# CVEs published 2021-09-24

25 CVEs were published on September 24, 2021: 0 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-21742](https://cve.now/CVE-2021-21742.md): There is an information leak vulnerability in the message service app of a ZTE mobile phone. (no CVSS, ZTE Axon 30 Pro Message Service App)
- [CVE-2020-20514](https://cve.now/CVE-2020-20514.md): A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/\<id\>.html allows authenticated attackers to delete all u (no CVSS)
- [CVE-2020-20508](https://cve.now/CVE-2020-20508.md): Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hi (no CVSS)
- [CVE-2021-40655](https://cve.now/CVE-2021-40655.md): An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. (CVSS 7.5, KEV)
- [CVE-2021-40654](https://cve.now/CVE-2021-40654.md): An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. (no CVSS)
- [CVE-2021-41504](https://cve.now/CVE-2021-41504.md): An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. (no CVSS)
- [CVE-2021-41503](https://cve.now/CVE-2021-41503.md): DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. (CVSS 8.0)
- [CVE-2021-2464](https://cve.now/CVE-2021-2464.md): Vulnerability in Oracle Linux (component: OSwatcher). (CVSS 7.8, Oracle Linux)
- [CVE-2021-39246](https://cve.now/CVE-2021-39246.md): Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion address (no CVSS)
- [CVE-2021-22868](https://cve.now/CVE-2021-22868.md): Unsafe configuration options in GitHub Pages leading to path traversal on GitHub Enterprise Server (no CVSS, GitHub Enterprise Server)
- [CVE-2021-22869](https://cve.now/CVE-2021-22869.md): Improper access control in GitHub Enterprise Server allows self-hosted runners to execute outside their control group (no CVSS, GitHub Enterprise Server)
- [CVE-2021-28130](https://cve.now/CVE-2021-28130.md): Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. (no CVSS)
- [CVE-2021-40309](https://cve.now/CVE-2021-40309.md): A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. (no CVSS)
- [CVE-2021-40310](https://cve.now/CVE-2021-40310.md): OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp\_id\_miss (no CVSS)
- [CVE-2021-40099](https://cve.now/CVE-2021-40099.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40100](https://cve.now/CVE-2021-40100.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40102](https://cve.now/CVE-2021-40102.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-41586](https://cve.now/CVE-2021-41586.md): In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password. (no CVSS)
- [CVE-2021-41587](https://cve.now/CVE-2021-41587.md): In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other re (no CVSS)
- [CVE-2021-41588](https://cve.now/CVE-2021-41588.md): In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. (no CVSS)
- [CVE-2021-36749](https://cve.now/CVE-2021-36749.md): Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920) (no CVSS, Apache Software Foundation Apache Druid · org.apache.druid:…)
- [CVE-2021-41584](https://cve.now/CVE-2021-41584.md): Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configura (no CVSS)
- [CVE-2021-31923](https://cve.now/CVE-2021-31923.md): Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. (no CVSS, Ping Identity PingAccess)
- [CVE-2021-41583](https://cve.now/CVE-2021-41583.md): vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated (no CVSS)
- [CVE-2021-41581](https://cve.now/CVE-2021-41581.md): x509\_constraints\_parse\_mailbox in lib/libcrypto/x509/x509\_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.