# CVEs published 2021-09-02

53 CVEs were published on September 2, 2021: 2 critical, 13 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-38642](https://cve.now/CVE-2021-38642.md): Microsoft Edge for iOS Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2021-38641](https://cve.now/CVE-2021-38641.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2021-36930](https://cve.now/CVE-2021-36930.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 5.3, Microsoft Edge)
- [CVE-2021-26439](https://cve.now/CVE-2021-26439.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 4.6, Microsoft Edge for Android)
- [CVE-2021-26436](https://cve.now/CVE-2021-26436.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2021-34436](https://cve.now/CVE-2021-34436.md): In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-ext (no CVSS, The Eclipse Foundation Eclipse Theia)
- [CVE-2020-18048](https://cve.now/CVE-2020-18048.md): An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name fiel (no CVSS)
- [CVE-2021-36017](https://cve.now/CVE-2021-36017.md): Adobe After Effects PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2021-35996](https://cve.now/CVE-2021-35996.md): Adobe After Effects Memory Corruption Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-35994](https://cve.now/CVE-2021-35994.md): Adobe After Effects JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2021-35995](https://cve.now/CVE-2021-35995.md): Adobe After Effects MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-35993](https://cve.now/CVE-2021-35993.md): Adobe After Effects PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2021-36019](https://cve.now/CVE-2021-36019.md): Adobe After Effects PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-36018](https://cve.now/CVE-2021-36018.md): Adobe After Effects PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-22525](https://cve.now/CVE-2021-22525.md): This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1 (no CVSS, NetIQ Access Manager versions prior to)
- [CVE-2021-38314](https://cve.now/CVE-2021-38314.md): Gutenberg Template Library & Redux Framework \<= 4.2.11 Sensitive Information Disclosure (CVSS 5.3, Redux.io Gutenberg Template Library & Redux Framework)
- [CVE-2021-38312](https://cve.now/CVE-2021-38312.md): Gutenberg Template Library & Redux Framework \<= 4.2.11 Incorrect Authorization check to Arbitrary plugin installation and post deletion (CVSS 7.1, Redux.io Gutenberg Template Library & Redux Framework)
- [CVE-2021-22704](https://cve.now/CVE-2021-22704.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Desig (no CVSS, Harmony/HMI Products Configured by Vijeo Designer (all vers…)
- [CVE-2021-22793](https://cve.now/CVE-2021-22793.md): A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exist in AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) (no CVSS, AccuSine PCS+ / PFV+ (Versions prior to V1.6.7) and AccuSin…)
- [CVE-2021-22792](https://cve.now/CVE-2021-22792.md): A CWE-476: NULL Pointer Dereference vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updati (CVSS 6.5, Modicon M580 CPU (part numbers BMEP\* and BMEH\*, all version…)
- [CVE-2021-22791](https://cve.now/CVE-2021-22791.md): A CWE-787: Out-of-bounds Write vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating th (CVSS 6.5, Modicon M580 CPU (part numbers BMEP\* and BMEH\*, all version…)
- [CVE-2021-22790](https://cve.now/CVE-2021-22790.md): A CWE-125: Out-of-bounds Read vulnerability that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the (CVSS 6.5, Modicon M580 CPU (part numbers BMEP\* and BMEH\*, all version…)
- [CVE-2021-22789](https://cve.now/CVE-2021-22789.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability that could cause a Denial of Service on the (CVSS 6.5, Modicon M580 CPU (part numbers BMEP\* and BMEH\*, all version…)
- [CVE-2021-22775](https://cve.now/CVE-2021-22775.md): A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution wit (no CVSS, GP-Pro EX V4.09.250 and prior)
- [CVE-2021-39322](https://cve.now/CVE-2021-39322.md): Easy Social Icons \<= 3.0.8 - Reflected Cross-Site Scripting (CVSS 6.1, cybernetikz Easy Social Icons)
- [CVE-2021-28564](https://cve.now/CVE-2021-28564.md): Adobe Acrobat Reader out-of-bounds write vulnerability could lead to arbitrary code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-28561](https://cve.now/CVE-2021-28561.md): Adobe Acrobat Reader memory corruption vulnerability could lead to remote code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-28559](https://cve.now/CVE-2021-28559.md): Adobe Acrobat Reader privacy violation vulnerability could lead to privilege escalation (CVSS 5.3, Adobe Acrobat Reader)
- [CVE-2021-28565](https://cve.now/CVE-2021-28565.md): Adobe Acrobat Reader out-of-bounds read could lead to information exposure (CVSS 4.3, Adobe Acrobat Reader)
- [CVE-2021-28560](https://cve.now/CVE-2021-28560.md): Adobe Acrobat Reader heap corruption vulnerability could lead to arbitrary code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-28557](https://cve.now/CVE-2021-28557.md): Adobe Acrobat Reader out-of-bounds read in PDFLibTool could lead to information exposure (CVSS 4.3, Adobe Acrobat Reader)
- [CVE-2021-28553](https://cve.now/CVE-2021-28553.md): Adobe Acrobat Reader use-after-free vulnerability could lead to arbitrary code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-28550](https://cve.now/CVE-2021-28550.md): Adobe Acrobat Reader use after free vulnerability could lead to arbitrary code execution (CVSS 9.6, KEV, Adobe Acrobat Reader)
- [CVE-2021-28555](https://cve.now/CVE-2021-28555.md): Adobe Acrobat Reader out-of-bounds Read could lead to information disclosure (CVSS 6.5, Adobe Acrobat Reader)
- [CVE-2021-28558](https://cve.now/CVE-2021-28558.md): Adobe Acrobat Reader heap-based buffer overflow could lead to arbitrary code execution (CVSS 8.8, Adobe Acrobat Reader)
- [CVE-2021-21086](https://cve.now/CVE-2021-21086.md): Adobe Reader CoolType Arbitrary Stack Manipulation (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39187](https://cve.now/CVE-2021-39187.md): Crash server with query parameter (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2021-33938](https://cve.now/CVE-2021-33938.md): Buffer overflow vulnerability in function prune\_to\_recommended in src/policy.c in libsolv before 0.7.17 allows attackers to cause a Denial o (no CVSS)
- [CVE-2021-33930](https://cve.now/CVE-2021-33930.md): Buffer overflow vulnerability in function pool\_installable\_whatprovides in src/repo.h in libsolv before 0.7.17 allows attackers to cause a D (no CVSS)
- [CVE-2021-33929](https://cve.now/CVE-2021-33929.md): Buffer overflow vulnerability in function pool\_disabled\_solvable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial o (no CVSS)
- [CVE-2021-33928](https://cve.now/CVE-2021-33928.md): Buffer overflow vulnerability in function pool\_installable in src/repo.h in libsolv before 0.7.17 allows attackers to cause a Denial of Serv (no CVSS)
- [CVE-2021-3758](https://cve.now/CVE-2021-3758.md): Server-Side Request Forgery (SSRF) in bookstackapp/bookstack (CVSS 6.3, bookstackapp/bookstack)
- [CVE-2021-3757](https://cve.now/CVE-2021-3757.md): Prototype Pollution in immerjs/immer (CVSS 7.5, immerjs/immer · immer)
- [CVE-2021-34765](https://cve.now/CVE-2021-34765.md): Cisco Nexus Insights Authenticated Information Disclosure Vulnerability (CVSS 4.3, Cisco Nexus Insights)
- [CVE-2021-34759](https://cve.now/CVE-2021-34759.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2021-34746](https://cve.now/CVE-2021-34746.md): Cisco Enterprise NFV Infrastructure Software Authentication Bypass Vulnerability (CVSS 9.8, Cisco Enterprise NFV Infrastructure Software)
- [CVE-2021-34733](https://cve.now/CVE-2021-34733.md): Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability (CVSS 5.5, Cisco Prime Infrastructure)
- [CVE-2021-34732](https://cve.now/CVE-2021-34732.md): Cisco Prime Collaboration Provisioning Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Prime Collaboration Provisioning)
- [CVE-2021-31796](https://cve.now/CVE-2021-31796.md): An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Disclosure. (no CVSS)
- [CVE-2021-31798](https://cve.now/CVE-2021-31798.md): The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and under certain condition (no CVSS)
- [CVE-2019-10095](https://cve.now/CVE-2019-10095.md): bash command injection in spark interpreter (no CVSS, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2020-13929](https://cve.now/CVE-2020-13929.md): Notebook permissions bypass (no CVSS, Apache Software Foundation Apache Zeppelin · org.apache.zep…)
- [CVE-2021-27578](https://cve.now/CVE-2021-27578.md): Cross Site Scripting in markdown interpreter (no CVSS, Apache Software Foundation Apache Zeppelin · org.apache.zep…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.