# CVEs published 2021-09-15

153 CVEs were published on September 15, 2021: 10 critical, 59 high. 9 are now in CISA KEV. Days are UTC.

- [CVE-2021-33045](https://cve.now/CVE-2021-33045.md): The identity authentication bypass vulnerability found in some Dahua products during the login process. (CVSS 9.8, KEV, Some Dahua IP Camera, Video Intercom, NVR, XVR devices)
- [CVE-2020-21483](https://cve.now/CVE-2020-21483.md): An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg file which is later ch (no CVSS)
- [CVE-2020-21482](https://cve.now/CVE-2020-21482.md): A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a crafted payload in the (no CVSS)
- [CVE-2020-21481](https://cve.now/CVE-2020-21481.md): An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file which is later chan (no CVSS)
- [CVE-2020-21480](https://cve.now/CVE-2020-21480.md): An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS)
- [CVE-2021-33044](https://cve.now/CVE-2021-33044.md): The identity authentication bypass vulnerability found in some Dahua products during the login process. (CVSS 9.8, KEV, Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Ther…)
- [CVE-2021-40881](https://cve.now/CVE-2021-40881.md): An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2021-40639](https://cve.now/CVE-2021-40639.md): Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.properties&config=filemana (no CVSS)
- [CVE-2020-21322](https://cve.now/CVE-2020-21322.md): An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a crafted PHP file. (no CVSS, feehi/cms)
- [CVE-2020-21321](https://cve.now/CVE-2020-21321.md): emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to arbitrarily add articl (no CVSS)
- [CVE-2016-20012](https://cve.now/CVE-2016-20012.md): OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH s (CVSS 5.3)
- [CVE-2021-37913](https://cve.now/CVE-2021-37913.md): HGiga OAKlouds - Command Injection-2 (CVSS 9.8, HGiga OAKlouds OAKSv2 · HGiga OAKlouds OAKSv3)
- [CVE-2021-37912](https://cve.now/CVE-2021-37912.md): HGiga OAKlouds - Command Injection-1 (CVSS 9.8, HGiga OAKlouds OAKSv2 · HGiga OAKlouds OAKSv3)
- [CVE-2021-37909](https://cve.now/CVE-2021-37909.md): CHANGING Inc. TSSServiSignAdapter Windows Versions - Improper Input Validation (CVSS 9.8, CHANGING TSSServiSignAdapter)
- [CVE-2021-40862](https://cve.now/CVE-2021-40862.md): HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to authenticated parties (no CVSS)
- [CVE-2021-33704](https://cve.now/CVE-2021-33704.md): The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that would otherwise be (CVSS 6.3, SAP SE SAP Business One)
- [CVE-2021-33701](https://cve.now/CVE-2021-33701.md): DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011\_1\_620, 2011\_1\_640, 2011\_1\_700, 2011\_1\_710, 2011\_1\_730, 710, 2011\_1\_731, 710, 2011\_1 (CVSS 9.1, SAP SE DMIS Mobile Plug-In · SAP SE SAP S/4HANA)
- [CVE-2021-33698](https://cve.now/CVE-2021-33698.md): SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script files) without the pr (CVSS 9.9, SAP SE SAP Business One)
- [CVE-2021-33705](https://cve.now/CVE-2021-33705.md): The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forger (CVSS 8.1, SAP SE SAP NetWeaver Enterprise Portal)
- [CVE-2021-33700](https://cve.now/CVE-2021-33700.md): SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstances, to login as the v (CVSS 7.0, SAP SE SAP Business One)
- [CVE-2021-33694](https://cve.now/CVE-2021-33694.md): SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to (CVSS 5.9, SAP SE SAP Cloud Connector)
- [CVE-2021-33691](https://cve.now/CVE-2021-33691.md): NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scriptin (CVSS 6.9, SAP SE SAP NetWeaver Development Infrastructure)
- [CVE-2021-33693](https://cve.now/CVE-2021-33693.md): SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that coul (CVSS 5.7, SAP SE SAP Cloud Connector)
- [CVE-2021-33697](https://cve.now/CVE-2021-33697.md): Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an unauthenticated att (CVSS 4.7, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2021-33695](https://cve.now/CVE-2021-33695.md): Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate. (CVSS 6.8, SAP SE SAP Cloud Connector)
- [CVE-2021-33692](https://cve.now/CVE-2021-33692.md): SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. (CVSS 5.2, SAP SE SAP Cloud Connector)
- [CVE-2021-33696](https://cve.now/CVE-2021-33696.md): SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode user controlled input (CVSS 5.4, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2021-33690](https://cve.now/CVE-2021-33690.md): Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service v (CVSS 9.9, SAP SE SAP NetWeaver Development Infrastructure)
- [CVE-2021-29773](https://cve.now/CVE-2021-29773.md): IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modify user details cause (CVSS 5.4, IBM Security Guardium)
- [CVE-2021-29750](https://cve.now/CVE-2021-29750.md): IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2021-20433](https://cve.now/CVE-2021-20433.md): IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in further attacks against (CVSS 6.5, IBM Security Guardium)
- [CVE-2021-28901](https://cve.now/CVE-2021-28901.md): Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to in (no CVSS)
- [CVE-2021-39215](https://cve.now/CVE-2021-39215.md): Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms (CVSS 7.5, jitsi-meet)
- [CVE-2021-39205](https://cve.now/CVE-2021-39205.md): DOM-based XSS/Content Spoofing via Prototype Pollution (CVSS 6.8, jitsi-meet)
- [CVE-2021-40964](https://cve.now/CVE-2021-40964.md): A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with (no CVSS)
- [CVE-2021-40965](https://cve.now/CVE-2021-40965.md): A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to u (no CVSS)
- [CVE-2021-40966](https://cve.now/CVE-2021-40966.md): A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that co (no CVSS)
- [CVE-2021-39213](https://cve.now/CVE-2021-39213.md): IP restriction on GLPI API Bypass with custom header injection (CVSS 6.8, glpi-project glpi)
- [CVE-2021-39211](https://cve.now/CVE-2021-39211.md): Disclosure of GLPI and server information in telemetry endpoint (CVSS 5.3, glpi-project glpi)
- [CVE-2021-39210](https://cve.now/CVE-2021-39210.md): Autologin cookie accessible by scripts (CVSS 6.5, glpi-project glpi)
- [CVE-2021-40156](https://cve.now/CVE-2021-40156.md): A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated boundaries when parsing (no CVSS, Autodesk Navisworks)
- [CVE-2021-40155](https://cve.now/CVE-2021-40155.md): A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing (no CVSS, Autodesk Navisworks)
- [CVE-2021-27046](https://cve.now/CVE-2021-27046.md): A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution through maliciously (no CVSS, Autodesk Navisworks)
- [CVE-2021-27045](https://cve.now/CVE-2021-27045.md): A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boundaries when parsing (no CVSS, Autodesk Navisworks)
- [CVE-2021-37412](https://cve.now/CVE-2021-37412.md): The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar. (no CVSS)
- [CVE-2021-3795](https://cve.now/CVE-2021-3795.md): Inefficient Regular Expression Complexity in sindresorhus/semver-regex (CVSS 7.5, sindresorhus/semver-regex · semver-regex)
- [CVE-2021-40238](https://cve.now/CVE-2021-40238.md): A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo \< 2.9.0 via an HTTP request to a non-existent page, which is (no CVSS)
- [CVE-2020-21127](https://cve.now/CVE-2020-21127.md): MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel. (no CVSS)
- [CVE-2020-21126](https://cve.now/CVE-2020-21126.md): MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo. (no CVSS)
- [CVE-2020-21124](https://cve.now/CVE-2020-21124.md): UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page. (no CVSS)
- [CVE-2020-21125](https://cve.now/CVE-2020-21125.md): An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code. (no CVSS, com.bstek.ureport:ureport2-core)
- [CVE-2020-21122](https://cve.now/CVE-2020-21122.md): UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports. (no CVSS, com.bstek.ureport:ureport2-console)
- [CVE-2020-21121](https://cve.now/CVE-2020-21121.md): Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin\_update\_module\_widgets.php fi (no CVSS)
- [CVE-2021-39392](https://cve.now/CVE-2021-39392.md): The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardco (no CVSS)
- [CVE-2021-39209](https://cve.now/CVE-2021-39209.md): Bypassable CSRF protection (CVSS 8.8, glpi-project glpi)
- [CVE-2021-40157](https://cve.now/CVE-2021-40157.md): A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability in FBX’s Review ver (no CVSS, Autodesk FBX Review)
- [CVE-2021-27044](https://cve.now/CVE-2021-27044.md): A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through maliciously crafted (no CVSS, Autodesk FBX Review)
- [CVE-2020-19159](https://cve.now/CVE-2020-19159.md): Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=memb (no CVSS)
- [CVE-2020-19158](https://cve.now/CVE-2020-19158.md): Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parame (no CVSS)
- [CVE-2020-19157](https://cve.now/CVE-2020-19157.md): Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component ' (no CVSS)
- [CVE-2020-19156](https://cve.now/CVE-2020-19156.md): Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Con (no CVSS)
- [CVE-2020-19155](https://cve.now/CVE-2020-19155.md): Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or execute arbitrary co (no CVSS)
- [CVE-2020-19151](https://cve.now/CVE-2020-19151.md): Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template (no CVSS)
- [CVE-2020-19154](https://cve.now/CVE-2020-19154.md): Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFi (no CVSS)
- [CVE-2020-19148](https://cve.now/CVE-2020-19148.md): Cross Site Scripting (XSS) in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code via the 'Nickname' parameter i (no CVSS)
- [CVE-2020-19150](https://cve.now/CVE-2020-19150.md): Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of servic (no CVSS)
- [CVE-2020-19147](https://cve.now/CVE-2020-19147.md): Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' funct (no CVSS)
- [CVE-2020-19146](https://cve.now/CVE-2020-19146.md): Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' para (no CVSS)
- [CVE-2021-39189](https://cve.now/CVE-2021-39189.md): Observable Response Discrepancy in Lost Password Service (CVSS 5.3, pimcore · pimcore/pimcore)
- [CVE-2021-38156](https://cve.now/CVE-2021-38156.md): In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. (no CVSS)
- [CVE-2021-21798](https://cve.now/CVE-2021-21798.md): An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. (CVSS 8.8, Nitro Pro)
- [CVE-2021-3797](https://cve.now/CVE-2021-3797.md): Use of Wrong Operator in String Comparison in hestiacp/hestiacp (CVSS 4.8, hestiacp/hestiacp)
- [CVE-2021-39307](https://cve.now/CVE-2021-39307.md): PDFTron's WebViewer UI 8.0 or below renders dangerous URLs as hyperlinks in supported documents, including JavaScript URLs, allowing the exe (no CVSS)
- [CVE-2021-3801](https://cve.now/CVE-2021-3801.md): Inefficient Regular Expression Complexity in prismjs/prism (CVSS 7.5, prismjs/prism · prismjs)
- [CVE-2021-40845](https://cve.now/CVE-2021-40845.md): The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts (no CVSS)
- [CVE-2021-30137](https://cve.now/CVE-2021-30137.md): Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. (CVSS 7.7)
- [CVE-2021-3794](https://cve.now/CVE-2021-3794.md): Inefficient Regular Expression Complexity in vuelidate/vuelidate (CVSS 7.5, vuelidate/vuelidate · @vuelidate/validators)
- [CVE-2020-3960](https://cve.now/CVE-2020-3960.md): VMware ESXi (6.7 before ESXi670-202006401-SG and 6.5 before ESXi650-202005401-SG), Workstation (15.x before 15.5.5), and Fusion (11.x before (no CVSS, VMware ESXi, Workstation, and Fusion)
- [CVE-2021-3785](https://cve.now/CVE-2021-3785.md): Cross-site Scripting (XSS) - Stored in yourls/yourls (CVSS 8.8, yourls/yourls)
- [CVE-2021-27662](https://cve.now/CVE-2021-27662.md): KT-1 Capture-replay (CVSS 8.6, Johnson Controls KT-1)
- [CVE-2021-3783](https://cve.now/CVE-2021-3783.md): Cross-site Scripting (XSS) - Reflected in yourls/yourls (CVSS 6.6, yourls/yourls)
- [CVE-2021-22148](https://cve.now/CVE-2021-22148.md): Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as (no CVSS, Elastic Enterprise Search)
- [CVE-2021-22149](https://cve.now/CVE-2021-22149.md): Elastic Enterprise Search App Search versions before 7.14.0 are vulnerable to an issue where API keys were missing authorization via an alte (no CVSS, Elastic Enterprise Search)
- [CVE-2021-22147](https://cve.now/CVE-2021-22147.md): Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. (no CVSS, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2020-35340](https://cve.now/CVE-2020-35340.md): A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from files that the runnin (no CVSS)
- [CVE-2021-40448](https://cve.now/CVE-2021-40448.md): Microsoft Accessibility Insights for Android Information Disclosure Vulnerability (CVSS 6.3, Microsoft Accessibility Insights for Android)
- [CVE-2021-40444](https://cve.now/CVE-2021-40444.md): Microsoft MSHTML Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2021-40447](https://cve.now/CVE-2021-40447.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-40440](https://cve.now/CVE-2021-40440.md): Microsoft Dynamics Business Central Cross-site Scripting Vulnerability (CVSS 5.4, Microsoft Dynamics 365 Business Central 2020 Release Wave 2…)
- [CVE-2021-38671](https://cve.now/CVE-2021-38671.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38669](https://cve.now/CVE-2021-38669.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 6.4, Microsoft Edge)
- [CVE-2021-38667](https://cve.now/CVE-2021-38667.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38661](https://cve.now/CVE-2021-38661.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-38660](https://cve.now/CVE-2021-38660.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel 2013 Service Pack)
- [CVE-2021-38659](https://cve.now/CVE-2021-38659.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise)
- [CVE-2021-38658](https://cve.now/CVE-2021-38658.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2013 Service Pack · Microsoft Office)
- [CVE-2021-38657](https://cve.now/CVE-2021-38657.md): Microsoft Office Graphics Component Information Disclosure Vulnerability (CVSS 6.1, Microsoft 365 Apps for Enterprise)
- [CVE-2021-38656](https://cve.now/CVE-2021-38656.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise)
- [CVE-2021-38655](https://cve.now/CVE-2021-38655.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +2)
- [CVE-2021-38654](https://cve.now/CVE-2021-38654.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2021-38653](https://cve.now/CVE-2021-38653.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2021-38652](https://cve.now/CVE-2021-38652.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2021-38650](https://cve.now/CVE-2021-38650.md): Microsoft Office Spoofing Vulnerability (CVSS 7.6, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +1)
- [CVE-2021-38651](https://cve.now/CVE-2021-38651.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-38649](https://cve.now/CVE-2021-38649.md): Open Management Infrastructure Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Azure Automation State Configuration, DSC Exte… +8)
- [CVE-2021-38648](https://cve.now/CVE-2021-38648.md): Open Management Infrastructure Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Azure Automation State Configuration, DSC Exte… +8)
- [CVE-2021-38647](https://cve.now/CVE-2021-38647.md): Open Management Infrastructure (OMI) Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft Azure Automation State Configuration, DSC Exte… +8)
- [CVE-2021-38646](https://cve.now/CVE-2021-38646.md): Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +1)
- [CVE-2021-38645](https://cve.now/CVE-2021-38645.md): Open Management Infrastructure Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Azure Automation State Configuration, DSC Exte… +8)
- [CVE-2021-38644](https://cve.now/CVE-2021-38644.md): Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft MPEG-2 Video Extension)
- [CVE-2021-38639](https://cve.now/CVE-2021-38639.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38637](https://cve.now/CVE-2021-38637.md): Windows Storage Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-38638](https://cve.now/CVE-2021-38638.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38636](https://cve.now/CVE-2021-38636.md): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-38635](https://cve.now/CVE-2021-38635.md): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-38634](https://cve.now/CVE-2021-38634.md): Microsoft Windows Update Client Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2021-38633](https://cve.now/CVE-2021-38633.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38632](https://cve.now/CVE-2021-38632.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-38630](https://cve.now/CVE-2021-38630.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38629](https://cve.now/CVE-2021-38629.md): Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-38628](https://cve.now/CVE-2021-38628.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-38626](https://cve.now/CVE-2021-38626.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2008 Service Pack)
- [CVE-2021-38625](https://cve.now/CVE-2021-38625.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2008 Service Pack)
- [CVE-2021-38624](https://cve.now/CVE-2021-38624.md): Windows Key Storage Provider Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-36975](https://cve.now/CVE-2021-36975.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36974](https://cve.now/CVE-2021-36974.md): Windows SMB Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36973](https://cve.now/CVE-2021-36973.md): Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36972](https://cve.now/CVE-2021-36972.md): Windows SMB Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36969](https://cve.now/CVE-2021-36969.md): Windows Redirected Drive Buffering SubSystem Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36968](https://cve.now/CVE-2021-36968.md): Windows DNS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36966](https://cve.now/CVE-2021-36966.md): Windows Subsystem for Linux Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36967](https://cve.now/CVE-2021-36967.md): Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2021-36965](https://cve.now/CVE-2021-36965.md): Windows WLAN AutoConfig Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-36964](https://cve.now/CVE-2021-36964.md): Windows Event Tracing Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36963](https://cve.now/CVE-2021-36963.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-36962](https://cve.now/CVE-2021-36962.md): Windows Installer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36961](https://cve.now/CVE-2021-36961.md): Windows Installer Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36960](https://cve.now/CVE-2021-36960.md): Windows SMB Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-36959](https://cve.now/CVE-2021-36959.md): Windows Authenticode Spoofing Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-36956](https://cve.now/CVE-2021-36956.md): Azure Sphere Information Disclosure Vulnerability (CVSS 4.4, Microsoft Azure Sphere)
- [CVE-2021-36955](https://cve.now/CVE-2021-36955.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-36954](https://cve.now/CVE-2021-36954.md): Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-36952](https://cve.now/CVE-2021-36952.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2021-26437](https://cve.now/CVE-2021-26437.md): Visual Studio Code Spoofing Vulnerability (CVSS 5.5, Microsoft Visual Studio Code)
- [CVE-2021-26435](https://cve.now/CVE-2021-26435.md): Windows Scripting Engine Memory Corruption Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-26434](https://cve.now/CVE-2021-26434.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2021-41061](https://cve.now/CVE-2021-41061.md): In RIOT-OS 2021.01, nonce reuse in 802.15.4 encryption in the ieee820154\_security component allows attackers to break encryption by triggeri (no CVSS)
- [CVE-2021-3780](https://cve.now/CVE-2021-3780.md): Cross-site Scripting (XSS) - Stored in chocobozzz/peertube (CVSS 7.6, chocobozzz/peertube · peertube)
- [CVE-2021-3777](https://cve.now/CVE-2021-3777.md): Inefficient Regular Expression Complexity in daaku/nodejs-tmpl (CVSS 7.5, daaku/nodejs-tmpl · tmpl)
- [CVE-2021-3751](https://cve.now/CVE-2021-3751.md): Out-of-bounds Write in bfabiszewski/libmobi (CVSS 9.6, bfabiszewski/libmobi)
- [CVE-2021-3706](https://cve.now/CVE-2021-3706.md): Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte (CVSS 7.4, pi-hole/adminlte)
- [CVE-2021-3778](https://cve.now/CVE-2021-3778.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2021-3796](https://cve.now/CVE-2021-3796.md): Use After Free in vim/vim (CVSS 8.2, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.