# CVEs published 2021-09-16

48 CVEs were published on September 16, 2021: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41314](https://cve.now/CVE-2021-41314.md): Certain NETGEAR smart switches are affected by a \\n injection in the web UI's password field, which - due to several faulty aspects of the a (no CVSS)
- [CVE-2020-21535](https://cve.now/CVE-2020-21535.md): fig2dev 3.2.7b contains a segmentation fault in the gencgm\_start function in gencgm.c. (no CVSS)
- [CVE-2020-21534](https://cve.now/CVE-2020-21534.md): fig2dev 3.2.7b contains a global buffer overflow in the get\_line function in read.c. (no CVSS)
- [CVE-2020-21533](https://cve.now/CVE-2020-21533.md): fig2dev 3.2.7b contains a stack buffer overflow in the read\_textobject function in read.c. (no CVSS)
- [CVE-2020-21530](https://cve.now/CVE-2020-21530.md): fig2dev 3.2.7b contains a segmentation fault in the read\_objects function in read.c. (no CVSS)
- [CVE-2021-40670](https://cve.now/CVE-2021-40670.md): SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file. (no CVSS)
- [CVE-2021-40669](https://cve.now/CVE-2021-40669.md): SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file. (no CVSS)
- [CVE-2021-29842](https://cve.now/CVE-2021-29842.md): IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames d (CVSS 3.7, IBM WebSphere Application Server)
- [CVE-2021-29825](https://cve.now/CVE-2021-29825.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN\_CMD with LOAD or BAC (CVSS 5.9, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-29763](https://cve.now/CVE-2021-29763.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to (CVSS 5.1, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-29752](https://cve.now/CVE-2021-29752.md): IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specif (CVSS 4.4, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2021-39214](https://cve.now/CVE-2021-39214.md): Lacking Protection against HTTP Request Smuggling in mitmproxy (CVSS 8.1, mitmproxy)
- [CVE-2021-41079](https://cve.now/CVE-2021-41079.md): Apache Tomcat DoS with unexpected TLS packet (no CVSS, Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2021-40438](https://cve.now/CVE-2021-40438.md): mod\_proxy SSRF (CVSS 9.0, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-39275](https://cve.now/CVE-2021-39275.md): ap\_escape\_quotes buffer overflow (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-39239](https://cve.now/CVE-2021-39239.md): XML External Entity (XXE) vulnerability (no CVSS, Apache Software Foundation Apache Jena · org.apache.jena:je…)
- [CVE-2021-36160](https://cve.now/CVE-2021-36160.md): mod\_proxy\_uwsgi out of bound read (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-34798](https://cve.now/CVE-2021-34798.md): NULL pointer dereference in httpd core (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-39208](https://cve.now/CVE-2021-39208.md): WriteEntryToDirectory used for an archive extraction is vulnerable to partial path traversal. (CVSS 4.3, adamhathcock sharpcompress · SharpCompress)
- [CVE-2021-27340](https://cve.now/CVE-2021-27340.md): OpenSIS Community Edition version \<= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" parameter. (no CVSS)
- [CVE-2021-27341](https://cve.now/CVE-2021-27341.md): OpenSIS Community Edition version \<= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via the "filename" parame (no CVSS)
- [CVE-2021-34576](https://cve.now/CVE-2021-34576.md): Observable discrepancy in Kaden PICOFLUX AiR leaks water consumption (CVSS 4.3, Kaden PICOFLUX AiR)
- [CVE-2021-34573](https://cve.now/CVE-2021-34573.md): Incorrect calculation in Enbra EWM does not report backflows or no flow events (CVSS 6.2, Enbra AT-WMBUS-16-2 · Enbra ER-AM DN +1)
- [CVE-2021-34572](https://cve.now/CVE-2021-34572.md): Insufficient Verification of Data Authenticity in Enbra EWM (replay attack) (CVSS 6.5, Enbra EWM)
- [CVE-2021-34571](https://cve.now/CVE-2021-34571.md): Hard-coded Credentials in Enbra Wireless M-Bus devices (CVSS 6.5, Enbra AT-WMBUS-16-2 · Enbra ER-AM DN +1)
- [CVE-2020-14124](https://cve.now/CVE-2020-14124.md): There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router AX3600 with ROM vers (no CVSS, Xiaomi Router AX3600)
- [CVE-2020-14119](https://cve.now/CVE-2020-14119.md): There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under administrator authority on (no CVSS, Xiaomi Router AX3600)
- [CVE-2020-14109](https://cve.now/CVE-2020-14109.md): There is command injection in the meshd program in the routing system, resulting in command execution under administrator authority on Xiaom (no CVSS, Xiaomi Router AX3600)
- [CVE-2020-14130](https://cve.now/CVE-2020-14130.md): Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affect (no CVSS, Xiaomi community app)
- [CVE-2021-40067](https://cve.now/CVE-2021-40067.md): The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. (no CVSS, NetMotion Mobility)
- [CVE-2021-40066](https://cve.now/CVE-2021-40066.md): The access controls on the Mobility read-only API improperly validate user access permissions. (no CVSS, NetMotion Mobility)
- [CVE-2021-39128](https://cve.now/CVE-2021-39128.md): Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administr (CVSS 7.2, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-21529](https://cve.now/CVE-2020-21529.md): fig2dev 3.2.7b contains a stack buffer overflow in the bezier\_spline function in genepic.c. (no CVSS)
- [CVE-2020-21531](https://cve.now/CVE-2020-21531.md): fig2dev 3.2.7b contains a global buffer overflow in the conv\_pattern\_index function in gencgm.c. (no CVSS)
- [CVE-2020-21532](https://cve.now/CVE-2020-21532.md): fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c. (no CVSS)
- [CVE-2020-21594](https://cve.now/CVE-2020-21594.md): libde265 v1.0.4 contains a heap buffer overflow in the put\_epel\_hv\_fallback function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21595](https://cve.now/CVE-2020-21595.md): libde265 v1.0.4 contains a heap buffer overflow in the mc\_luma function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21596](https://cve.now/CVE-2020-21596.md): libde265 v1.0.4 contains a global buffer overflow in the decode\_CABAC\_bit function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21597](https://cve.now/CVE-2020-21597.md): libde265 v1.0.4 contains a heap buffer overflow in the mc\_chroma function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21598](https://cve.now/CVE-2020-21598.md): libde265 v1.0.4 contains a heap buffer overflow in the ff\_hevc\_put\_unweighted\_pred\_8\_sse function, which can be exploited via a crafted a fi (no CVSS)
- [CVE-2020-21599](https://cve.now/CVE-2020-21599.md): libde265 v1.0.4 contains a heap buffer overflow in the de265\_image::available\_zscan function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21600](https://cve.now/CVE-2020-21600.md): libde265 v1.0.4 contains a heap buffer overflow in the put\_weighted\_pred\_avg\_16\_fallback function, which can be exploited via a crafted a fi (no CVSS)
- [CVE-2020-21601](https://cve.now/CVE-2020-21601.md): libde265 v1.0.4 contains a stack buffer overflow in the put\_qpel\_fallback function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21602](https://cve.now/CVE-2020-21602.md): libde265 v1.0.4 contains a heap buffer overflow in the put\_weighted\_bipred\_16\_fallback function, which can be exploited via a crafted a file (no CVSS)
- [CVE-2020-21603](https://cve.now/CVE-2020-21603.md): libde265 v1.0.4 contains a heap buffer overflow in the put\_qpel\_0\_0\_fallback\_16 function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21604](https://cve.now/CVE-2020-21604.md): libde265 v1.0.4 contains a heap buffer overflow fault in the \_mm\_loadl\_epi64 function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21605](https://cve.now/CVE-2020-21605.md): libde265 v1.0.4 contains a segmentation fault in the apply\_sao\_internal function, which can be exploited via a crafted a file. (no CVSS)
- [CVE-2020-21606](https://cve.now/CVE-2020-21606.md): libde265 v1.0.4 contains a heap buffer overflow fault in the put\_epel\_16\_fallback function, which can be exploited via a crafted a file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.