# CVEs published 2021-09-28

51 CVEs were published on September 28, 2021: 0 critical, 7 high. Days are UTC.

- [CVE-2020-20125](https://cve.now/CVE-2020-20125.md): EARCLINK ESPCMS-P8 contains a cross-site scripting (XSS) vulnerability in espcms\_web\\espcms\_load.php. (no CVSS)
- [CVE-2020-20124](https://cve.now/CVE-2020-20124.md): Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \\attachment\\admin\\index.php. (no CVSS)
- [CVE-2020-20122](https://cve.now/CVE-2020-20122.md): Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php. (no CVSS)
- [CVE-2020-20120](https://cve.now/CVE-2020-20120.md): ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" (no CVSS, topthink/thinkphp)
- [CVE-2021-41106](https://cve.now/CVE-2021-41106.md): File reference keys leads to incorrect hashes on HMAC algorithms (CVSS 4.4, lcobucci jwt · lcobucci/jwt)
- [CVE-2021-36297](https://cve.now/CVE-2021-36297.md): SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll fil (CVSS 7.8, Dell SupportAssist Client Consumer)
- [CVE-2021-36286](https://cve.now/CVE-2021-36286.md): Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability tha (CVSS 7.1, Dell SupportAssist Client Consumer)
- [CVE-2021-36285](https://cve.now/CVE-2021-36285.md): Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. (CVSS 5.7, Dell CPG BIOS)
- [CVE-2021-36284](https://cve.now/CVE-2021-36284.md): Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. (CVSS 5.7, Dell CPG BIOS)
- [CVE-2021-36283](https://cve.now/CVE-2021-36283.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-21570](https://cve.now/CVE-2021-21570.md): Dell NetWorker, versions 18.x and 19.x contain an Information disclosure vulnerability. (CVSS 6.8, Dell NetWorker)
- [CVE-2021-21569](https://cve.now/CVE-2021-21569.md): Dell NetWorker, versions 18.x and 19.x contain a Path traversal vulnerability. (CVSS 6.8, Dell NetWorker)
- [CVE-2021-21522](https://cve.now/CVE-2021-21522.md): Dell BIOS contains a Credentials Management issue. (CVSS 8.2, Dell CPG BIOS)
- [CVE-2021-38303](https://cve.now/CVE-2021-38303.md): A SQL injection vulnerability exists in Sureline SUREedge Migrator 7.0.7.29360. (no CVSS)
- [CVE-2021-30086](https://cve.now/CVE-2021-30086.md): Cross Site Scripting (XSS) vulnerability exists in KindEditor (Chinese versions) 4.1.12, which can be exploited by an attacker to obtain use (no CVSS)
- [CVE-2021-37267](https://cve.now/CVE-2021-37267.md): Cross Site Scripting (XSS) vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie i (no CVSS)
- [CVE-2021-37271](https://cve.now/CVE-2021-37271.md): Cross Site Scripting (XSS) vulnerability exists in UEditor v1.4.3.3, which can be exploited by an attacker to obtain user cookie information (no CVSS)
- [CVE-2021-37273](https://cve.now/CVE-2021-37273.md): A Denial of Service issue exists in China Telecom Corporation EPON Tianyi Gateway ZXHN F450(EPON ONU) 3.0. (no CVSS)
- [CVE-2021-41318](https://cve.now/CVE-2021-41318.md): In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. (no CVSS)
- [CVE-2021-36366](https://cve.now/CVE-2021-36366.md): Nagios XI before 5.8.5 incorrectly allows manage\_services.sh wildcards. (no CVSS)
- [CVE-2021-36365](https://cve.now/CVE-2021-36365.md): Nagios XI before 5.8.5 has Incorrect Permission Assignment for repairmysql.sh. (no CVSS)
- [CVE-2021-36364](https://cve.now/CVE-2021-36364.md): Nagios XI before 5.8.5 incorrectly allows backup\_xi.sh wildcards. (no CVSS)
- [CVE-2021-36363](https://cve.now/CVE-2021-36363.md): Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php. (no CVSS)
- [CVE-2021-29367](https://cve.now/CVE-2021-29367.md): A buffer overflow vulnerability in WPG+0x1dda of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted WPG file. (no CVSS)
- [CVE-2021-29365](https://cve.now/CVE-2021-29365.md): Irfanview 4.57 is affected by an infinite loop when processing a crafted BMP file in the EFFECTS!AutoCrop\_W component. (no CVSS)
- [CVE-2021-29366](https://cve.now/CVE-2021-29366.md): A buffer overflow vulnerability in FORMATS!GetPlugInInfo+0x2de9 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted R (no CVSS)
- [CVE-2021-29364](https://cve.now/CVE-2021-29364.md): A buffer overflow vulnerability in Formats!ReadRAS\_W+0x1001 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE f (no CVSS)
- [CVE-2021-29363](https://cve.now/CVE-2021-29363.md): A buffer overflow vulnerability in FORMATS!ReadRAS\_W+0xa74 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE fi (no CVSS)
- [CVE-2021-29362](https://cve.now/CVE-2021-29362.md): A buffer overflow vulnerability in FORMATS!ReadRAS\_W+0xa30 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RLE fi (no CVSS)
- [CVE-2021-29361](https://cve.now/CVE-2021-29361.md): A buffer overflow vulnerability in FORMATS!Read\_Utah\_RLE+0x340 of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RL (no CVSS)
- [CVE-2021-29360](https://cve.now/CVE-2021-29360.md): A buffer overflow vulnerability in FORMATS!Read\_Utah\_RLE+0x37a of Irfanview 4.57 allows attackers to execute arbitrary code via a crafted RL (no CVSS)
- [CVE-2021-29358](https://cve.now/CVE-2021-29358.md): A buffer overflow vulnerability in FORMATS!ReadPVR\_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of service (DOS) via a crafte (no CVSS)
- [CVE-2021-41104](https://cve.now/CVE-2021-41104.md): web\_server allows OTA update without checking user defined basic auth username & password (CVSS 7.5, esphome)
- [CVE-2021-37105](https://cve.now/CVE-2021-37105.md): There is an improper file upload control vulnerability in FusionCompute 6.5.0, 6.5.1 and 8.0.0. (no CVSS, FusionCompute)
- [CVE-2021-37106](https://cve.now/CVE-2021-37106.md): There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0, 6.3.1, 6.5.0 and 8.0.0 when processing the default (no CVSS, FusionCompute)
- [CVE-2021-37104](https://cve.now/CVE-2021-37104.md): There is a server-side request forgery vulnerability in HUAWEI P40 versions 10.1.0.118(C00E116R3P3). (no CVSS, HUAWEI P40)
- [CVE-2021-38124](https://cve.now/CVE-2021-38124.md): Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting versions 7.0.2 through 7.5. (no CVSS, ArcSight Enterprise Security Manager (ESM).)
- [CVE-2021-22535](https://cve.now/CVE-2021-22535.md): Unauthorized information security disclosure vulnerability on Micro Focus Directory and Resource Administrator (DRA) product, affecting all (no CVSS, Directory and Resource Administrator)
- [CVE-2021-34636](https://cve.now/CVE-2021-34636.md): Countdown and CountUp, WooCommerce Sales Timer \<= 1.5.7 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, WpDevArt Countdown and CountUp, WooCommerce Sales Timers)
- [CVE-2021-37146](https://cve.now/CVE-2021-37146.md): An infinite loop in Open Robotics ros\_comm XMLRPC server in ROS Melodic through 1.4.11 and ROS Noetic through1.15.11 allows remote attackers (no CVSS)
- [CVE-2021-41539](https://cve.now/CVE-2021-41539.md): A vulnerability has been identified in Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-41540](https://cve.now/CVE-2021-41540.md): A vulnerability has been identified in Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-41538](https://cve.now/CVE-2021-41538.md): A vulnerability has been identified in NX 1953 Series (All versions \< V1973.3700), NX 1980 Series (All versions \< V1988), Solid Edge SE2021 (no CVSS, Siemens NX 1953 Series · Siemens NX 1980 Series +1)
- [CVE-2021-41537](https://cve.now/CVE-2021-41537.md): A vulnerability has been identified in Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-41536](https://cve.now/CVE-2021-41536.md): A vulnerability has been identified in Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens Solid Edge SE2021)
- [CVE-2021-41535](https://cve.now/CVE-2021-41535.md): A vulnerability has been identified in NX 1953 Series (All versions \< V1973.3700), NX 1980 Series (All versions \< V1988), Solid Edge SE2021 (no CVSS, Siemens NX 1953 Series · Siemens NX 1980 Series +1)
- [CVE-2021-41534](https://cve.now/CVE-2021-41534.md): A vulnerability has been identified in NX 1980 Series (All versions \< V1984), Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens NX 1980 Series · Siemens Solid Edge SE2021)
- [CVE-2021-41533](https://cve.now/CVE-2021-41533.md): A vulnerability has been identified in NX 1980 Series (All versions \< V1984), Solid Edge SE2021 (All versions \< SE2021MP8). (no CVSS, Siemens NX 1980 Series · Siemens Solid Edge SE2021)
- [CVE-2021-36165](https://cve.now/CVE-2021-36165.md): RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and passw (no CVSS)
- [CVE-2021-33601](https://cve.now/CVE-2021-33601.md): Arbitrary Code Execution in Web Interface of F-Secure Internet Gatekeeper (CVSS 7.6, F-Secure Internet Gatekeeper)
- [CVE-2021-33600](https://cve.now/CVE-2021-33600.md): Denial of Service Vulnerability in Web Interface of F-Secure Internet Gatekeeper (CVSS 5.4, F-Secure Internet Gatekeeper)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.