# CVEs published 2021-09-10

50 CVEs were published on September 10, 2021: 4 critical, 3 high. Days are UTC.

- [CVE-2021-39207](https://cve.now/CVE-2021-39207.md): Deserialization of Untrusted Data in parlai (CVSS 8.4, facebookresearch ParlAI · parlai)
- [CVE-2021-24040](https://cve.now/CVE-2021-24040.md): Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicio (no CVSS, Facebook ParlAI · parlai)
- [CVE-2021-40347](https://cve.now/CVE-2021-40347.md): An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. (no CVSS, postorius)
- [CVE-2021-3145](https://cve.now/CVE-2021-3145.md): In Ionic Identity Vault before 5, a local root attacker on an Android device can bypass biometric authentication. (no CVSS)
- [CVE-2021-40864](https://cve.now/CVE-2021-40864.md): The Translate plugin 6.1.x through 6.3.x before 6.3.0.72 for ONLYOFFICE Document Server lacks escape calls for the msg.data and text fields. (no CVSS)
- [CVE-2021-3646](https://cve.now/CVE-2021-3646.md): Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver (CVSS 4.9, btcpayserver/btcpayserver)
- [CVE-2021-37422](https://cve.now/CVE-2021-37422.md): Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to SQL Injection while linking the databases. (no CVSS)
- [CVE-2021-37423](https://cve.now/CVE-2021-37423.md): Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. (no CVSS)
- [CVE-2021-37414](https://cve.now/CVE-2021-37414.md): Zoho ManageEngine DesktopCentral before 10.0.709 allows anyone to get a valid user's APIKEY without authentication. (no CVSS)
- [CVE-2021-38360](https://cve.now/CVE-2021-38360.md): wp-publications \<= 0.0 Local File Include (CVSS 8.3, wp-publications)
- [CVE-2021-38357](https://cve.now/CVE-2021-38357.md): SMS OVH \<= 0.1 Reflected Cross-Site Scripting (CVSS 6.1, SMS OVH)
- [CVE-2021-38358](https://cve.now/CVE-2021-38358.md): MoolaMojo \<= 0.7.4.1 Reflected Cross-Site Scripting (CVSS 6.1, MoolaMojo)
- [CVE-2021-38359](https://cve.now/CVE-2021-38359.md): WordPress InviteBox Plugin \<= 1.4.1 Reflected Cross-Site Scripting (CVSS 6.1, WordPress InviteBox Plugin)
- [CVE-2021-38354](https://cve.now/CVE-2021-38354.md): GNU-Mailman Integration \<= 1.0.6 Reflected Cross-Site Scripting (CVSS 6.1, GNU-Mailman Integration)
- [CVE-2021-38327](https://cve.now/CVE-2021-38327.md): YouTube Video Inserter \<= 1.2.1.0 Reflected Cross-Site Scripting (CVSS 6.1, YouTube Video Inserter)
- [CVE-2021-38339](https://cve.now/CVE-2021-38339.md): Simple Matted Thumbnails \<= 1.01 Reflected Cross-Site Scripting (CVSS 6.1, Simple Matted Thumbnails)
- [CVE-2021-38347](https://cve.now/CVE-2021-38347.md): Custom Website Data \<= 2.2 Reflected Cross-Site Scripting (CVSS 6.1, Custom Website Data)
- [CVE-2021-38355](https://cve.now/CVE-2021-38355.md): Bug Library \<= 2.0.3 Reflected Cross-Site Scripting (CVSS 6.1, Bug Library)
- [CVE-2021-38336](https://cve.now/CVE-2021-38336.md): Edit Comments XT \<= 1.0 Reflected Cross-Site Scripting (CVSS 6.1, Edit Comments XT)
- [CVE-2021-40373](https://cve.now/CVE-2021-40373.md): playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the #tabs-information-page of core\_main\_config, and then execut (no CVSS)
- [CVE-2021-38335](https://cve.now/CVE-2021-38335.md): Wise Agent Capture Forms \<= 1.0 Reflected Cross-Site Scripting (CVSS 6.1, Wise Agent Capture Forms)
- [CVE-2021-38329](https://cve.now/CVE-2021-38329.md): DJ EmailPublish \<= 1.7.2 Reflected Cross-Site Scripting (CVSS 6.1, DJ EmailPublish)
- [CVE-2021-38328](https://cve.now/CVE-2021-38328.md): Notices \<= 6.1 Reflected Cross-Site Scripting (CVSS 6.1, Notices)
- [CVE-2021-38338](https://cve.now/CVE-2021-38338.md): Border Loading Bar \<= 1.0.1 Reflected Cross-Site Scripting (CVSS 6.1, Border Loading Bar)
- [CVE-2021-38331](https://cve.now/CVE-2021-38331.md): WP-T-Wap \<= 1.13.2 Reflected Cross-Site Scripting (CVSS 6.1, WP-T-Wap)
- [CVE-2021-38333](https://cve.now/CVE-2021-38333.md): WP Scrippets \<= 1.5.1 Reflected Cross-Site Scripting (CVSS 6.1, WP Scrippets)
- [CVE-2021-38352](https://cve.now/CVE-2021-38352.md): Feedify – Web Push Notifications \<= 2.1.8 Reflected Cross-Site Scripting (CVSS 6.1, Feedify – Web Push Notifications)
- [CVE-2021-38341](https://cve.now/CVE-2021-38341.md): WooCommerce Payment Gateway Per Category \<= 2.0.10 Reflected Cross-Site Scripting (CVSS 6.1, WooCommerce Payment Gateway Per Category)
- [CVE-2021-38340](https://cve.now/CVE-2021-38340.md): Wordpress Simple Shop \<= 1.2 Reflected Cross-Site Scripting (CVSS 6.1, Wordpress Simple Shop)
- [CVE-2021-38349](https://cve.now/CVE-2021-38349.md): Integration of Moneybird for WooCommerce \<= 2.1.1 Reflected Cross-Site Scripting (CVSS 6.1, Integration of Moneybird for WooCommerce)
- [CVE-2021-38353](https://cve.now/CVE-2021-38353.md): Dropdown and scrollable Text \<= 2.0 Reflected Cross-Site Scripting (CVSS 6.1, Dropdown and scrollable Text)
- [CVE-2021-38326](https://cve.now/CVE-2021-38326.md): Post Title Counter \<= 1.1 Reflected Cross-Site Scripting (CVSS 6.1, Post Title Counter)
- [CVE-2021-38348](https://cve.now/CVE-2021-38348.md): Advance Search \<= 1.1.2 Reflected Cross-Site Scripting (CVSS 6.1, Advance Search)
- [CVE-2021-38332](https://cve.now/CVE-2021-38332.md): On Page SEO + Whatsapp Chat Button \<= 1.0.1 Reflected Cross-Site Scripting (CVSS 6.1, On Page SEO + Whatsapp Chat Button)
- [CVE-2021-38337](https://cve.now/CVE-2021-38337.md): RSVPMaker Excel \<= 1.1 Reflected Cross-Site Scripting (CVSS 6.1, RSVPMaker Excel)
- [CVE-2021-38330](https://cve.now/CVE-2021-38330.md): Yet Another bol.com Plugin \<= 1.4 Reflected Cross-Site Scripting (CVSS 6.1, Yet Another bol.com Plugin)
- [CVE-2021-38334](https://cve.now/CVE-2021-38334.md): WP Design Maps & Places \<= 1.2 Reflected Cross-Site Scripting (CVSS 6.1, WP Design Maps & Places)
- [CVE-2021-38350](https://cve.now/CVE-2021-38350.md): spideranalyse \<= 0.0.1 Reflected Cross-Site Scripting (CVSS 6.1, spideranalyse)
- [CVE-2021-38351](https://cve.now/CVE-2021-38351.md): OSD Subscribe \<= 1.2.3 Reflected Cross-Site Scripting (CVSS 6.1, OSD Subscribe)
- [CVE-2021-33011](https://cve.now/CVE-2021-33011.md): All versions of the afffected TOYOPUC-PC10 Series,TOYOPUC-Plus Series,TOYOPUC-PC3J/PC2J Series, TOYOPUC-Nano Series products may not be able (no CVSS, JTEKT Corporation TOYOPUC products)
- [CVE-2021-35976](https://cve.now/CVE-2021-35976.md): The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-previe (no CVSS)
- [CVE-2021-3645](https://cve.now/CVE-2021-3645.md): Prototype Pollution in viking04/merge (CVSS 6.8, viking04/merge · @viking04/merge)
- [CVE-2021-34346](https://cve.now/CVE-2021-34346.md): Stack Based Overflow Vulnerability in NVR Storage Expansion (CVSS 9.8, QNAP Systems NVR Storage Expansion)
- [CVE-2021-34345](https://cve.now/CVE-2021-34345.md): Stack Based Overflow Vulnerability in NVR Storage Expansion (CVSS 9.8, QNAP Systems NVR Storage Expansion)
- [CVE-2021-34344](https://cve.now/CVE-2021-34344.md): Stack Buffer Overflow Vulnerability in QUSBCam2 (CVSS 9.8, QNAP Systems QUSBCam2)
- [CVE-2021-34343](https://cve.now/CVE-2021-34343.md): Buffer Overflow Vulnerability in QTS, QuTS hero, and QuTScloud (CVSS 6.0, QNAP Systems QTS · QNAP Systems QuTScloud +1)
- [CVE-2021-28816](https://cve.now/CVE-2021-28816.md): Stack Buffer Overflow Vulnerabilities in QTS, QuTS hero, and QuTScloud (CVSS 7.6, QNAP Systems QTS · QNAP Systems QuTScloud +1)
- [CVE-2021-28813](https://cve.now/CVE-2021-28813.md): Insufficiently Protected Credentials Vulnerability in QSW-M2116P-2T2S and QuNetSwitch (CVSS 9.6, QNAP Systems QSW-M2116P-2T2S · QNAP Systems QuNetSwitch)
- [CVE-2018-19957](https://cve.now/CVE-2018-19957.md): Insufficient HTTP Security Headers in QTS, QuTS hero, and QuTScloud (no CVSS, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2021-40839](https://cve.now/CVE-2021-40839.md): The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\\x2f\\x7f), enabling a remote attack (no CVSS, rencode)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.