# CVEs published 2021-09-17

50 CVEs were published on September 17, 2021: 2 critical, 16 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41392](https://cve.now/CVE-2021-41392.md): static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. (no CVSS)
- [CVE-2021-41391](https://cve.now/CVE-2021-41391.md): In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XS (no CVSS)
- [CVE-2021-41390](https://cve.now/CVE-2021-41390.md): In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV Inj (no CVSS)
- [CVE-2021-41387](https://cve.now/CVE-2021-41387.md): seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root. (no CVSS)
- [CVE-2020-21548](https://cve.now/CVE-2020-21548.md): Libsixel 1.8.3 contains a heap-based buffer overflow in the sixel\_encode\_highcolor function in tosixel.c. (no CVSS)
- [CVE-2020-21547](https://cve.now/CVE-2020-21547.md): Libsixel 1.8.2 contains a heap-based buffer overflow in the dither\_func\_fs function in tosixel.c. (no CVSS)
- [CVE-2021-39218](https://cve.now/CVE-2021-39218.md): Out-of-bounds read/write and invalid free with \`externref\`s and GC safepoints in Wasmtime (CVSS 6.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2021-39219](https://cve.now/CVE-2021-39219.md): Wrong type for \`Linker\`-define functions when used across two \`Engine\`s (CVSS 6.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2021-39216](https://cve.now/CVE-2021-39216.md): Use after free passing \`externref\`s to Wasm in Wasmtime (CVSS 6.3, bytecodealliance wasmtime · wasmtime)
- [CVE-2021-41383](https://cve.now/CVE-2021-41383.md): setup.cgi on NETGEAR R6020 1.0.0.48 devices allows an admin to execute arbitrary shell commands via shell metacharacters in the ntp\_server f (no CVSS)
- [CVE-2021-41380](https://cve.now/CVE-2021-41380.md): RealVNC Viewer 6.21.406 allows remote VNC servers to cause a denial of service (application crash) via crafted RFB protocol data. (no CVSS)
- [CVE-2021-38412](https://cve.now/CVE-2021-38412.md): Digi PortServer TS 16 Improper Authentication (CVSS 9.6, Digi International PortServer TS)
- [CVE-2021-38404](https://cve.now/CVE-2021-38404.md): Delta Electronics DOPSoft 2 Heap-based Buffer Overflow (CVSS 7.8, Delta Electronics DOPSoft)
- [CVE-2021-38402](https://cve.now/CVE-2021-38402.md): Delta Electronics DOPSoft 2 Stack-Based Buffer Overflow (CVSS 7.8, Delta Electronics DOPSoft)
- [CVE-2021-38406](https://cve.now/CVE-2021-38406.md): Delta Electronics DOPSoft 2 Out-of-Bounds Write (CVSS 7.8, KEV, Delta Electronics DOPSoft)
- [CVE-2020-12083](https://cve.now/CVE-2020-12083.md): An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1 (7.11.0-64). (no CVSS)
- [CVE-2020-12082](https://cve.now/CVE-2020-12082.md): A stored cross-site scripting issue impacts certain areas of the Web UI for Code Insight v7.x releases up to and including 2020 R1 (7.11.0-6 (no CVSS)
- [CVE-2020-12080](https://cve.now/CVE-2020-12080.md): A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. (no CVSS)
- [CVE-2021-40825](https://cve.now/CVE-2021-40825.md): nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. (no CVSS)
- [CVE-2021-38304](https://cve.now/CVE-2021-38304.md): Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged user to potentially (no CVSS)
- [CVE-2019-9060](https://cve.now/CVE-2019-9060.md): An issue was discovered in CMS Made Simple 2.2.8. (no CVSS)
- [CVE-2021-41317](https://cve.now/CVE-2021-41317.md): XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths. (no CVSS)
- [CVE-2021-41315](https://cve.now/CVE-2021-41315.md): The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. (no CVSS)
- [CVE-2021-41316](https://cve.now/CVE-2021-41316.md): The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. (no CVSS)
- [CVE-2021-39227](https://cve.now/CVE-2021-39227.md): Fix prototype pollution in the zrender merge and clone helper methods (CVSS 6.2, ecomfe zrender · zrender)
- [CVE-2021-39228](https://cve.now/CVE-2021-39228.md): Memory Safety Issue when using patch or merge on state and assign the result back to state (CVSS 6.5, tremor-rs tremor-runtime · tremor-script)
- [CVE-2021-31844](https://cve.now/CVE-2021-31844.md): Local Privilege Escalation in McAfee DLP Endpoint for Windows (CVSS 8.2, McAfee Data Loss Prevention (DLP) Endpoint for Windows)
- [CVE-2021-31845](https://cve.now/CVE-2021-31845.md): Remote Code Execution in McAfee DLP Discover (CVSS 8.4, McAfee Data Loss Prevention (DLP) Discover)
- [CVE-2021-31843](https://cve.now/CVE-2021-31843.md): Improper access control vulnerability in McAfee ENS for Windows (CVSS 7.3, McAfee Endpoint Security (ENS) for WIndows)
- [CVE-2021-31842](https://cve.now/CVE-2021-31842.md): XML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a lo (CVSS 5.0, McAfee Endpoint Security (ENS) for WIndows)
- [CVE-2021-39327](https://cve.now/CVE-2021-39327.md): BulletProof Security \<= 5.1 Sensitive Information Disclosure (CVSS 5.3, AITpro BulletProof Security)
- [CVE-2021-23442](https://cve.now/CVE-2021-23442.md): Prototype Pollution (CVSS 8.6, @cookiex/deep)
- [CVE-2021-41303](https://cve.now/CVE-2021-41303.md): Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass (no CVSS, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2021-30261](https://cve.now/CVE-2021-30261.md): Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from HLOS in S (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag…)
- [CVE-2021-30260](https://cve.now/CVE-2021-30260.md): Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan hostlist configurat (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1976](https://cve.now/CVE-2021-1976.md): A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snap (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1947](https://cve.now/CVE-2021-1947.md): Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Connectivity, (CVSS 8.4, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-1939](https://cve.now/CVE-2021-1939.md): Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, Snapdragon (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-3812](https://cve.now/CVE-2021-3812.md): Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.7, pi-hole/adminlte)
- [CVE-2021-3811](https://cve.now/CVE-2021-3811.md): Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte (CVSS 6.7, pi-hole/adminlte)
- [CVE-2021-3810](https://cve.now/CVE-2021-3810.md): Inefficient Regular Expression Complexity in cdr/code-server (CVSS 7.5, cdr/code-server · code-server)
- [CVE-2021-3804](https://cve.now/CVE-2021-3804.md): Inefficient Regular Expression Complexity in nervjs/taro (CVSS 7.5, nervjs/taro · @tarojs/helper)
- [CVE-2021-20828](https://cve.now/CVE-2021-20828.md): Cross-site scripting vulnerability in Order Status Batch Change Plug-in (for EC-CUBE 3.0 series) all versions allows a remote attacker to in (no CVSS, ActiveFusions Co. Order Status Batch Change Plug-in)
- [CVE-2021-20825](https://cve.now/CVE-2021-20825.md): Cross-site scripting vulnerability in List (order management) item change plug-in (for EC-CUBE 3.0 series) Ver.1.1 and earlier allows a remo (no CVSS, shiro8 Co. List (order management) item change plug-in)
- [CVE-2021-20791](https://cve.now/CVE-2021-20791.md): Improper access control vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to bypass access restriction and to exchan (no CVSS, J’s Communication Co. RevoWorks Browser)
- [CVE-2021-20790](https://cve.now/CVE-2021-20790.md): Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary comm (no CVSS, J’s Communication Co. RevoWorks Browser)
- [CVE-2021-3803](https://cve.now/CVE-2021-3803.md): Inefficient Regular Expression Complexity in fb55/nth-check (CVSS 7.5, fb55/nth-check · nth-check)
- [CVE-2021-3805](https://cve.now/CVE-2021-3805.md): Prototype Pollution in mariocasciaro/object-path (CVSS 7.5, mariocasciaro/object-path · object-path)
- [CVE-2021-3807](https://cve.now/CVE-2021-3807.md): Inefficient Regular Expression Complexity in chalk/ansi-regex (CVSS 7.5, chalk/ansi-regex · ansi-regex)
- [CVE-2021-41326](https://cve.now/CVE-2021-41326.md): In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell\_exec call. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.