# CVEs published 2021-09-23

104 CVEs were published on September 23, 2021: 7 critical, 23 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2021-41088](https://cve.now/CVE-2021-41088.md): Remote code execution via the web UI backend of Elvish (CVSS 8.0, elves elvish · github.com/elves/elvish)
- [CVE-2020-19951](https://cve.now/CVE-2020-19951.md): A cross-site request forgery (CSRF) in /controller/pay.class.php of YzmCMS v5.5 allows attackers to access sensitive components of the appli (no CVSS)
- [CVE-2020-19950](https://cve.now/CVE-2020-19950.md): A cross-site scripting (XSS) vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web script (no CVSS)
- [CVE-2020-19949](https://cve.now/CVE-2020-19949.md): A cross-site scripting (XSS) vulnerability in the /link/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts (no CVSS)
- [CVE-2021-38877](https://cve.now/CVE-2021-38877.md): IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29905](https://cve.now/CVE-2021-29905.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to cross-site scripting. (CVSS 5.4, IBM Jazz for Service Management)
- [CVE-2021-29904](https://cve.now/CVE-2021-29904.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI displays user credentials in plain clear text which can be read (CVSS 6.2, IBM Jazz for Service Management)
- [CVE-2021-29833](https://cve.now/CVE-2021-29833.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29832](https://cve.now/CVE-2021-29832.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29816](https://cve.now/CVE-2021-29816.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to cross-site request forgery which could allow an (CVSS 4.3, IBM Jazz for Service Management)
- [CVE-2021-29815](https://cve.now/CVE-2021-29815.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29814](https://cve.now/CVE-2021-29814.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29813](https://cve.now/CVE-2021-29813.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29812](https://cve.now/CVE-2021-29812.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-29810](https://cve.now/CVE-2021-29810.md): IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus\_GUI is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2020-24327](https://cve.now/CVE-2020-24327.md): Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. (no CVSS)
- [CVE-2021-38870](https://cve.now/CVE-2021-38870.md): IBM Aspera Cloud is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Aspera)
- [CVE-2021-38864](https://cve.now/CVE-2021-38864.md): IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation. (CVSS 6.1, IBM Security Verify Bridge)
- [CVE-2021-20563](https://cve.now/CVE-2021-20563.md): IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote authenciated user to obtain sensitive information. (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2021-20485](https://cve.now/CVE-2021-20485.md): IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical er (CVSS 4.3, IBM Sterling File Gateway)
- [CVE-2021-20484](https://cve.now/CVE-2021-20484.md): IBM Sterling File Gateway 2.2.0.0 through 6.1.0.3 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling File Gateway)
- [CVE-2021-20435](https://cve.now/CVE-2021-20435.md): IBM Security Verify Bridge 1.0.5.0 does not properly validate a certificate which could allow a local attacker to obtain sensitive informati (CVSS 2.5, IBM Security Verify Bridge)
- [CVE-2021-20434](https://cve.now/CVE-2021-20434.md): IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a local user. (CVSS 4.1, IBM Security Verify Bridge)
- [CVE-2020-4941](https://cve.now/CVE-2020-4941.md): IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks agai (CVSS 4.3, IBM Edge)
- [CVE-2021-38863](https://cve.now/CVE-2021-38863.md): IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. (CVSS 6.5, IBM Security Verify Bridge)
- [CVE-2021-29800](https://cve.now/CVE-2021-29800.md): IBM Tivoli Netcool/OMNIbus\_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Jazz for Service Management)
- [CVE-2021-20377](https://cve.now/CVE-2021-20377.md): IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned (CVSS 2.7, IBM Security Guardium)
- [CVE-2020-4809](https://cve.now/CVE-2020-4809.md): IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Edge)
- [CVE-2020-4805](https://cve.now/CVE-2020-4805.md): IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Edge)
- [CVE-2020-4803](https://cve.now/CVE-2020-4803.md): IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. (CVSS 4.0, IBM Edge)
- [CVE-2020-4690](https://cve.now/CVE-2020-4690.md): IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authe (CVSS 7.5, IBM Security Guardium)
- [CVE-2021-22276](https://cve.now/CVE-2021-22276.md): free@home System Access Point FW integrity check can be bypassed. (CVSS 6.1, ABB System Access Point · Busch-Jaeger System Access Point)
- [CVE-2021-26794](https://cve.now/CVE-2021-26794.md): Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php file. (no CVSS)
- [CVE-2021-36823](https://cve.now/CVE-2021-36823.md): WordPress Absolutely Glamorous Custom Admin plugin \<= 6.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.6, Cusmin AGCA - Absolutely Glamorous Custom Admin)
- [CVE-2021-36873](https://cve.now/CVE-2021-36873.md): WordPress iQ Block Country plugin \<= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 5.5, Webence iQ Block Country)
- [CVE-2021-36872](https://cve.now/CVE-2021-36872.md): WordPress Popular Posts plugin \<= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability (CVSS 5.5, Hector Cabrera WordPress Popular Posts)
- [CVE-2021-3824](https://cve.now/CVE-2021-3824.md): OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL. (no CVSS, OpenVPN Access Server)
- [CVE-2021-21913](https://cve.now/CVE-2021-21913.md): An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. (CVSS 10.0, D-Link)
- [CVE-2021-26750](https://cve.now/CVE-2021-26750.md): DLL hijacking in Panda Agent \<=1.16.11 in Panda Security, S.L.U. (no CVSS)
- [CVE-2021-32987](https://cve.now/CVE-2021-32987.md): AVEVA SuiteLink Server Null Pointer Dereference (CVSS 7.5, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-32999](https://cve.now/CVE-2021-32999.md): AVEVA SuiteLink Server Improper Handling of Exceptional Conditions (CVSS 7.5, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-32979](https://cve.now/CVE-2021-32979.md): AVEVA SuiteLink Server Null Pointer Dereference (CVSS 7.5, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-32971](https://cve.now/CVE-2021-32971.md): AVEVA SuiteLink Server Null Pointer Dereference (CVSS 7.5, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-32959](https://cve.now/CVE-2021-32959.md): AVEVA SuiteLink Server Buffer Overflow (CVSS 8.1, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-32963](https://cve.now/CVE-2021-32963.md): AVEVA SuiteLink Server Null Pointer Dereference (CVSS 7.5, AVEVA Software AVEVA System Platform · AVEVA Software AV… +4)
- [CVE-2021-22941](https://cve.now/CVE-2021-22941.md): Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacker to remotely compro (CVSS 9.8, KEV, Citrix ShareFile storage zones controller)
- [CVE-2021-22948](https://cve.now/CVE-2021-22948.md): Vulnerability in the generation of session IDs in revive-adserver \< 5.3.0, based on the cryptographically insecure uniqid() PHP function. (no CVSS, https://github.com/revive-adserver/revive-adserver)
- [CVE-2021-22953](https://cve.now/CVE-2021-22953.md): A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, and exhaustion of disk (no CVSS, https://github.com/concrete5/concrete5)
- [CVE-2021-22952](https://cve.now/CVE-2021-22952.md): A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to (no CVSS, UniFi Talk application)
- [CVE-2021-22950](https://cve.now/CVE-2021-22950.md): Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be deleted.Credit for d (no CVSS, https://github.com/concrete5/concrete5)
- [CVE-2021-22949](https://cve.now/CVE-2021-22949.md): A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience, and exhaustion of d (no CVSS, https://github.com/concrete5/concrete5)
- [CVE-2021-22020](https://cve.now/CVE-2021-22020.md): The vCenter Server contains a denial-of-service vulnerability in the Analytics service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22019](https://cve.now/CVE-2021-22019.md): The vCenter Server contains a denial-of-service vulnerability in VAPI (vCenter API) service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22018](https://cve.now/CVE-2021-22018.md): The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22017](https://cve.now/CVE-2021-22017.md): Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. (CVSS 5.3, KEV, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22016](https://cve.now/CVE-2021-22016.md): The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22014](https://cve.now/CVE-2021-22014.md): The vCenter Server contains an authenticated code execution vulnerability in VAMI (Virtual Appliance Management Infrastructure). (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22013](https://cve.now/CVE-2021-22013.md): The vCenter Server contains a file path traversal vulnerability leading to information disclosure in the appliance management API. (no CVSS, VMware vCenter Server)
- [CVE-2021-22012](https://cve.now/CVE-2021-22012.md): The vCenter Server contains an information disclosure vulnerability due to an unauthenticated appliance management API. (no CVSS, VMware vCenter Server)
- [CVE-2021-22011](https://cve.now/CVE-2021-22011.md): vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22010](https://cve.now/CVE-2021-22010.md): The vCenter Server contains a denial-of-service vulnerability in VPXD service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22009](https://cve.now/CVE-2021-22009.md): The vCenter Server contains multiple denial-of-service vulnerabilities in VAPI (vCenter API) service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22008](https://cve.now/CVE-2021-22008.md): The vCenter Server contains an information disclosure vulnerability in VAPI (vCenter API) service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22007](https://cve.now/CVE-2021-22007.md): The vCenter Server contains a local information disclosure vulnerability in the Analytics service. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22006](https://cve.now/CVE-2021-22006.md): The vCenter Server contains a reverse proxy bypass vulnerability due to the way the endpoints handle the URI. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22005](https://cve.now/CVE-2021-22005.md): The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. (CVSS 9.8, KEV, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-21993](https://cve.now/CVE-2021-21993.md): The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vCenter Server Content (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-33035](https://cve.now/CVE-2021-33035.md): Buffer overflow from a crafted DBF file (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2021-1621](https://cve.now/CVE-2021-1621.md): Cisco IOS XE Software Interface Queue Wedge Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2021-1620](https://cve.now/CVE-2021-1620.md): Cisco IOS and IOS XE Software IKEv2 AutoReconnect Feature Denial of Service Vulnerability (CVSS 7.7, Cisco IOS)
- [CVE-2021-1619](https://cve.now/CVE-2021-1619.md): Cisco IOS XE Software NETCONF and RESTCONF Authentication Bypass Vulnerability (CVSS 9.8, Cisco IOS XE Software)
- [CVE-2021-1616](https://cve.now/CVE-2021-1616.md): Cisco IOS XE Software H.323 Application Level Gateway Bypass Vulnerability (CVSS 4.7, Cisco IOS XE Software)
- [CVE-2021-1615](https://cve.now/CVE-2021-1615.md): Cisco Embedded Wireless Controller Software for Catalyst Access Points Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-1612](https://cve.now/CVE-2021-1612.md): Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability (CVSS 5.5, Cisco IOS XE SD-WAN Software)
- [CVE-2021-1611](https://cve.now/CVE-2021-1611.md): Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers EoGRE Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-1589](https://cve.now/CVE-2021-1589.md): Cisco SD-WAN vManage Software Disaster Recovery Feature Password Exposure Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2021-1419](https://cve.now/CVE-2021-1419.md): Cisco Access Points SSH Management Privilege Escalation Vulnerability (CVSS 7.8, Cisco Wireless LAN Controller)
- [CVE-2021-1546](https://cve.now/CVE-2021-1546.md): Cisco SD-WAN Software Information Disclosure Vulnerability (CVSS 5.5, Cisco SD-WAN Solution)
- [CVE-2021-1565](https://cve.now/CVE-2021-1565.md): Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-34770](https://cve.now/CVE-2021-34770.md): Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Remote Code Execution Vulnerability (CVSS 10.0, Cisco IOS XE Software)
- [CVE-2021-34769](https://cve.now/CVE-2021-34769.md): Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-34768](https://cve.now/CVE-2021-34768.md): Cisco IOS XE Software for Catalyst 9000 Family Wireless Controllers CAPWAP Denial of Service Vulnerabilities (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-34767](https://cve.now/CVE-2021-34767.md): Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers IPv6 Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2021-34740](https://cve.now/CVE-2021-34740.md): Cisco Aironet Access Points WLAN Control Protocol Packet Buffer Leak Denial of Service Vulnerability (CVSS 7.4, Cisco Aironet Access Point Software)
- [CVE-2021-34729](https://cve.now/CVE-2021-34729.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 6.7, Cisco IOS XE SD-WAN Software)
- [CVE-2021-34727](https://cve.now/CVE-2021-34727.md): Cisco IOS XE SD-WAN Software Buffer Overflow Vulnerability (CVSS 9.8, Cisco IOS XE SD-WAN Software)
- [CVE-2021-34726](https://cve.now/CVE-2021-34726.md): Cisco SD-WAN Software Command Injection Vulnerability (CVSS 6.7, Cisco SD-WAN Solution)
- [CVE-2021-34725](https://cve.now/CVE-2021-34725.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 6.7, Cisco IOS XE SD-WAN Software)
- [CVE-2021-34724](https://cve.now/CVE-2021-34724.md): Cisco IOS XE SD-WAN Software Privilege Escalation Vulnerability (CVSS 6.0, Cisco IOS XE SD-WAN Software)
- [CVE-2021-34705](https://cve.now/CVE-2021-34705.md): Cisco IOS and IOS XE Software FXO Interface Destination Pattern Bypass Vulnerability (CVSS 5.3, Cisco IOS)
- [CVE-2021-34712](https://cve.now/CVE-2021-34712.md): Cisco SD-WAN vManage Software Cypher Query Language Injection Vulnerability (CVSS 5.4, Cisco SD-WAN vManage)
- [CVE-2021-34714](https://cve.now/CVE-2021-34714.md): Multiple Cisco Operating Systems Unidirectional Link Detection Denial of Service Vulnerability (CVSS 7.4, Cisco IOS)
- [CVE-2021-34723](https://cve.now/CVE-2021-34723.md): Cisco IOS XE SD-WAN Software Arbitrary File Overwrite Vulnerability (CVSS 6.7, Cisco IOS XE Software)
- [CVE-2021-34703](https://cve.now/CVE-2021-34703.md): Cisco IOS and IOS XE Software Link Layer Discovery Protocol Denial of Service Vulnerability (CVSS 6.8, Cisco IOS)
- [CVE-2021-34699](https://cve.now/CVE-2021-34699.md): Cisco IOS and IOS XE Software TrustSec CLI Parser Denial of Service Vulnerability (CVSS 7.7, Cisco IOS)
- [CVE-2021-34697](https://cve.now/CVE-2021-34697.md): Cisco IOS XE Software Protection Against Distributed Denial of Service Attacks Feature Vulnerability (CVSS 5.8, Cisco IOS XE Software)
- [CVE-2021-34696](https://cve.now/CVE-2021-34696.md): Cisco ASR 900 and ASR 920 Series Aggregation Services Routers Access Control List Bypass Vulnerability (CVSS 5.8, Cisco IOS XE Software)
- [CVE-2021-1625](https://cve.now/CVE-2021-1625.md): Cisco IOS XE Software Zone-Based Policy Firewall ICMP and UDP Inspection Vulnerability (CVSS 5.8, Cisco IOS XE Software)
- [CVE-2021-1624](https://cve.now/CVE-2021-1624.md): Cisco IOS XE Software Rate Limiting Network Address Translation Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-1623](https://cve.now/CVE-2021-1623.md): Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Simple Network Management Protocol Denial of Service Vulnerability (CVSS 7.7, Cisco IOS XE Software)
- [CVE-2021-1622](https://cve.now/CVE-2021-1622.md): Cisco IOS XE Software for Cisco cBR-8 Converged Broadband Routers Common Open Policy Service Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2021-22015](https://cve.now/CVE-2021-22015.md): The vCenter Server contains multiple local privilege escalation vulnerabilities due to improper permissions of files and directories. (no CVSS, VMware vCenter Server, VMware Cloud Foundation)
- [CVE-2021-22945](https://cve.now/CVE-2021-22945.md): When sending data to an MQTT server, libcurl \<= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed (CVSS 9.1, https://github.com/curl/curl)
- [CVE-2021-41381](https://cve.now/CVE-2021-41381.md): Payara Micro Community 5.2021.6 and below allows Directory Traversal. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.