# CVEs published 2021-10-01

70 CVEs were published on October 1, 2021: 2 critical, 10 high. Days are UTC.

- [CVE-2021-41864](https://cve.now/CVE-2021-41864.md): prealloc\_elems\_and\_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multipl (no CVSS)
- [CVE-2021-41862](https://cve.now/CVE-2021-41862.md): AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL). (no CVSS, com.googlecode.aviator:aviator)
- [CVE-2021-38107](https://cve.now/CVE-2021-38107.md): CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38109](https://cve.now/CVE-2021-38109.md): Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38108](https://cve.now/CVE-2021-38108.md): Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38105](https://cve.now/CVE-2021-38105.md): IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38110](https://cve.now/CVE-2021-38110.md): Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38102](https://cve.now/CVE-2021-38102.md): IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38106](https://cve.now/CVE-2021-38106.md): UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38100](https://cve.now/CVE-2021-38100.md): Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38098](https://cve.now/CVE-2021-38098.md): Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38101](https://cve.now/CVE-2021-38101.md): CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-41847](https://cve.now/CVE-2021-41847.md): An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. (no CVSS)
- [CVE-2020-21228](https://cve.now/CVE-2020-21228.md): JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitraril (no CVSS)
- [CVE-2021-36309](https://cve.now/CVE-2021-36309.md): Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. (CVSS 7.1, Dell Enterprise SONiC OS)
- [CVE-2021-36298](https://cve.now/CVE-2021-36298.md): Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. (CVSS 8.1, Dell Isilon InsightIQ)
- [CVE-2020-21014](https://cve.now/CVE-2020-21014.md): emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php. (no CVSS)
- [CVE-2020-21013](https://cve.now/CVE-2020-21013.md): emlog v6.0.0 contains a SQL injection via /admin/comment.php. (no CVSS)
- [CVE-2020-21012](https://cve.now/CVE-2020-21012.md): Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execut (no CVSS)
- [CVE-2021-41845](https://cve.now/CVE-2021-41845.md): A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. (no CVSS)
- [CVE-2021-38103](https://cve.now/CVE-2021-38103.md): IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38104](https://cve.now/CVE-2021-38104.md): IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38099](https://cve.now/CVE-2021-38099.md): CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38096](https://cve.now/CVE-2021-38096.md): Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-38097](https://cve.now/CVE-2021-38097.md): Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. (no CVSS)
- [CVE-2021-41467](https://cve.now/CVE-2021-41467.md): Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inj (no CVSS, hjue/justwriting)
- [CVE-2021-41464](https://cve.now/CVE-2021-41464.md): Cross-site scripting (XSS) vulnerability in concrete/elements/collection\_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke (no CVSS)
- [CVE-2021-41465](https://cve.now/CVE-2021-41465.md): Cross-site scripting (XSS) vulnerability in concrete/elements/collection\_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attac (no CVSS)
- [CVE-2021-41462](https://cve.now/CVE-2021-41462.md): Cross-site scripting (XSS) vulnerability in concrete/elements/collection\_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke (no CVSS)
- [CVE-2021-41463](https://cve.now/CVE-2021-41463.md): Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group\_combination.php in concrete5-legacy 5.6.4.0 a (no CVSS)
- [CVE-2021-41461](https://cve.now/CVE-2021-41461.md): Cross-site scripting (XSS) vulnerability in concrete/elements/collection\_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke (no CVSS)
- [CVE-2021-40973](https://cve.now/CVE-2021-40973.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40975](https://cve.now/CVE-2021-40975.md): Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codei (no CVSS)
- [CVE-2021-40971](https://cve.now/CVE-2021-40971.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40972](https://cve.now/CVE-2021-40972.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40969](https://cve.now/CVE-2021-40969.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40970](https://cve.now/CVE-2021-40970.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40928](https://cve.now/CVE-2021-40928.md): Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web scr (no CVSS)
- [CVE-2021-40968](https://cve.now/CVE-2021-40968.md): Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject (no CVSS)
- [CVE-2021-40926](https://cve.now/CVE-2021-40926.md): Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary (no CVSS, james-heinrich/getid3)
- [CVE-2021-40927](https://cve.now/CVE-2021-40927.md): Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2021-40924](https://cve.now/CVE-2021-40924.md): Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2021-40925](https://cve.now/CVE-2021-40925.md): Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject a (no CVSS)
- [CVE-2021-40923](https://cve.now/CVE-2021-40923.md): Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2021-40922](https://cve.now/CVE-2021-40922.md): Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web (no CVSS)
- [CVE-2021-40921](https://cve.now/CVE-2021-40921.md): Cross-site scripting (XSS) vulnerability in \_contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbit (no CVSS)
- [CVE-2021-29110](https://cve.now/CVE-2021-29110.md): Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. (CVSS 5.4, Esri Portal for ArcGIS)
- [CVE-2021-29109](https://cve.now/CVE-2021-29109.md): A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9. (CVSS 6.1, Esri Portal for ArcGIS)
- [CVE-2021-29108](https://cve.now/CVE-2021-29108.md): There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below. (CVSS 8.8, Esri Portal for ArcGIS)
- [CVE-2021-3825](https://cve.now/CVE-2021-3825.md): Missing Authorization Checks in LiderAhenk (CVSS 9.6, TUBITAK Lider)
- [CVE-2021-41647](https://cve.now/CVE-2021-41647.md): An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. (no CVSS)
- [CVE-2021-41648](https://cve.now/CVE-2021-41648.md): An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. (no CVSS)
- [CVE-2021-41649](https://cve.now/CVE-2021-41649.md): An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat\_id parameter. (no CVSS)
- [CVE-2021-40960](https://cve.now/CVE-2021-40960.md): Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. (no CVSS)
- [CVE-2021-35297](https://cve.now/CVE-2021-35297.md): Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overfl (no CVSS)
- [CVE-2021-41110](https://cve.now/CVE-2021-41110.md): CWL Viewer: deserialization of untrusted data can lead to complete takeover by an attacker (CVSS 9.1, common-workflow-language cwlviewer)
- [CVE-2021-23893](https://cve.now/CVE-2021-23893.md): Privilege Escalation vulnerability in McAfee Drive Encryption (MDE) (CVSS 8.8, McAfee Drive Encryption)
- [CVE-2021-38675](https://cve.now/CVE-2021-38675.md): Stored XSS Vulnerability in Image2PDF (CVSS 5.4, QNAP Systems Image2PDF)
- [CVE-2021-34356](https://cve.now/CVE-2021-34356.md): Stored XSS Vulnerability in Photo Station (CVSS 7.6, QNAP Systems Photo Station)
- [CVE-2021-34355](https://cve.now/CVE-2021-34355.md): Stored XSS Vulnerability in Photo Station (CVSS 7.6, QNAP Systems Photo Station)
- [CVE-2021-34354](https://cve.now/CVE-2021-34354.md): Stored Cross-site Scripting Vulnerability in Photo Station (CVSS 7.6, QNAP Systems Photo Station)
- [CVE-2021-34352](https://cve.now/CVE-2021-34352.md): Command Injection Vulnerability in QVR (CVSS 7.2, QNAP Systems QVR)
- [CVE-2021-3747](https://cve.now/CVE-2021-3747.md): MacOS version of Multipass incorrect owner for application directory (CVSS 8.8, Canonical Multipass)
- [CVE-2021-3710](https://cve.now/CVE-2021-3710.md): Apport info disclosure via path traversal bug in read\_file (CVSS 6.5, Canonical apport)
- [CVE-2021-3709](https://cve.now/CVE-2021-3709.md): Apport file permission bypass through emacs byte compilation errors (CVSS 6.5, Canonical apport)
- [CVE-2021-3626](https://cve.now/CVE-2021-3626.md): Windows version of Multipass unauthenticated localhost tcp control socket can perform mounts (CVSS 8.8, Canonical Multipass)
- [CVE-2021-33626](https://cve.now/CVE-2021-33626.md): A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate th (no CVSS)
- [CVE-2021-41456](https://cve.now/CVE-2021-41456.md): There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx\_nhml.c:1004 in the nhmldmx\_send\_sample() function szXmlTo parameter whi (no CVSS)
- [CVE-2021-41457](https://cve.now/CVE-2021-41457.md): There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx\_nhml.c in nhmldmx\_init\_parsing which leads to a denial of service vulner (no CVSS)
- [CVE-2021-41459](https://cve.now/CVE-2021-41459.md): There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx\_nhml.c:1008 in the nhmldmx\_send\_sample() function szXmlFrom parameter w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.