# CVEs published 2021-09-30

51 CVEs were published on September 30, 2021: 8 critical, 7 high. Days are UTC.

- [CVE-2020-20799](https://cve.now/CVE-2020-20799.md): JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via (no CVSS)
- [CVE-2020-20797](https://cve.now/CVE-2020-20797.md): FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php. (no CVSS)
- [CVE-2020-20796](https://cve.now/CVE-2020-20796.md): FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter. (no CVSS)
- [CVE-2020-20746](https://cve.now/CVE-2020-20746.md): A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60\_EN allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2021-41324](https://cve.now/CVE-2021-41324.md): Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal file (no CVSS)
- [CVE-2021-41101](https://cve.now/CVE-2021-41101.md): CORS \`Access-Control-Allow-Origin\` settings are too lenient (CVSS 5.7, wireapp wire-server)
- [CVE-2021-33583](https://cve.now/CVE-2021-33583.md): REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file. (no CVSS)
- [CVE-2021-41325](https://cve.now/CVE-2021-41325.md): Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile paramete (no CVSS)
- [CVE-2021-41323](https://cve.now/CVE-2021-41323.md): Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells fil (no CVSS)
- [CVE-2021-41288](https://cve.now/CVE-2021-41288.md): Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. (no CVSS)
- [CVE-2021-35199](https://cve.now/CVE-2021-35199.md): NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile. (no CVSS)
- [CVE-2021-35198](https://cve.now/CVE-2021-35198.md): NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module. (no CVSS)
- [CVE-2021-35205](https://cve.now/CVE-2021-35205.md): NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector. (no CVSS)
- [CVE-2021-35200](https://cve.now/CVE-2021-35200.md): NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService. (no CVSS)
- [CVE-2021-35201](https://cve.now/CVE-2021-35201.md): NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks. (no CVSS)
- [CVE-2021-35202](https://cve.now/CVE-2021-35202.md): NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService. (no CVSS)
- [CVE-2021-35203](https://cve.now/CVE-2021-35203.md): NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint. (no CVSS)
- [CVE-2021-35204](https://cve.now/CVE-2021-35204.md): NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint. (no CVSS)
- [CVE-2020-20665](https://cve.now/CVE-2020-20665.md): rudp v0.6 was discovered to contain a memory leak in the component main.c. (no CVSS)
- [CVE-2020-20664](https://cve.now/CVE-2020-20664.md): libiec\_iccp\_mod v1.5 contains a segmentation violation in the component server\_example1.c. (no CVSS)
- [CVE-2020-20663](https://cve.now/CVE-2020-20663.md): libiec\_iccp\_mod v1.5 contains a heap-buffer-overflow in the component mms\_client\_connection.c. (no CVSS)
- [CVE-2020-20662](https://cve.now/CVE-2020-20662.md): libiec\_iccp\_mod v1.5 contains a heap-buffer-overflow in the component mms\_client\_example1.c. (no CVSS)
- [CVE-2021-29894](https://cve.now/CVE-2021-29894.md): IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorithms that could allow (CVSS 5.9, IBM Cloud Pak for Security)
- [CVE-2021-20578](https://cve.now/CVE-2021-20578.md): IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized actions due to impr (CVSS 5.4, IBM Cloud Pak for Security)
- [CVE-2021-20554](https://cve.now/CVE-2021-20554.md): IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Sterling Order Management)
- [CVE-2021-24017](https://cve.now/CVE-2021-24017.md): An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign arbitrary Policy and (CVSS 5.4, Fortinet FortiManager)
- [CVE-2021-24016](https://cve.now/CVE-2021-24016.md): An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attack (CVSS 3.7, Fortinet FortiManager)
- [CVE-2021-41109](https://cve.now/CVE-2021-41109.md): LiveQuery publishes user session tokens (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2021-21089](https://cve.now/CVE-2021-21089.md): Adobe Acrobat Reader DC URI Parsing Out-Of-Bounds Read (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-41729](https://cve.now/CVE-2021-41729.md): BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the serve (no CVSS)
- [CVE-2021-41302](https://cve.now/CVE-2021-41302.md): ECOA BAS controller - Missing Encryption of Sensitive Data (CVSS 7.3, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41301](https://cve.now/CVE-2021-41301.md): ECOA BAS controller - Exposure of Sensitive Information to an Unauthorized Actor (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41300](https://cve.now/CVE-2021-41300.md): ECOA BAS controller - Insufficiently Protected Credentials-2 (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41299](https://cve.now/CVE-2021-41299.md): ECOA BAS controller - Use of Hard-coded Credentials (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41298](https://cve.now/CVE-2021-41298.md): ECOA BAS controller - Improper Access Control (CVSS 8.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41297](https://cve.now/CVE-2021-41297.md): ECOA BAS controller - Insufficiently Protected Credentials-1 (CVSS 8.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41296](https://cve.now/CVE-2021-41296.md): ECOA BAS controller - Weak Password Requirements (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41295](https://cve.now/CVE-2021-41295.md): ECOA BAS controller - Cross-Site Request Forgery (CSRF) (CVSS 8.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41294](https://cve.now/CVE-2021-41294.md): ECOA BAS controller - Path Traversal-4 (CVSS 9.1, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41293](https://cve.now/CVE-2021-41293.md): ECOA BAS controller - Path Traversal-3 (CVSS 7.5, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41292](https://cve.now/CVE-2021-41292.md): ECOA BAS controller - Broken Authentication (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41291](https://cve.now/CVE-2021-41291.md): ECOA BAS controller - Path Traversal-1 (CVSS 7.5, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41290](https://cve.now/CVE-2021-41290.md): ECOA BAS controller - Path Traversal-1 (CVSS 9.8, ECOA ECS Router Controller ECS · ECOA RiskBuster Termina… +5)
- [CVE-2021-41616](https://cve.now/CVE-2021-41616.md): Apache ddlutils 1.0 readobject vulnerability (CVSS 9.8, Apache Software Foundation Apache DB ddlutils · org.apache.…)
- [CVE-2021-25963](https://cve.now/CVE-2021-25963.md): Shuup - Reflected XSS in Error Page (CVSS 6.1, shuup)
- [CVE-2021-41827](https://cve.now/CVE-2021-41827.md): Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. (no CVSS)
- [CVE-2021-41828](https://cve.now/CVE-2021-41828.md): Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. (no CVSS)
- [CVE-2021-41829](https://cve.now/CVE-2021-41829.md): Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain encryption key. (no CVSS)
- [CVE-2020-18683](https://cve.now/CVE-2020-18683.md): Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined fields mishandling. (no CVSS)
- [CVE-2020-18685](https://cve.now/CVE-2020-18685.md): Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked prerequisites relat (no CVSS)
- [CVE-2020-18684](https://cve.now/CVE-2020-18684.md): Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port number. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-09-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.