# CVEs published 2021-09-29

74 CVEs were published on September 29, 2021: 1 critical, 28 high. Days are UTC.

- [CVE-2021-41826](https://cve.now/CVE-2021-41826.md): PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions\_controller.rb open redirect. (no CVSS)
- [CVE-2021-41824](https://cve.now/CVE-2021-41824.md): Craft CMS before 3.7.14 allows CSV injection. (no CVSS, craftcms/cms)
- [CVE-2021-41821](https://cve.now/CVE-2021-41821.md): Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial of service. (no CVSS)
- [CVE-2020-20781](https://cve.now/CVE-2020-20781.md): A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list\_edit of UCMS 1.4.7 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2021-41034](https://cve.now/CVE-2021-41034.md): The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoint. (no CVSS, The Eclipse Foundation Eclipse Che)
- [CVE-2020-20131](https://cve.now/CVE-2020-20131.md): LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows atackers to execute arbitrary web scripts or HTML via (no CVSS)
- [CVE-2020-20129](https://cve.now/CVE-2020-20129.md): LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi (no CVSS, wanglelecc/laracms)
- [CVE-2020-20128](https://cve.now/CVE-2020-20128.md): LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers. (no CVSS)
- [CVE-2021-41795](https://cve.now/CVE-2021-41795.md): The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization bypass. (no CVSS)
- [CVE-2021-3653](https://cve.now/CVE-2021-3653.md): A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. (no CVSS, kernel)
- [CVE-2021-39342](https://cve.now/CVE-2021-39342.md): Credova\_Financial \<= 1.4.8 Sensitive Information Disclosure (CVSS 5.3, Credova Financial Credova\_Financial)
- [CVE-2020-12030](https://cve.now/CVE-2020-12030.md): Emerson WirelessHART Gateway (CVSS 10.0, Emerson Wireless 1410 Gateway · Emerson Wireless 1420 Ga… +1)
- [CVE-2021-35944](https://cve.now/CVE-2021-35944.md): Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. (no CVSS)
- [CVE-2021-35943](https://cve.now/CVE-2021-35943.md): Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. (no CVSS)
- [CVE-2021-35945](https://cve.now/CVE-2021-35945.md): Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. (no CVSS)
- [CVE-2021-41764](https://cve.now/CVE-2021-41764.md): A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. (no CVSS)
- [CVE-2021-41732](https://cve.now/CVE-2021-41732.md): An issue was discovered in zeek version 4.1.0. (CVSS 8.2)
- [CVE-2021-41573](https://cve.now/CVE-2021-41573.md): Hitachi Content Platform Anywhere (HCP-AW) 4.4.5 and later allows information disclosure. (CVSS 7.5)
- [CVE-2021-23446](https://cve.now/CVE-2021-23446.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, handsontable)
- [CVE-2021-29834](https://cve.now/CVE-2021-29834.md): IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3,20.0.0.1, 20.0.0.2, and 21.0.2 and IBM Business (CVSS 6.4, IBM Business Automation Workflow · IBM Business Process Man…)
- [CVE-2021-28547](https://cve.now/CVE-2021-28547.md): Adobe Creative Cloud for macOS Privilege Escalation Vulnerability (CVSS 7.8, Adobe Creative Cloud)
- [CVE-2021-40716](https://cve.now/CVE-2021-40716.md): XMP Toolkit SDK SVG\_Adapter Out-of-bounds Read Information Disclosure (CVSS 5.5, Adobe XMP Toolkit)
- [CVE-2021-40710](https://cve.now/CVE-2021-40710.md): Adobe Premiere Pro 2021 SVG File Parsing Leads to Memory Corruption (CVSS 7.8, Adobe Premiere)
- [CVE-2021-40697](https://cve.now/CVE-2021-40697.md): Adobe FrameMaker PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe FrameMaker)
- [CVE-2021-39863](https://cve.now/CVE-2021-39863.md): Adobe Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-40715](https://cve.now/CVE-2021-40715.md): Adobe Premiere Pro 2021 EXR File Parsing Leads to Memory Corruption (CVSS 7.8, Adobe Premiere)
- [CVE-2021-39862](https://cve.now/CVE-2021-39862.md): Adobe FrameMaker PostScript File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe FrameMaker)
- [CVE-2021-40708](https://cve.now/CVE-2021-40708.md): Adobe Genuine Service Installer Privilege Escalation Vulnerability (CVSS 7.3, Adobe GoCart)
- [CVE-2021-39865](https://cve.now/CVE-2021-39865.md): Adobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe FrameMaker)
- [CVE-2021-39858](https://cve.now/CVE-2021-39858.md): Adobe Acrobat Pro DC PostScript File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-39861](https://cve.now/CVE-2021-39861.md): Adobe Acrobat Reader DC Catalog Plugin Out-of-Bounds Read Bug (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39856](https://cve.now/CVE-2021-39856.md): Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via LoadFile (CVSS 6.5, Adobe Acrobat Reader)
- [CVE-2021-39860](https://cve.now/CVE-2021-39860.md): Adobe Acrobat Reader DC Search Plugin Null Pointer Dereference (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39854](https://cve.now/CVE-2021-39854.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39855](https://cve.now/CVE-2021-39855.md): Adobe Acrobat Reader DC NTLMv2 SSO Information Disclosure via src Parameter (CVSS 6.5, Adobe Acrobat Reader)
- [CVE-2021-39849](https://cve.now/CVE-2021-39849.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39857](https://cve.now/CVE-2021-39857.md): Adobe Acrobat Reader DC Information Disclosure via ActiveX LoadFile (CVSS 4.3, Adobe Acrobat Reader)
- [CVE-2021-39850](https://cve.now/CVE-2021-39850.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39852](https://cve.now/CVE-2021-39852.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39846](https://cve.now/CVE-2021-39846.md): Adobe Acrobat Reader /Parent Property Recursive Stack Overflow (CVSS 6.1, Adobe Acrobat Reader)
- [CVE-2021-39851](https://cve.now/CVE-2021-39851.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39853](https://cve.now/CVE-2021-39853.md): Adobe Acrobat Reader DC Null Pointer Dereference Could Lead To Application Denial-of-Service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-39845](https://cve.now/CVE-2021-39845.md): Adobe Acrobat Reader Page Tree Node Recursive Stack Overflow (CVSS 6.1, Adobe Acrobat Reader)
- [CVE-2021-39844](https://cve.now/CVE-2021-39844.md): Adobe Acrobat Reader CalRGB Out-of-Bounds Read Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-39843](https://cve.now/CVE-2021-39843.md): Adobe Acrobat Reader XObject Out-of-Bound Write Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39842](https://cve.now/CVE-2021-39842.md): Adobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39841](https://cve.now/CVE-2021-39841.md): Adobe Acrobat Pro DC DocMedia Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39840](https://cve.now/CVE-2021-39840.md): Adobe Acrobat Reader DC AcroForm Field Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39838](https://cve.now/CVE-2021-39838.md): Adobe Acrobat Reader DC AcroForm buttonGetCaption Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39839](https://cve.now/CVE-2021-39839.md): Adobe Acrobat Reader DC AcroForm getItemAt Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39837](https://cve.now/CVE-2021-39837.md): Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39835](https://cve.now/CVE-2021-39835.md): Adobe FrameMaker PDF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 4.3, Adobe FrameMaker)
- [CVE-2021-39836](https://cve.now/CVE-2021-39836.md): Adobe Acrobat Reader DC AcroForm buttonGetIcon Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-39829](https://cve.now/CVE-2021-39829.md): Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2021-39832](https://cve.now/CVE-2021-39832.md): Adobe FrameMaker PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2021-39834](https://cve.now/CVE-2021-39834.md): Adobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe FrameMaker)
- [CVE-2021-39830](https://cve.now/CVE-2021-39830.md): Adobe FrameMaker PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2021-39833](https://cve.now/CVE-2021-39833.md): Adobe FrameMaker TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe FrameMaker)
- [CVE-2021-39831](https://cve.now/CVE-2021-39831.md): Adobe FrameMaker PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe FrameMaker)
- [CVE-2021-39821](https://cve.now/CVE-2021-39821.md): Adobe InDesign TIF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2021-35982](https://cve.now/CVE-2021-35982.md): Adobe Reader DC Windows Installer Uncontrolled Search Path element could lead to Arbitrary Code Execution (CVSS 7.3, Adobe Acrobat Reader)
- [CVE-2021-25960](https://cve.now/CVE-2021-25960.md): SuiteCRM - CSV Injection in Accounts Module (CVSS 8.0, salesagility SuiteCRM)
- [CVE-2021-25962](https://cve.now/CVE-2021-25962.md): Shuup - Formula Injection in Checkout Addresses (CVSS 8.0, shuup)
- [CVE-2021-25959](https://cve.now/CVE-2021-25959.md): OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality (CVSS 6.1, org.opencrx opencrx-core-config · org.opencrx:opencrx-co… +4)
- [CVE-2021-25961](https://cve.now/CVE-2021-25961.md): SuiteCRM - Account Takeover in Password Reset Functionality (CVSS 8.0, salesagility SuiteCRM)
- [CVE-2021-40651](https://cve.now/CVE-2021-40651.md): OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arb (no CVSS)
- [CVE-2021-35028](https://cve.now/CVE-2021-35028.md): A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to ex (CVSS 7.3, Zyxel ZyWALL VPN2S Firmware)
- [CVE-2021-35027](https://cve.now/CVE-2021-35027.md): A directory traversal vulnerability in the web server of the Zyxel VPN2S firmware version 1.12 could allow a remote attacker to gain access (CVSS 7.5, Zyxel ZyWALL VPN2S Firmware)
- [CVE-2021-36745](https://cve.now/CVE-2021-36745.md): A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers (no CVSS, Trend Micro ServerProtect for Storage · Trend Micro Serv… +2)
- [CVE-2021-32466](https://cve.now/CVE-2021-32466.md): An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below (no CVSS, Trend Micro HouseCall for Home Networks)
- [CVE-2021-33924](https://cve.now/CVE-2021-33924.md): Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 and 6.0.0 is vulnerable to Incorrect Access Control via its auxiliary component t (no CVSS)
- [CVE-2021-33923](https://cve.now/CVE-2021-33923.md): Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0, 5.5.1, 5.5.2 and 6.0.0 allows local attackers to access some sensitive informa (no CVSS)
- [CVE-2021-22946](https://cve.now/CVE-2021-22946.md): A user can tell curl \>= 7.20.0 and \<= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (\`--ssl-req (CVSS 7.5, https://github.com/curl/curl)
- [CVE-2021-22947](https://cve.now/CVE-2021-22947.md): When curl \>= 7.20.0 and \<= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server (CVSS 5.9, https://github.com/curl/curl)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.