# CVEs published 2021-10-12

72 CVEs were published on October 12, 2021: 6 critical, 8 high. Days are UTC.

- [CVE-2021-20031](https://cve.now/CVE-2021-20031.md): A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary w (no CVSS, SonicWall SonicOS)
- [CVE-2021-3330](https://cve.now/CVE-2021-3330.md): RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr (CVSS 7.1, zephyrproject-rtos zephyr)
- [CVE-2021-3323](https://cve.now/CVE-2021-3323.md): Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr (CVSS 8.3, zephyrproject-rtos zephyr)
- [CVE-2021-3322](https://cve.now/CVE-2021-3322.md): Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyr (CVSS 6.5, zephyrproject-rtos zephyr)
- [CVE-2021-3321](https://cve.now/CVE-2021-3321.md): Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removal (CVSS 7.5, zephyrproject-rtos zephyr)
- [CVE-2020-22673](https://cve.now/CVE-2020-22673.md): Memory leak in the senc\_Parse function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input. (no CVSS)
- [CVE-2020-22674](https://cve.now/CVE-2020-22674.md): An issue was discovered in gpac 0.8.0. (no CVSS)
- [CVE-2020-22675](https://cve.now/CVE-2020-22675.md): An issue was discovered in gpac 0.8.0. (no CVSS)
- [CVE-2020-22677](https://cve.now/CVE-2020-22677.md): An issue was discovered in gpac 0.8.0. (no CVSS)
- [CVE-2020-22678](https://cve.now/CVE-2020-22678.md): An issue was discovered in gpac 0.8.0. (no CVSS)
- [CVE-2020-22679](https://cve.now/CVE-2020-22679.md): Memory leak in the sgpd\_parse\_entry function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input (no CVSS)
- [CVE-2021-39184](https://cve.now/CVE-2021-39184.md): Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API (CVSS 6.8, electron)
- [CVE-2021-42325](https://cve.now/CVE-2021-42325.md): Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. (no CVSS, froxlor/froxlor)
- [CVE-2021-38915](https://cve.now/CVE-2021-38915.md): IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. (CVSS 5.3, IBM Data Risk Manager)
- [CVE-2021-38862](https://cve.now/CVE-2021-38862.md): IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti (CVSS 5.9, IBM Data Risk Manager)
- [CVE-2021-29645](https://cve.now/CVE-2021-29645.md): Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading (CVSS 7.0)
- [CVE-2021-29644](https://cve.now/CVE-2021-29644.md): Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. (CVSS 8.1)
- [CVE-2021-42326](https://cve.now/CVE-2021-42326.md): Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter. (no CVSS)
- [CVE-2021-27003](https://cve.now/CVE-2021-27003.md): Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a cli (no CVSS, Clustered Data ONTAP)
- [CVE-2021-40618](https://cve.now/CVE-2021-40618.md): An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR\_CONT\_USRN, 2) ADDR\_CONT\_PSWD, 3) SECN\_CONT\_USRN or 4) SECN\_CONT (no CVSS)
- [CVE-2021-35496](https://cve.now/CVE-2021-35496.md): TIBCO JasperReports XML Eternal Entity (XXE) vulnerability (CVSS 7.5, TIBCO Software TIBCO JasperReports Server)
- [CVE-2021-35495](https://cve.now/CVE-2021-35495.md): TIBCO JasperReports FTP Password exposed (CVSS 9.0, TIBCO Software TIBCO JasperReports Server)
- [CVE-2021-35494](https://cve.now/CVE-2021-35494.md): TIBCO JasperReports unauthorized access to temporary object (CVSS 5.7, TIBCO Software TIBCO JasperReports Server)
- [CVE-2021-40292](https://cve.now/CVE-2021-40292.md): A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter. (no CVSS)
- [CVE-2021-41136](https://cve.now/CVE-2021-41136.md): Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in puma (CVSS 3.7, puma)
- [CVE-2021-35214](https://cve.now/CVE-2021-35214.md): Session Management Vulnerability (CVSS 4.8, SolarWinds Pingdom)
- [CVE-2021-37734](https://cve.now/CVE-2021-37734.md): A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Ar (no CVSS, HPE Aruba Instant)
- [CVE-2021-37735](https://cve.now/CVE-2021-37735.md): A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba Instan (no CVSS, HPE Aruba Instant)
- [CVE-2021-37732](https://cve.now/CVE-2021-37732.md): A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2. (no CVSS, HPE Aruba Instant)
- [CVE-2021-37727](https://cve.now/CVE-2021-37727.md): A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below (no CVSS, HPE Aruba Instant)
- [CVE-2021-37730](https://cve.now/CVE-2021-37730.md): A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2. (no CVSS, HPE Aruba Instant)
- [CVE-2021-37726](https://cve.now/CVE-2021-37726.md): A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2. (no CVSS, HPE Aruba Instant)
- [CVE-2021-40500](https://cve.now/CVE-2021-40500.md): SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit miss (no CVSS, SAP SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2021-40498](https://cve.now/CVE-2021-40498.md): A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attacke (no CVSS, SAP SE SAP SuccessFactors Mobile Application)
- [CVE-2021-38183](https://cve.now/CVE-2021-38183.md): SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential (no CVSS, SAP SE SAP NetWeaver)
- [CVE-2021-40499](https://cve.now/CVE-2021-40499.md): Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, (no CVSS, SAP SE SAP NetWeaver Application Server for ABAP)
- [CVE-2021-40496](https://cve.now/CVE-2021-40496.md): SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attack (no CVSS, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-38180](https://cve.now/CVE-2021-38180.md): SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitati (no CVSS, SAP SE SAP Business One)
- [CVE-2021-38178](https://cve.now/CVE-2021-38178.md): The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 7 (no CVSS, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-40497](https://cve.now/CVE-2021-40497.md): SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read sen (no CVSS, SAP SE SAP BusinessObjects Analysis,)
- [CVE-2021-40495](https://cve.now/CVE-2021-40495.md): There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751 (no CVSS, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-38181](https://cve.now/CVE-2021-38181.md): SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to pr (no CVSS, SAP SE SAP NetWeaver AS ABAP and ABAP Platform)
- [CVE-2021-38179](https://cve.now/CVE-2021-38179.md): Debug function of Admin UI of SAP Business One Integration is enabled by default. (no CVSS, SAP SE SAP Business One)
- [CVE-2021-38460](https://cve.now/CVE-2021-38460.md): Moxa MXview Network Management Software (CVSS 7.5, Moxa MXview Network Management Software)
- [CVE-2021-38458](https://cve.now/CVE-2021-38458.md): Moxa MXview Network Management Software (CVSS 9.8, Moxa MXview Network Management Software)
- [CVE-2021-38454](https://cve.now/CVE-2021-38454.md): Moxa MXview Network Management Software (CVSS 10.0, Moxa MXview Network Management Software)
- [CVE-2021-38456](https://cve.now/CVE-2021-38456.md): Moxa MXview Network Management Software (CVSS 9.8, Moxa MXview Network Management Software)
- [CVE-2021-38452](https://cve.now/CVE-2021-38452.md): Moxa MXview Network Management Software (CVSS 7.5, Moxa MXview Network Management Software)
- [CVE-2021-21941](https://cve.now/CVE-2021-21941.md): A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h. (CVSS 10.0, Anker)
- [CVE-2021-21940](https://cve.now/CVE-2021-21940.md): A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h. (CVSS 10.0, Anker)
- [CVE-2021-25634](https://cve.now/CVE-2021-25634.md): Timestamp Manipulation with Signature Wrapping (no CVSS, The Document Foundation LibreOffice)
- [CVE-2020-28145](https://cve.now/CVE-2020-28145.md): Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\\app\\attachment\\admin\\index.php, which allows attacker (no CVSS)
- [CVE-2021-41546](https://cve.now/CVE-2021-41546.md): A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions \< V2.14.1), RUGGEDCOM ROX RX1400 (All versions \< V2.14.1), RUGGEDC (no CVSS, Siemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8)
- [CVE-2021-37199](https://cve.now/CVE-2021-37199.md): A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions \< V4.95). (no CVSS, Siemens SINUMERIK)
- [CVE-2021-33736](https://cve.now/CVE-2021-33736.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33734](https://cve.now/CVE-2021-33734.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33735](https://cve.now/CVE-2021-33735.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33733](https://cve.now/CVE-2021-33733.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33732](https://cve.now/CVE-2021-33732.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33731](https://cve.now/CVE-2021-33731.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33730](https://cve.now/CVE-2021-33730.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33729](https://cve.now/CVE-2021-33729.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33728](https://cve.now/CVE-2021-33728.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33726](https://cve.now/CVE-2021-33726.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33727](https://cve.now/CVE-2021-33727.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33725](https://cve.now/CVE-2021-33725.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33724](https://cve.now/CVE-2021-33724.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33723](https://cve.now/CVE-2021-33723.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-33722](https://cve.now/CVE-2021-33722.md): A vulnerability has been identified in SINEC NMS (All versions \< V1.0 SP2 Update 1). (no CVSS, Siemens SINEC NMS)
- [CVE-2021-27395](https://cve.now/CVE-2021-27395.md): A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versio (no CVSS, Siemens SIMATIC Process Historian 2013 and earlier · Siemen…)
- [CVE-2021-42009](https://cve.now/CVE-2021-42009.md): Apache Traffic Control Traffic Ops Email Injection Vulnerability (no CVSS, Apache Software Foundation Apache Traffic Control · github.…)
- [CVE-2021-3671](https://cve.now/CVE-2021-3671.md): A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request). (no CVSS, Samba)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.