# CVEs published 2021-09-27

115 CVEs were published on September 27, 2021: 4 critical, 21 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2020-20693](https://cve.now/CVE-2020-20693.md): A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts. (no CVSS, gilacms/gila)
- [CVE-2020-20695](https://cve.now/CVE-2020-20695.md): A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted (no CVSS, gilacms/gila)
- [CVE-2020-20696](https://cve.now/CVE-2020-20696.md): A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HT (no CVSS, gilacms/gila)
- [CVE-2020-20691](https://cve.now/CVE-2020-20691.md): An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploadi (no CVSS)
- [CVE-2020-20692](https://cve.now/CVE-2020-20692.md): GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $\_GET parameter in /src/core/controllers/cm.php. (no CVSS)
- [CVE-2021-37274](https://cve.now/CVE-2021-37274.md): Kingdee KIS Professional Edition has a privilege escalation vulnerability. (no CVSS)
- [CVE-2020-24930](https://cve.now/CVE-2020-24930.md): Beijing Wuzhi Internet Technology Co., Ltd. (no CVSS)
- [CVE-2021-37270](https://cve.now/CVE-2021-37270.md): There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. (no CVSS)
- [CVE-2021-41098](https://cve.now/CVE-2021-41098.md): Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby (CVSS 7.5, sparklemotion nokogiri · nokogiri)
- [CVE-2021-41095](https://cve.now/CVE-2021-41095.md): XSS via blocked watched word in error message (CVSS 4.2, discourse)
- [CVE-2021-41096](https://cve.now/CVE-2021-41096.md): Use of a Broken or Risky Cryptographic Algorithm in com.mayank.rucky (CVSS 7.5, mayankmetha Rucky)
- [CVE-2021-41097](https://cve.now/CVE-2021-41097.md): Prototype pollution in aurelia-path (CVSS 9.1, aurelia path · aurelia-path)
- [CVE-2021-20035](https://cve.now/CVE-2021-20035.md): Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary co (CVSS 6.5, KEV, SonicWall SMA100)
- [CVE-2021-20034](https://cve.now/CVE-2021-20034.md): An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete a (no CVSS, SonicWall SMA100)
- [CVE-2021-41558](https://cve.now/CVE-2021-41558.md): The set\_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility\_hook bypass via set\_config. (no CVSS)
- [CVE-2021-23445](https://cve.now/CVE-2021-23445.md): Cross-site Scripting (XSS) (CVSS 3.1, datatables.net)
- [CVE-2021-37761](https://cve.now/CVE-2021-37761.md): Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote code execution. (no CVSS)
- [CVE-2021-41753](https://cve.now/CVE-2021-41753.md): A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remo (no CVSS)
- [CVE-2021-40329](https://cve.now/CVE-2021-40329.md): The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. (no CVSS, Ping Identity PingFederate)
- [CVE-2021-36134](https://cve.now/CVE-2021-36134.md): Out of bounds write in Netop Vision Pro (CVSS 7.4)
- [CVE-2021-40712](https://cve.now/CVE-2021-40712.md): Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS (CVSS 6.5, Adobe Experience Manager)
- [CVE-2021-40714](https://cve.now/CVE-2021-40714.md): Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter (CVSS 6.1, Adobe Experience Manager)
- [CVE-2021-40700](https://cve.now/CVE-2021-40700.md): Adobe Premiere Elements TIFF Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-40709](https://cve.now/CVE-2021-40709.md): Adobe Photoshop Buffer Overflow leads to Arbitrary Code Execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2021-40701](https://cve.now/CVE-2021-40701.md): Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-39828](https://cve.now/CVE-2021-39828.md): Adobe Digital Editions Installer flaw leads to Local Privilege Escalation (CVSS 5.8, Adobe Digital Editions)
- [CVE-2021-40703](https://cve.now/CVE-2021-40703.md): Adobe Premiere Elements m4a Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Not a product)
- [CVE-2021-39825](https://cve.now/CVE-2021-39825.md): Adobe Photoshop Elements Edit 2021 TTF Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop Elements)
- [CVE-2021-40713](https://cve.now/CVE-2021-40713.md): Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack (CVSS 5.9, Adobe Experience Manager)
- [CVE-2021-39827](https://cve.now/CVE-2021-39827.md): Adobe Digital Editions Installer flaw leads to Arbitrary File System Write (CVSS 6.5, Adobe Digital Editions)
- [CVE-2021-40702](https://cve.now/CVE-2021-40702.md): Adobe Premiere Elements psd Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-39824](https://cve.now/CVE-2021-39824.md): Adobe Premiere Elements png Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-40711](https://cve.now/CVE-2021-40711.md): Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code Execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2021-28613](https://cve.now/CVE-2021-28613.md): Adobe Creative Cloud Arbitrary File Overwrite Vulnerability (CVSS 7.4, Adobe Creative Cloud)
- [CVE-2021-39818](https://cve.now/CVE-2021-39818.md): Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe InCopy)
- [CVE-2021-39826](https://cve.now/CVE-2021-39826.md): Adobe Digital Editions Command Execution Vulnerability (CVSS 8.6, Adobe Digital Editions)
- [CVE-2021-39819](https://cve.now/CVE-2021-39819.md): Adobe InCopy Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution (CVSS 7.8, Adobe InCopy)
- [CVE-2021-39823](https://cve.now/CVE-2021-39823.md): svg-native-viewer Heap Buffer overflow Vulnerability (CVSS 7.8, Adobe SVG Native Viewer)
- [CVE-2021-36845](https://cve.now/CVE-2021-36845.md): YITH Maintenance Mode (WordPress plugin) \<= 1.3.8 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 6.9, YITH Maintenance Mode)
- [CVE-2021-36841](https://cve.now/CVE-2021-36841.md): YITH Maintenance Mode (WordPress plugin) \<= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability. (CVSS 6.9, YITH Maintenance Mode)
- [CVE-2021-36875](https://cve.now/CVE-2021-36875.md): WordPress uListing plugin \<= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 5.9, Stylemix Directory Listings WordPress plugin – uListing)
- [CVE-2021-36880](https://cve.now/CVE-2021-36880.md): WordPress uListing plugin \<= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability (CVSS 8.6, StylemixThemes uListing)
- [CVE-2021-36874](https://cve.now/CVE-2021-36874.md): WordPress uListing plugin \<= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1, StylemixThemes uListing)
- [CVE-2021-36877](https://cve.now/CVE-2021-36877.md): WordPress uListing plugin \<= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StylemixThemes uListing)
- [CVE-2021-36876](https://cve.now/CVE-2021-36876.md): WordPress uListing plugin \<= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4, StylemixThemes uListing)
- [CVE-2021-36879](https://cve.now/CVE-2021-36879.md): WordPress uListing plugin \<= 2.0.5 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8, StylemixThemes uListing)
- [CVE-2021-24671](https://cve.now/CVE-2021-24671.md): MX Time Zone Clocks \< 3.4.1 - Contributor+ Cross-Site Scripting (no CVSS, MX Time Zone Clocks)
- [CVE-2021-24670](https://cve.now/CVE-2021-24670.md): CoolClock \< 4.3.5 - Contributor+ Stored Cross-Site Scripting (no CVSS, CoolClock – a Javascript Analog Clock)
- [CVE-2021-24666](https://cve.now/CVE-2021-24666.md): Podlove Podcast Publisher \< 3.5.6 - Unauthenticated SQL Injection (no CVSS, Podlove Podcast Publisher)
- [CVE-2021-24661](https://cve.now/CVE-2021-24661.md): PostX Gutenberg Blocks Saved Templates Addon \< 2.4.10 - Private Content Disclosure (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24660](https://cve.now/CVE-2021-24660.md): PostX Gutenberg Blocks Saved Templates Addon \< 2.4.10 - Contributor+ Stored Cross-Site Scripting (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24659](https://cve.now/CVE-2021-24659.md): PostX Gutenberg Blocks for Post Grid \< 2.4.10 - Contributor+ Stored Cross-Site Scripting (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24652](https://cve.now/CVE-2021-24652.md): PostX Gutenberg Blocks for Post Grid \< 2.4.10 - Missing Access Controls (no CVSS, PostX – Gutenberg Blocks for Post Grid)
- [CVE-2021-24643](https://cve.now/CVE-2021-24643.md): WP Map Block \< 1.2.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, WP Map Block – Gutenberg Map Block for Google Map and OpenS…)
- [CVE-2021-24634](https://cve.now/CVE-2021-24634.md): Recipe Card Blocks \< 2.8.3 - Contributor+ Stored Cross-Site Scripting (no CVSS, Recipe Card Blocks by WPZOOM)
- [CVE-2021-24633](https://cve.now/CVE-2021-24633.md): Countdown Block \< 1.1.2 - Missing Authorisation in AJAX action (no CVSS, Countdown Block)
- [CVE-2021-24632](https://cve.now/CVE-2021-24632.md): Recipe Card Blocks \< 2.8.1 - Reflected Cross-Site Scripting (no CVSS, Recipe Card Blocks by WPZOOM)
- [CVE-2021-24610](https://cve.now/CVE-2021-24610.md): TranslatePress \< 2.0.9 - Authenticated Stored Cross-Site Scripting (no CVSS, Translate Multilingual sites – TranslatePress)
- [CVE-2021-24569](https://cve.now/CVE-2021-24569.md): Cookie Notice & Compliance for GDPR / CCPA \< 2.1.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Cookie Notice & Compliance for GDPR / CCPA)
- [CVE-2021-36878](https://cve.now/CVE-2021-36878.md): WordPress uListing plugin \<= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3, StylemixThemes uListing)
- [CVE-2021-37539](https://cve.now/CVE-2021-37539.md): Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. (no CVSS)
- [CVE-2021-26587](https://cve.now/CVE-2021-26587.md): A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. (no CVSS, HPE StoreOnce 3620; HPE StoreOnce 3640; HPE StoreOnce 5200;…)
- [CVE-2021-34413](https://cve.now/CVE-2021-34413.md): All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-use (TOC/TOU) vulnerab (no CVSS, Zoom Plugin for Microsoft Outlook for MacOS)
- [CVE-2021-34416](https://cve.now/CVE-2021-34416.md): The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325, Zoom on-pr (no CVSS, Zoom On-Premise Meeting Connector Controller, Zoom On-Premi…)
- [CVE-2021-34415](https://cve.now/CVE-2021-34415.md): The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not verify the cnt fiel (no CVSS, Zoom On-Premise Meeting Connector Controller)
- [CVE-2021-34414](https://cve.now/CVE-2021-34414.md): The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217, Zoom on-premi (no CVSS, Zoom on-premise Meeting Connector Controller, Zoom on-premi…)
- [CVE-2021-34412](https://cve.now/CVE-2021-34412.md): During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possible to launch Internet (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-34411](https://cve.now/CVE-2021-34411.md): During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to launch Internet Explore (no CVSS, Zoom Rooms for Conference Room for Windows)
- [CVE-2021-34410](https://cve.now/CVE-2021-34410.md): A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook for Mac before 5.0. (no CVSS, Zoom Plugin for Microsoft Outlook for Mac)
- [CVE-2021-34409](https://cve.now/CVE-2021-34409.md): Zoom Client Installer Local Privilege Escalation (CVSS 7.8, Zoom Video Communications Zoom Client for Meetings for M… +1)
- [CVE-2021-34408](https://cve.now/CVE-2021-34408.md): The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-33907](https://cve.now/CVE-2021-33907.md): The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate information used to sign .m (no CVSS, Zoom Client for Meetings for Windows)
- [CVE-2021-37786](https://cve.now/CVE-2021-37786.md): Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper handling of exception (no CVSS)
- [CVE-2021-22272](https://cve.now/CVE-2021-22272.md): ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase. (CVSS 6.5, mybuildings.abb.com · my.busch-jaeger.de)
- [CVE-2021-36218](https://cve.now/CVE-2021-36218.md): An issue was discovered in SKALE sgxwallet 1.58.3. (no CVSS)
- [CVE-2021-36219](https://cve.now/CVE-2021-36219.md): An issue was discovered in SKALE sgxwallet 1.58.3. (no CVSS)
- [CVE-2021-3828](https://cve.now/CVE-2021-3828.md): Inefficient Regular Expression Complexity in nltk/nltk (CVSS 7.5, nltk/nltk · nltk)
- [CVE-2021-3822](https://cve.now/CVE-2021-3822.md): Inefficient Regular Expression Complexity in josdejong/jsoneditor (CVSS 5.3, josdejong/jsoneditor · jsoneditor)
- [CVE-2021-3820](https://cve.now/CVE-2021-3820.md): Inefficient Regular Expression Complexity in pksunkara/inflect (CVSS 5.3, pksunkara/inflect · i)
- [CVE-2021-3819](https://cve.now/CVE-2021-3819.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 4.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3818](https://cve.now/CVE-2021-3818.md): Reliance on Cookies without Validation and Integrity Checking in getgrav/grav (CVSS 6.3, getgrav/grav)
- [CVE-2021-3799](https://cve.now/CVE-2021-3799.md): Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin (CVSS 5.4, getgrav/grav-plugin-admin)
- [CVE-2021-23243](https://cve.now/CVE-2021-23243.md): In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be used. (no CVSS, OPPO Android Phone with Qualcomm chipset)
- [CVE-2021-40109](https://cve.now/CVE-2021-40109.md): A SSRF issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40108](https://cve.now/CVE-2021-40108.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40106](https://cve.now/CVE-2021-40106.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40105](https://cve.now/CVE-2021-40105.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40104](https://cve.now/CVE-2021-40104.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-0660](https://cve.now/CVE-2021-0660.md): In ccu, there is a possible out of bounds read due to incorrect error handling. (no CVSS, MT6779, MT6853, MT6873, MT6885)
- [CVE-2021-0612](https://cve.now/CVE-2021-0612.md): In m4u, there is a possible memory corruption due to a use after free. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0611](https://cve.now/CVE-2021-0611.md): In m4u, there is a possible memory corruption due to a use after free. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0610](https://cve.now/CVE-2021-0610.md): In memory management driver, there is a possible memory corruption due to an integer overflow. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0425](https://cve.now/CVE-2021-0425.md): In memory management driver, there is a possible side channel information disclosure. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0424](https://cve.now/CVE-2021-0424.md): In memory management driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0423](https://cve.now/CVE-2021-0423.md): In memory management driver, there is a possible information disclosure due to uninitialized data. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0422](https://cve.now/CVE-2021-0422.md): In memory management driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-0421](https://cve.now/CVE-2021-0421.md): In memory management driver, there is a possible information disclosure due to a missing bounds check. (no CVSS, MT6580, MT6582E, MT6582H, MT6582T, MT6582W, MT6582\_90, MT65…)
- [CVE-2021-40103](https://cve.now/CVE-2021-40103.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40098](https://cve.now/CVE-2021-40098.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-40097](https://cve.now/CVE-2021-40097.md): An issue was discovered in Concrete CMS through 8.5.5. (no CVSS)
- [CVE-2021-23054](https://cve.now/CVE-2021-23054.md): On version 16.x before 16.1.0, 15.1.x before 15.1.4, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.x, and 11.6.x, a reflected cro (no CVSS, BIG-IP APM)
- [CVE-2021-20317](https://cve.now/CVE-2021-20317.md): A flaw was found in the Linux kernel. (no CVSS, kernel)
- [CVE-2021-34570](https://cve.now/CVE-2021-34570.md): Phoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTS (CVSS 7.5, Phoenix Contact AXC F · Phoenix Contact RFC +1)
- [CVE-2021-41580](https://cve.now/CVE-2021-41580.md): The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. (no CVSS, passport-oauth2)
- [CVE-2021-38299](https://cve.now/CVE-2021-38299.md): Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. (no CVSS, web-auth/webauthn-framework)
- [CVE-2021-41385](https://cve.now/CVE-2021-41385.md): The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295\_0302 allows an authenticated user to obtain access to server co (no CVSS)
- [CVE-2021-41329](https://cve.now/CVE-2021-41329.md): Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their vie (no CVSS)
- [CVE-2021-40981](https://cve.now/CVE-2021-40981.md): ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PRO (no CVSS)
- [CVE-2021-40349](https://cve.now/CVE-2021-40349.md): e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring. (no CVSS)
- [CVE-2021-31605](https://cve.now/CVE-2021-31605.md): furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. (no CVSS, openvpn-monitor)
- [CVE-2021-31604](https://cve.now/CVE-2021-31604.md): furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client. (no CVSS, openvpn-monitor)
- [CVE-2021-34351](https://cve.now/CVE-2021-34351.md): Command Injection Vulnerability in QVR (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-34349](https://cve.now/CVE-2021-34349.md): Command Injection Vulnerability in QVR (CVSS 7.2, QNAP Systems QVR)
- [CVE-2021-34348](https://cve.now/CVE-2021-34348.md): Command Injection Vulnerability in QVR (CVSS 9.8, QNAP Systems QVR)
- [CVE-2021-31606](https://cve.now/CVE-2021-31606.md): furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients. (no CVSS, openvpn-monitor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.