# CVEs published 2021-09-21 30 CVEs were published on September 21, 2021: 0 critical, 4 high. Days are UTC. - [CVE-2021-41382](https://cve.now/CVE-2021-41382.md): Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface. (no CVSS) - [CVE-2020-23273](https://cve.now/CVE-2020-23273.md): Heap-buffer overflow in the randomize\_iparp function in edit\_packet.c. (no CVSS) - [CVE-2020-23269](https://cve.now/CVE-2020-23269.md): An issue was discovered in gpac 0.8.0. (no CVSS) - [CVE-2020-23266](https://cve.now/CVE-2020-23266.md): An issue was discovered in gpac 0.8.0. (no CVSS) - [CVE-2020-23267](https://cve.now/CVE-2020-23267.md): An issue was discovered in gpac 0.8.0. (no CVSS) - [CVE-2021-41087](https://cve.now/CVE-2021-41087.md): Improperly Implemented path matching for in-toto-golang (CVSS 5.6, in-toto-golang · github.com/in-toto/in-toto-golang) - [CVE-2021-41086](https://cve.now/CVE-2021-41086.md): Clipboard-based XSS in jsuites (CVSS 8.7, jsuites) - [CVE-2020-19554](https://cve.now/CVE-2020-19554.md): Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager \<=12.5.174 when the API key contains an XML-based XSS payload. (no CVSS) - [CVE-2020-19553](https://cve.now/CVE-2020-19553.md): Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in coreframe/app/attachment/lib (no CVSS) - [CVE-2020-19551](https://cve.now/CVE-2020-19551.md): Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause remote code execution (no CVSS) - [CVE-2021-41084](https://cve.now/CVE-2021-41084.md): Response Splitting from unsanitized headers in http4s (CVSS 8.7, http4s · org.http4s:http4s-client\_2.12 +8) - [CVE-2021-40847](https://cve.now/CVE-2021-40847.md): The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code executio (no CVSS) - [CVE-2021-23444](https://cve.now/CVE-2021-23444.md): Prototype Pollution (CVSS 5.6, jointjs) - [CVE-2021-39230](https://cve.now/CVE-2021-39230.md): Error in JPNS kernel of Butter (CVSS 8.8, FrankEnderman Butter) - [CVE-2021-23443](https://cve.now/CVE-2021-23443.md): Cross-site Scripting (XSS) (CVSS 5.4, edge.js) - [CVE-2021-40868](https://cve.now/CVE-2021-40868.md): In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS. (no CVSS) - [CVE-2021-29831](https://cve.now/CVE-2021-29831.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to an XML External Entity Injection (XXE) attack w (CVSS 7.1, IBM Jazz for Service Management) - [CVE-2021-29795](https://cve.now/CVE-2021-29795.md): IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of hypervisor calls fr (CVSS 6.0, IBM PowerVM Hypervisor) - [CVE-2021-41525](https://cve.now/CVE-2021-41525.md): An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNet inventory agent an (no CVSS) - [CVE-2021-41531](https://cve.now/CVE-2021-41531.md): Invalid RPKI data could disable Route Origin Validation on RTR clients. (no CVSS, NLnet Labs Routinator) - [CVE-2021-37741](https://cve.now/CVE-2021-37741.md): ManageEngine ADManager Plus before 7111 has Pre-authentication RCE vulnerabilities. (no CVSS) - [CVE-2021-37419](https://cve.now/CVE-2021-37419.md): Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to SSRF. (no CVSS) - [CVE-2021-37420](https://cve.now/CVE-2021-37420.md): Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing. (no CVSS) - [CVE-2021-37424](https://cve.now/CVE-2021-37424.md): ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover. (no CVSS) - [CVE-2021-28960](https://cve.now/CVE-2021-28960.md): Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input comman (no CVSS) - [CVE-2021-0869](https://cve.now/CVE-2021-0869.md): In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android) - [CVE-2021-26333](https://cve.now/CVE-2021-26333.md): AMD Chipset Driver Information Disclosure Vulnerability (no CVSS, AMD PSP Driver) - [CVE-2021-31917](https://cve.now/CVE-2021-31917.md): A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). (no CVSS, Red Hat DataGrid and Infinispan) - [CVE-2021-20829](https://cve.now/CVE-2021-20829.md): Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to e (no CVSS, WESEEK GROWI) - [CVE-2021-20037](https://cve.now/CVE-2021-20037.md): SonicWall Global VPN Client 4.10.5 installer (32-bit and 64-bit) incorrect default file permission vulnerability leads to privilege escalati (no CVSS, SonicWall Global VPN Client) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-09-21 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.