# CVEs published 2021-10-15

59 CVEs were published on October 15, 2021: 4 critical, 11 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2018-16061](https://cve.now/CVE-2018-16061.md): Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2018-16060](https://cve.now/CVE-2018-16060.md): Mitsubishi Electric Europe B.V. (no CVSS)
- [CVE-2021-27561](https://cve.now/CVE-2021-27561.md): Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticati (CVSS 9.8, KEV)
- [CVE-2021-29745](https://cve.now/CVE-2021-29745.md): IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to priviledge escalation where a lower evel user could have access to the 'New Job' pag (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2021-29679](https://cve.now/CVE-2021-29679.md): IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-cont (CVSS 8.8, IBM Cognos Analytics)
- [CVE-2020-4951](https://cve.now/CVE-2020-4951.md): IBM Cognos Analytics 11.1.7 and 11.2.0 contains locally cached browser data, that could allow a local attacker to obtain sensitive informati (CVSS 4.0, IBM Cognos Analytics)
- [CVE-2021-41320](https://cve.now/CVE-2021-41320.md): A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authentica (CVSS 5.5)
- [CVE-2021-40721](https://cve.now/CVE-2021-40721.md): Adobe Connect Reflected Cross Site Scripting (CVSS 6.1, Adobe Connect)
- [CVE-2021-40731](https://cve.now/CVE-2021-40731.md): Adobe Acrobat Reader DC JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-40728](https://cve.now/CVE-2021-40728.md): Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-40724](https://cve.now/CVE-2021-40724.md): Adobe Acrobat Reader Android Abritrary Code Execution Vulnerability (CVSS 7.8, Adobe Reader Mobile)
- [CVE-2021-40720](https://cve.now/CVE-2021-40720.md): Ops CLI Deserialization of Untrusted Data leads to Abritrary Code Execution (CVSS 9.8, Adobe Ops-CLI · ops-cli)
- [CVE-2021-40730](https://cve.now/CVE-2021-40730.md): Adobe Acrobat Reader DC JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-40729](https://cve.now/CVE-2021-40729.md): Adobe Acrobat Reader DC PDF Out-of-Bound Read Vulnerability Information Disclosure (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-39864](https://cve.now/CVE-2021-39864.md): Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition (CVSS 6.5, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2021-38432](https://cve.now/CVE-2021-38432.md): FATEK Automation Communication Server (CVSS 9.8, FATEK Automation Communication Server)
- [CVE-2021-40998](https://cve.now/CVE-2021-40998.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40997](https://cve.now/CVE-2021-40997.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x pr (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40995](https://cve.now/CVE-2021-40995.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-41148](https://cve.now/CVE-2021-41148.md): The update of the CI job targeted by a widget is vulnerable to blind SQL injections (CVSS 8.8, Enalean tuleap)
- [CVE-2021-40991](https://cve.now/CVE-2021-40991.md): A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Man (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40994](https://cve.now/CVE-2021-40994.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40993](https://cve.now/CVE-2021-40993.md): A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40996](https://cve.now/CVE-2021-40996.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x pr (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-41147](https://cve.now/CVE-2021-41147.md): SQL injection in the planning edition panel (CVSS 7.2, Enalean tuleap)
- [CVE-2021-40990](https://cve.now/CVE-2021-40990.md): A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Man (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40988](https://cve.now/CVE-2021-40988.md): A remote directory traversal vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prio (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40989](https://cve.now/CVE-2021-40989.md): A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x p (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-3881](https://cve.now/CVE-2021-3881.md): Out-of-bounds Read in bfabiszewski/libmobi (CVSS 7.1, bfabiszewski/libmobi)
- [CVE-2021-3878](https://cve.now/CVE-2021-3878.md): Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (CVSS 9.8, stanfordnlp/corenlp · edu.stanford.nlp:stanford-corenlp)
- [CVE-2021-3875](https://cve.now/CVE-2021-3875.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2021-3874](https://cve.now/CVE-2021-3874.md): Path Traversal in bookstackapp/bookstack (CVSS 4.3, bookstackapp/bookstack)
- [CVE-2021-40992](https://cve.now/CVE-2021-40992.md): A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40986](https://cve.now/CVE-2021-40986.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-37739](https://cve.now/CVE-2021-37739.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-40987](https://cve.now/CVE-2021-40987.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-37738](https://cve.now/CVE-2021-37738.md): A remote disclosure of sensitive information vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Man (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-37736](https://cve.now/CVE-2021-37736.md): A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x pr (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-37737](https://cve.now/CVE-2021-37737.md): A remote SQL injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.10.x prior to 6 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-38431](https://cve.now/CVE-2021-38431.md): Advantech WebAccess SCADA (CVSS 4.3, Advantech WebAccess SCADA)
- [CVE-2021-39349](https://cve.now/CVE-2021-39349.md): Author Bio Box \<= 3.3.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Author Bio Box)
- [CVE-2021-39344](https://cve.now/CVE-2021-39344.md): KJM Admin Notices \<= 2.0.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, KJM Admin Notices)
- [CVE-2021-39335](https://cve.now/CVE-2021-39335.md): WpGenius Job Listing \<= 1.0.2 Authenticated Stored Cross-Site Scripting (CVSS 5.5, WpGenius Job Listing)
- [CVE-2021-39338](https://cve.now/CVE-2021-39338.md): MyBB Cross-Poster \<= 1.0 Authenticated Stored Cross-Site Scripting (CVSS 5.5, MyBB Cross-Poster)
- [CVE-2021-39345](https://cve.now/CVE-2021-39345.md): HAL \<= 2.1.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, HAL)
- [CVE-2021-39337](https://cve.now/CVE-2021-39337.md): job-portal \<= 0.0.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, job-portal)
- [CVE-2021-39336](https://cve.now/CVE-2021-39336.md): Job Manager \<= 0.7.25 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Job Manager)
- [CVE-2021-39334](https://cve.now/CVE-2021-39334.md): Job Board Vanila Plugin \<= 1.0 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Job Board Vanila Plugin)
- [CVE-2021-39332](https://cve.now/CVE-2021-39332.md): Business Manager – WordPress ERP, HR, CRM, and Project Management Plugin \<= 1.4.5 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Business Manager)
- [CVE-2021-42336](https://cve.now/CVE-2021-42336.md): Huachu Digital Technology Co.,Ltd. Easytest - Improper Authorization (CVSS 4.3, Huachu Digital Technology Co. Easytest)
- [CVE-2021-42335](https://cve.now/CVE-2021-42335.md): Huachu Digital Technology Co.,Ltd. Easytest - Stored XSS (CVSS 5.4, Huachu Digital Technology Co. Easytest)
- [CVE-2021-42334](https://cve.now/CVE-2021-42334.md): Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-2 (CVSS 8.8, Huachu Digital Technology Co. Easytest)
- [CVE-2021-42333](https://cve.now/CVE-2021-42333.md): Huachu Digital Technology Co.,Ltd. Easytest - SQL Injection-1 (CVSS 8.8, Huachu Digital Technology Co. Easytest)
- [CVE-2021-42332](https://cve.now/CVE-2021-42332.md): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-3 (CVSS 4.3, ShinHer Information Co. ShinHer StudyOnline System)
- [CVE-2021-42331](https://cve.now/CVE-2021-42331.md): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-2 (CVSS 5.4, ShinHer Information Co. ShinHer StudyOnline System)
- [CVE-2021-42330](https://cve.now/CVE-2021-42330.md): ShinHer Information Co., LTD. ShinHer StudyOnline System - Improper Authorization-1 (CVSS 8.8, ShinHer Information Co. ShinHer StudyOnline System)
- [CVE-2021-42329](https://cve.now/CVE-2021-42329.md): ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS (CVSS 5.4, ShinHer Information Co. ShinHer StudyOnline System)
- [CVE-2021-40999](https://cve.now/CVE-2021-40999.md): A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s): ClearPass Policy Manager 6.1 (no CVSS, Aruba ClearPass Policy Manager)
- [CVE-2021-28021](https://cve.now/CVE-2021-28021.md): Buffer overflow vulnerability in function stbi\_\_extend\_receive in stb\_image.h in stb 2.26 via a crafted JPEG file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.