Adobe Connect Reflected Cross-site Scripting via 'campaign-id' parameter (CVSS 5.4, Adobe Connect)
- [CVE-2021-36054](https://cve.now/CVE-2021-36054.md): XMP Toolkit SDK Heap-based Buffer Overflow in the PSD\_MetaHandler::CacheFileData Could Lead To Application Denial Of Service (CVSS 3.3, Adobe XMP Toolkit)
- [CVE-2021-36059](https://cve.now/CVE-2021-36059.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36057](https://cve.now/CVE-2021-36057.md): XMP Toolkit SDK Write-What-Where Condition Could Lead To Local Application Denial Of Service (CVSS 4.0, Adobe XMP Toolkit)
- [CVE-2021-36055](https://cve.now/CVE-2021-36055.md): XMP Toolkit SDK Use After Free Vulnerability In ReadingXMPNewDOM Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36052](https://cve.now/CVE-2021-36052.md): XMPToolkit SDK ImportTIFF\_CheckStandardMapping Memory Corruption (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36053](https://cve.now/CVE-2021-36053.md): XMP Toolkit SDK Out-of-bounds Read Vulnerability In FindAndReadXMPChunk Could Lead To Information Exposure (CVSS 3.3, Adobe XMP Toolkit)
- [CVE-2021-36050](https://cve.now/CVE-2021-36050.md): XMP Toolkit SDK Heap-based Buffer Overflow Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36044](https://cve.now/CVE-2021-36044.md): Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service (CVSS 7.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36048](https://cve.now/CVE-2021-36048.md): XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36047](https://cve.now/CVE-2021-36047.md): XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36049](https://cve.now/CVE-2021-36049.md): Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-36045](https://cve.now/CVE-2021-36045.md): XMP Toolkit SDK Out-of-bounds Read Vulnerability In PostScriptSupport::ConvertToDate Could Lead To Information Exposure (CVSS 3.3, Adobe XMP Toolkit)
- [CVE-2021-36027](https://cve.now/CVE-2021-36027.md): Magento Commerce Stored Cross-site Scripting Vulnerability (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36043](https://cve.now/CVE-2021-36043.md): Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution (CVSS 8.0, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36046](https://cve.now/CVE-2021-36046.md): XMP Toolkit SDK TIFF\_MemoryReader::SortIFD function Memory Corruption (CVSS 7.8, Adobe XMP Toolkit)
- [CVE-2021-36042](https://cve.now/CVE-2021-36042.md): Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36030](https://cve.now/CVE-2021-36030.md): Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation (CVSS 7.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36041](https://cve.now/CVE-2021-36041.md): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36040](https://cve.now/CVE-2021-36040.md): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36025](https://cve.now/CVE-2021-36025.md): Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36020](https://cve.now/CVE-2021-36020.md): Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution (CVSS 8.2, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36035](https://cve.now/CVE-2021-36035.md): Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce)
- [CVE-2021-36024](https://cve.now/CVE-2021-36024.md): Magento Commerce Improper Neutralization of Special Elements Used In A Command (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36031](https://cve.now/CVE-2021-36031.md): Magento Commerce Path Traversal In \`theme\[preview\_image\]\` Parameter Could Lead To Remote Code Execution (CVSS 7.2, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-23427](https://cve.now/CVE-2021-23427.md): Arbitrary File Write via Archive Extraction (Zip Slip) (CVSS 8.6, elFinder.NetCore)
- [CVE-2021-23428](https://cve.now/CVE-2021-23428.md): Directory Traversal (CVSS 8.6, elFinder.NetCore)
- [CVE-2021-36039](https://cve.now/CVE-2021-36039.md): Magento Commerce \`quoteId\` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36029](https://cve.now/CVE-2021-36029.md): Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36026](https://cve.now/CVE-2021-36026.md): Magento Commerce Stored Cross-site Scripting Vulnerability (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36032](https://cve.now/CVE-2021-36032.md): Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation (CVSS 8.3, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36038](https://cve.now/CVE-2021-36038.md): Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36002](https://cve.now/CVE-2021-36002.md): Adobe Captivate Installer Creation of Temporary File In Directory With Incorrect Permissions Could Lead To Privilege Escalation (CVSS 5.0, Adobe Captivate)
- [CVE-2021-36028](https://cve.now/CVE-2021-36028.md): Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36034](https://cve.now/CVE-2021-36034.md): Magento Commerce Improper Input Validation Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36022](https://cve.now/CVE-2021-36022.md): Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36033](https://cve.now/CVE-2021-36033.md): Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36037](https://cve.now/CVE-2021-36037.md): Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-36012](https://cve.now/CVE-2021-36012.md): Magento Commerce Gift Card Business Logic Error (CVSS 6.5, Adobe Magento Commerce · magento/project-community-editi… +1)
- [CVE-2021-23426](https://cve.now/CVE-2021-23426.md): Prototype Pollution (CVSS 5.6, Proto)
- [CVE-2021-35218](https://cve.now/CVE-2021-35218.md): Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.9, SolarWinds Patch Manager)
- [CVE-2021-35216](https://cve.now/CVE-2021-35216.md): Deserialization of Untrusted Data in Resource Controls Remote Code Execution (CVSS 8.9, SolarWinds Patch Manager)
- [CVE-2021-40350](https://cve.now/CVE-2021-40350.md): webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing a (no CVSS)
- [CVE-2021-35215](https://cve.now/CVE-2021-35215.md): ActionPluginBaseView Deserialization of Untrusted Data RCE (CVSS 8.9, SolarWinds Orion Platform)
- [CVE-2021-39320](https://cve.now/CVE-2021-39320.md): underConstruction \<= 1.18 - Reflected Cross-Site Scripting (CVSS 6.1, Noah Kagan underConstruction)
- [CVE-2021-39170](https://cve.now/CVE-2021-39170.md): Improper Encoding or Escaping of Output in Asset Metadata Component (CVSS 8.0, pimcore · pimcore/pimcore)
- [CVE-2021-39166](https://cve.now/CVE-2021-39166.md): Improper Neutralization of Text-Values in Object Version Preview (CVSS 8.0, pimcore · pimcore/pimcore)
- [CVE-2021-35508](https://cve.now/CVE-2021-35508.md): NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged u (no CVSS)
- [CVE-2021-39379](https://cve.now/CVE-2021-39379.md): A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. (no CVSS)
- [CVE-2021-37151](https://cve.now/CVE-2021-37151.md): CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is valid. (no CVSS, CyberArk Identity)
- [CVE-2021-39377](https://cve.now/CVE-2021-39377.md): A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. (no CVSS)
- [CVE-2021-39373](https://cve.now/CVE-2021-39373.md): Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. (no CVSS)
- [CVE-2021-39378](https://cve.now/CVE-2021-39378.md): A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. (no CVSS)
- [CVE-2021-40352](https://cve.now/CVE-2021-40352.md): OpenEMR 6.0.0 has a pnotes\_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of a (no CVSS)
- [CVE-2021-38703](https://cve.now/CVE-2021-38703.md): Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the sys (no CVSS)
- [CVE-2021-35238](https://cve.now/CVE-2021-35238.md): Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability (CVSS 4.8, SolarWinds Orion Platform)
- [CVE-2020-9002](https://cve.now/CVE-2020-9002.md): An issue was discovered in iPortalis iCS 7.1.13.0. (CVSS 9.6)
- [CVE-2020-9000](https://cve.now/CVE-2020-9000.md): An issue was discovered in iPortalis iCS 7.1.13.0. (no CVSS)
- [CVE-2021-33582](https://cve.now/CVE-2021-33582.md): Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled duri (no CVSS)
- [CVE-2021-37415](https://cve.now/CVE-2021-37415.md): Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authenticatio (CVSS 9.8, KEV)
- [CVE-2021-39109](https://cve.now/CVE-2021-39109.md): The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path tra (CVSS 7.5, Atlassian Atlasboard · atlasboard)
- [CVE-2021-36235](https://cve.now/CVE-2021-36235.md): An issue was discovered in Ivanti Workspace Control before 10.6.30.0. (no CVSS)
- [CVE-2021-40353](https://cve.now/CVE-2021-40353.md): A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.