# CVEs published 2021-09-14

100 CVEs were published on September 14, 2021: 7 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-23029](https://cve.now/CVE-2021-23029.md): On version 16.0.x before 16.0.1.2, insufficient permission checks may allow authenticated users with guest privileges to perform Server-Side (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23026](https://cve.now/CVE-2021-23026.md): BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and (no CVSS, BIG-IP & BIG-IQ)
- [CVE-2021-23027](https://cve.now/CVE-2021-23027.md): On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM based cross-site scripting (XSS) vulnerability (no CVSS, BIG-IP)
- [CVE-2021-23025](https://cve.now/CVE-2021-23025.md): On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all versions of 12.1.x and 11.6.x, an authenticated r (no CVSS, BIG-IP)
- [CVE-2021-23028](https://cve.now/CVE-2021-23028.md): On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, and 13.1.x before 13.1.4, when JSON content profiles are (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23030](https://cve.now/CVE-2021-23030.md): On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1 (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23031](https://cve.now/CVE-2021-23031.md): On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.1, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and 11.6.x befo (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23036](https://cve.now/CVE-2021-23036.md): On version 16.0.x before 16.0.1.2, when a BIG-IP ASM and DataSafe profile are configured on a virtual server, undisclosed requests can cause (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23034](https://cve.now/CVE-2021-23034.md): On BIG-IP version 16.x before 16.1.0 and 15.1.x before 15.1.3.1, when a DNS profile using a DNS cache resolver is configured on a virtual se (no CVSS, BIG-IP)
- [CVE-2021-23037](https://cve.now/CVE-2021-23037.md): On all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a reflected cross-site scripting (XSS) vulnerability exists i (no CVSS, BIG-IP)
- [CVE-2021-23032](https://cve.now/CVE-2021-23032.md): On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x and 12.1.x, when a BIG-IP DNS syst (no CVSS, BIG-IP DNS)
- [CVE-2021-39391](https://cve.now/CVE-2021-39391.md): Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated b (no CVSS, github.com/beego/beego/v2)
- [CVE-2021-23038](https://cve.now/CVE-2021-23038.md): On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a sto (no CVSS, BIG-IP)
- [CVE-2021-23035](https://cve.now/CVE-2021-23035.md): On BIG-IP 14.1.x before 14.1.4.4, when an HTTP profile is configured on a virtual server, after a specific sequence of packets, chunked resp (no CVSS, BIG-IP)
- [CVE-2021-35493](https://cve.now/CVE-2021-35493.md): TIBCO WebFOCUS Cross Site Scripting vulnerabilities (CVSS 9.0, TIBCO Software TIBCO WebFOCUS Client · TIBCO Software TI… +1)
- [CVE-2021-23033](https://cve.now/CVE-2021-23033.md): On BIG-IP Advanced WAF and BIG-IP ASM version 16.x before 16.1.0x, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, a (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23039](https://cve.now/CVE-2021-23039.md): On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.2.8, and all versions of 13.1.x and 12.1.x, when IPSec is config (no CVSS, BIG-IP)
- [CVE-2021-23045](https://cve.now/CVE-2021-23045.md): On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x (no CVSS, BIG-IP)
- [CVE-2020-21082](https://cve.now/CVE-2020-21082.md): A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal (no CVSS)
- [CVE-2020-21081](https://cve.now/CVE-2020-21081.md): A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a (no CVSS)
- [CVE-2021-23044](https://cve.now/CVE-2021-23044.md): On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x and (no CVSS, BIG-IP)
- [CVE-2020-21050](https://cve.now/CVE-2020-21050.md): Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif\_process\_raster at fromgif.c. (no CVSS)
- [CVE-2020-21049](https://cve.now/CVE-2020-21049.md): An invalid read in the stb\_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted P (no CVSS)
- [CVE-2020-21048](https://cve.now/CVE-2020-21048.md): An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file. (no CVSS)
- [CVE-2021-41077](https://cve.now/CVE-2021-41077.md): The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is (no CVSS)
- [CVE-2021-23042](https://cve.now/CVE-2021-23042.md): On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, and 12.1.x before 12.1.6, when a (no CVSS, BIG-IP)
- [CVE-2021-23040](https://cve.now/CVE-2021-23040.md): On BIG-IP AFM version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1 (no CVSS, BIG-IP AFM)
- [CVE-2021-23043](https://cve.now/CVE-2021-23043.md): On BIG-IP, on all versions of 16.1.x, 16.0.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x, a directory traversal vulnerability exists in an u (no CVSS, BIG-IP)
- [CVE-2021-23046](https://cve.now/CVE-2021-23046.md): On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Acce (no CVSS, BIG-IP Guided Configuration)
- [CVE-2021-23041](https://cve.now/CVE-2021-23041.md): On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, (no CVSS, BIG-IP)
- [CVE-2021-23047](https://cve.now/CVE-2021-23047.md): On version 16.x before 16.1.0, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, and all versions of 13.1.x, 12.1.x and 11.6.x, when BIG-IP AP (no CVSS, BIG-IP APM)
- [CVE-2021-29841](https://cve.now/CVE-2021-29841.md): IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Financial Transaction Manager)
- [CVE-2021-20582](https://cve.now/CVE-2021-20582.md): IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. (CVSS 3.7, IBM Security Secret Server)
- [CVE-2021-20569](https://cve.now/CVE-2021-20569.md): IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. (CVSS 5.3, IBM Security Secret Server)
- [CVE-2021-20508](https://cve.now/CVE-2021-20508.md): IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message (CVSS 2.7, IBM Security Secret Server)
- [CVE-2021-23049](https://cve.now/CVE-2021-23049.md): On BIG-IP version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3, when the iRules RESOLVER::summarize command is used on a virtual server, (no CVSS, BIG-IP)
- [CVE-2021-23048](https://cve.now/CVE-2021-23048.md): On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, 14.1.x before 14.1.4.3, 13.1.x before 13.1.4.1, and all versions of 12.1.x (no CVSS, BIG-IP)
- [CVE-2021-23050](https://cve.now/CVE-2021-23050.md): On BIG-IP Advanced WAF and BIG-IP ASM version 16.0.x before 16.0.1.2 and 15.1.x before 15.1.3 and NGINX App Protect on all versions before 3 (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM; NGINX App Protect)
- [CVE-2021-23053](https://cve.now/CVE-2021-23053.md): On version 15.1.x before 15.1.3, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6, when the brute force protection feature of BIG-IP Advan (no CVSS, BIG-IP Advanced WAF and BIG-IP ASM)
- [CVE-2021-23052](https://cve.now/CVE-2021-23052.md): On version 14.1.x before 14.1.4.4 and all versions of 13.1.x, an open redirect vulnerability exists on virtual servers enabled with a BIG-IP (no CVSS, BIG-IP APM)
- [CVE-2021-23051](https://cve.now/CVE-2021-23051.md): On BIG-IP versions 15.1.0.4 through 15.1.3, when the Data Plane Development Kit (DPDK)/Elastic Network Adapter (ENA) driver is used with BIG (no CVSS, BIG-IP)
- [CVE-2021-36581](https://cve.now/CVE-2021-36581.md): Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. (no CVSS)
- [CVE-2021-36582](https://cve.now/CVE-2021-36582.md): In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell f (no CVSS)
- [CVE-2021-32202](https://cve.now/CVE-2021-32202.md): In CS-Cart version 4.11.1, it is possible to induce copy-paste XSS by manipulating the "post description" filed in the blog post creation pa (no CVSS)
- [CVE-2021-38174](https://cve.now/CVE-2021-38174.md): When a user opens manipulated files received from untrusted sources in SAP 3D Visual Enterprise Viewer version - 9, the application crashes (CVSS 4.3, SAP SE SAP 3D Visual Enterprise Viewer)
- [CVE-2021-33688](https://cve.now/CVE-2021-33688.md): SAP Business One allows an attacker with business privileges to execute crafted database queries, exposing the back-end database. (no CVSS, SAP SE SAP Business One)
- [CVE-2021-33686](https://cve.now/CVE-2021-33686.md): Under certain conditions, SAP Business One version - 10.0, allows an unauthorized attacker to get access to some encrypted sensitive informa (CVSS 5.3, SAP SE SAP Business One)
- [CVE-2021-33674](https://cve.now/CVE-2021-33674.md): Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. (CVSS 6.5, SAP SE SAP Contact Center)
- [CVE-2021-38177](https://cve.now/CVE-2021-38177.md): SAP CommonCryptoLib version 8.5.38 or lower is vulnerable to null pointer dereference vulnerability when an unauthenticated attacker sends c (CVSS 7.5, SAP SE SAP CommonCryptoLib)
- [CVE-2021-33685](https://cve.now/CVE-2021-33685.md): SAP Business One version - 10.0 allows low-level authorized attacker to traverse the file system to access files or directories that are out (CVSS 6.5, SAP SE SAP Business One)
- [CVE-2021-33672](https://cve.now/CVE-2021-33672.md): Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in cha (CVSS 9.6, SAP SE SAP Contact Center)
- [CVE-2021-38175](https://cve.now/CVE-2021-38175.md): SAP Analysis for Microsoft Office - version 2.8, allows an attacker with high privileges to read sensitive data over the network, and gather (CVSS 6.5, SAP SE SAP Analysis for Microsoft Office)
- [CVE-2021-38163](https://cve.now/CVE-2021-38163.md): SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administra (CVSS 9.9, KEV, SAP SE SAP NetWeaver)
- [CVE-2021-37535](https://cve.now/CVE-2021-37535.md): SAP NetWeaver Application Server Java (JMS Connector Service) - versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform necessary auth (CVSS 10.0, SAP SE SAP NetWeaver Application Server Java)
- [CVE-2021-33675](https://cve.now/CVE-2021-33675.md): Under certain conditions, SAP Contact Center - version 700, does not sufficiently encode user-controlled inputs. (CVSS 6.1, SAP SE SAP Contact Center)
- [CVE-2021-33679](https://cve.now/CVE-2021-33679.md): The SAP BusinessObjects BI Platform version - 420 allows an attacker, who has basic access to the application, to inject a malicious script (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2021-38176](https://cve.now/CVE-2021-38176.md): Due to improper input sanitization, an authenticated user with certain specific privileges can remotely call NZDT function modules listed in (CVSS 9.9, SAP SE SAP S/4HANA · SAP SE SAP LT Replication Server +3)
- [CVE-2021-38164](https://cve.now/CVE-2021-38164.md): SAP ERP Financial Accounting (RFOPENPOSTING\_FR) versions - SAP\_APPL - 600, 602, 603, 604, 605, 606, 616, SAP\_FIN - 617, 618, 700, 720, 730, (CVSS 5.4, SAP SE SAP ERP Financial Accounting)
- [CVE-2021-33673](https://cve.now/CVE-2021-33673.md): Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. (CVSS 8.3, SAP SE SAP Contact Center)
- [CVE-2021-38162](https://cve.now/CVE-2021-38162.md): SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7 (CVSS 8.9, SAP SE SAP Web Dispatcher)
- [CVE-2021-37532](https://cve.now/CVE-2021-37532.md): SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conte (CVSS 4.3, SAP SE SAP Business One)
- [CVE-2021-21489](https://cve.now/CVE-2021-21489.md): SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulti (CVSS 4.8, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2021-37531](https://cve.now/CVE-2021-37531.md): SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a no (CVSS 9.9, SAP SE SAP NetWeaver Knowledge Management XML Forms)
- [CVE-2021-38150](https://cve.now/CVE-2021-38150.md): When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP (CVSS 6.1, SAP SE SAP Business Client)
- [CVE-2021-40357](https://cve.now/CVE-2021-40357.md): A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions \< V4.3.10), Teamcenter Active Workspace V5.0 (All vers (no CVSS, Siemens Teamcenter Active Workspace)
- [CVE-2021-40356](https://cve.now/CVE-2021-40356.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.8), Teamcenter V13.0 (All versions \< V13.0.0.7), Teamcenter (no CVSS, Siemens Teamcenter)
- [CVE-2021-40355](https://cve.now/CVE-2021-40355.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.8), Teamcenter V13.0 (All versions \< V13.0.0.7), Teamcenter (no CVSS, Siemens Teamcenter)
- [CVE-2021-40354](https://cve.now/CVE-2021-40354.md): A vulnerability has been identified in Teamcenter V12.4 (All versions \< V12.4.0.8), Teamcenter V13.0 (All versions \< V13.0.0.7), Teamcenter (no CVSS, Siemens Teamcenter)
- [CVE-2021-37206](https://cve.now/CVE-2021-37206.md): A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions \< V8.80), SIPROTEC 5 relays with CPU variants (no CVSS, Siemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1)
- [CVE-2021-37203](https://cve.now/CVE-2021-37203.md): A vulnerability has been identified in NX 1980 Series (All versions \< V1984), Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens NX 1980 Series · Siemens Solid Edge SE2021)
- [CVE-2021-37202](https://cve.now/CVE-2021-37202.md): A vulnerability has been identified in NX 1980 Series (All versions \< V1984), Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens NX 1980 Series · Siemens Solid Edge SE2021)
- [CVE-2021-37201](https://cve.now/CVE-2021-37201.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-37200](https://cve.now/CVE-2021-37200.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-37193](https://cve.now/CVE-2021-37193.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37192](https://cve.now/CVE-2021-37192.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37190](https://cve.now/CVE-2021-37190.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37191](https://cve.now/CVE-2021-37191.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 4.3, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37186](https://cve.now/CVE-2021-37186.md): A vulnerability has been identified in LOGO! CMR2020 (All versions \< V2.2), LOGO! CMR2040 (All versions \< V2.2), SIMATIC RTU3010C (All versi (no CVSS, Siemens LOGO! CMR2020 · Siemens LOGO! CMR2040 +4)
- [CVE-2021-37184](https://cve.now/CVE-2021-37184.md): A vulnerability has been identified in Industrial Edge Management (All versions \< V1.3). (no CVSS, Siemens Industrial Edge Management)
- [CVE-2021-37183](https://cve.now/CVE-2021-37183.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37181](https://cve.now/CVE-2021-37181.md): A vulnerability has been identified in Cerberus DMS V4.0 (All versions), Cerberus DMS V4.1 (All versions), Cerberus DMS V4.2 (All versions), (no CVSS, Siemens Cerberus DMS · Siemens Desigo CC Compact +1)
- [CVE-2021-37177](https://cve.now/CVE-2021-37177.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.0 SP2). (CVSS 6.5, Siemens SINEMA Remote Connect Server)
- [CVE-2021-37176](https://cve.now/CVE-2021-37176.md): A vulnerability has been identified in Simcenter Femap V2020.2 (All versions), Simcenter Femap V2021.1 (All versions). (no CVSS, Siemens Simcenter Femap)
- [CVE-2021-37175](https://cve.now/CVE-2021-37175.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.14.1), RUGGEDCOM ROX RX1400 (All versions \< V2.14.1), RUGGEDC (no CVSS, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8)
- [CVE-2021-37174](https://cve.now/CVE-2021-37174.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.14.1), RUGGEDCOM ROX RX1400 (All versions \< V2.14.1), RUGGEDC (no CVSS, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8)
- [CVE-2021-37173](https://cve.now/CVE-2021-37173.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.14.1), RUGGEDCOM ROX RX1400 (All versions \< V2.14.1), RUGGEDC (no CVSS, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8)
- [CVE-2021-33737](https://cve.now/CVE-2021-33737.md): A vulnerability has been identified in SIMATIC CP 343-1 (incl. (CVSS 7.5, Siemens SIMATIC CP 343-1 · Siemens SIMATIC CP 443-1 +1)
- [CVE-2021-33720](https://cve.now/CVE-2021-33720.md): A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions \< V8.80), SIPROTEC 5 relays with CPU variants (no CVSS, Siemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1)
- [CVE-2021-33719](https://cve.now/CVE-2021-33719.md): A vulnerability has been identified in SIPROTEC 5 relays with CPU variants CP050 (All versions \< V8.80), SIPROTEC 5 relays with CPU variants (no CVSS, Siemens SIPROTEC 5 relays with CPU variants CP050 · Siem… +1)
- [CVE-2021-33716](https://cve.now/CVE-2021-33716.md): A vulnerability has been identified in SIMATIC CP 1543-1 (incl. (no CVSS, Siemens SIMATIC CP 1543-1 · Siemens SIMATIC CP 1545-1)
- [CVE-2021-27391](https://cve.now/CVE-2021-27391.md): A vulnerability has been identified in APOGEE MBC (PPC) (P2 Ethernet) (All versions \>= V2.6.3), APOGEE MEC (PPC) (P2 Ethernet) (All versions (CVSS 9.8, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +4)
- [CVE-2021-31891](https://cve.now/CVE-2021-31891.md): A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module), GMA-Manager (All versions with OIS running on Deb (no CVSS, Siemens Desigo CC · Siemens GMA-Manager +2)
- [CVE-2021-25665](https://cve.now/CVE-2021-25665.md): A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions \< V2021.2.1). (no CVSS, Siemens Simcenter STAR-CCM+ Viewer)
- [CVE-2019-10941](https://cve.now/CVE-2019-10941.md): A vulnerability has been identified in SINEMA Server (All versions \< V14 SP3). (no CVSS, Siemens SINEMA Server)
- [CVE-2021-39125](https://cve.now/CVE-2021-39125.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to discover the usernames of users via an enumer (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2019-20101](https://cve.now/CVE-2019-20101.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view whitelist rules via a Broken Access Cont (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-39118](https://cve.now/CVE-2021-39118.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to discover the usernames and full names of users via an e (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-39123](https://cve.now/CVE-2021-39123.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to impact the application's availability v (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-39124](https://cve.now/CVE-2021-39124.md): The Cross-Site Request Forgery (CSRF) failure retry feature of Atlassian Jira Server and Data Center before version 8.16.0 allows remote att (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41072](https://cve.now/CVE-2021-41072.md): squashfs\_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.