# CVEs published 2021-09-22

24 CVEs were published on September 22, 2021: 1 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-23481](https://cve.now/CVE-2020-23481.md): CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web (no CVSS)
- [CVE-2020-23478](https://cve.now/CVE-2020-23478.md): Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/ (no CVSS, leo)
- [CVE-2020-23469](https://cve.now/CVE-2020-23469.md): gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin. (no CVSS)
- [CVE-2021-21992](https://cve.now/CVE-2021-21992.md): The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-21991](https://cve.now/CVE-2021-21991.md): The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-34647](https://cve.now/CVE-2021-34647.md): Ninja Forms \<= 3.5.7 Sensitive Information Disclosure (CVSS 6.5, Saturday Drive Ninja Forms)
- [CVE-2021-34648](https://cve.now/CVE-2021-34648.md): Ninja Forms \<= 3.5.7 Unprotected REST-API to Email Injection (CVSS 6.4, Saturday Drive Ninja Forms)
- [CVE-2021-37860](https://cve.now/CVE-2021-37860.md): Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web (CVSS 3.7, Mattermost · github.com/mattermost/mattermost-server/v5 +1)
- [CVE-2019-6288](https://cve.now/CVE-2019-6288.md): Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU\_SHELL URI. (no CVSS)
- [CVE-2021-40684](https://cve.now/CVE-2021-40684.md): Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint (no CVSS)
- [CVE-2021-41011](https://cve.now/CVE-2021-41011.md): LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities under certain conditio (no CVSS, LINE client for iOS)
- [CVE-2021-40875](https://cve.now/CVE-2021-40875.md): Improper Access Control in Gurock TestRail versions \< 7.2.0.3014 resulted in sensitive information exposure. (no CVSS)
- [CVE-2021-37927](https://cve.now/CVE-2021-37927.md): Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO. (no CVSS)
- [CVE-2021-31836](https://cve.now/CVE-2021-31836.md): Improper Privilege Management in MA for Windows (CVSS 5.6, McAfee Agent for Windows)
- [CVE-2021-31847](https://cve.now/CVE-2021-31847.md): Improper privilege management in repair process of MA for Windows (CVSS 8.2, McAfee Agent for Windows)
- [CVE-2021-31841](https://cve.now/CVE-2021-31841.md): DLL side loading vulnerability in MA for Windows (CVSS 8.2, McAfee Agent for Windows)
- [CVE-2021-37925](https://cve.now/CVE-2021-37925.md): Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability. (no CVSS)
- [CVE-2021-39404](https://cve.now/CVE-2021-39404.md): MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database. (no CVSS)
- [CVE-2021-36260](https://cve.now/CVE-2021-36260.md): A command injection vulnerability in the web server of some Hikvision product. (CVSS 9.8, KEV)
- [CVE-2021-39339](https://cve.now/CVE-2021-39339.md): Telefication \<= 1.8.0 Open Proxy and Server-Side Request Forgery (CVSS 5.8, Telefication)
- [CVE-2021-38153](https://cve.now/CVE-2021-38153.md): Timing Attack Vulnerability for Apache Kafka Connect and Clients (no CVSS, Apache Software Foundation Apache Kafka · org.apache.kaf… +3)
- [CVE-2021-38112](https://cve.now/CVE-2021-38112.md): In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote (no CVSS)
- [CVE-2021-31819](https://cve.now/CVE-2021-31819.md): In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already t (no CVSS, Octopus Deploy Halibut · Halibut)
- [CVE-2021-3583](https://cve.now/CVE-2021-3583.md): A flaw was found in Ansible, where a user's controller is vulnerable to template injection. (no CVSS, ansible)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.