# CVEs published 2021-10-21

59 CVEs were published on October 21, 2021: 1 critical, 6 high. Days are UTC.

- [CVE-2021-27746](https://cve.now/CVE-2021-27746.md): "HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability" (no CVSS, "HCL Connections")
- [CVE-2021-41169](https://cve.now/CVE-2021-41169.md): Improper Neutralization HTML tags in sulu/sulu (CVSS 6.2, sulu · sulu/sulu)
- [CVE-2021-36869](https://cve.now/CVE-2021-36869.md): WordPress Ivory Search plugin \<= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, Ivory Search)
- [CVE-2021-41127](https://cve.now/CVE-2021-41127.md): Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasa (CVSS 7.3, RasaHQ rasa · rasa)
- [CVE-2021-41168](https://cve.now/CVE-2021-41168.md): Hash-Collision Denial-of-Service Vulnerability in snudown (CVSS 6.5, reddit snudown)
- [CVE-2021-39354](https://cve.now/CVE-2021-39354.md): Easy Digital Downloads \<= 2.11.2 Authenticated Reflected Cross-Site Scripting (CVSS 4.8, Easy Digital Downloads)
- [CVE-2021-39321](https://cve.now/CVE-2021-39321.md): Sassy Social Share 3.3.23 PHP Object Injection (CVSS 8.8, Sassy Social Share)
- [CVE-2021-39328](https://cve.now/CVE-2021-39328.md): Simple Job Board \<= 2.9.4 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Simple Job Board)
- [CVE-2021-39352](https://cve.now/CVE-2021-39352.md): Catch Themes Demo Import \<= 1.7 Admin+ Arbitrary File Upload (CVSS 7.2, Catch Themes Demo Import)
- [CVE-2021-39356](https://cve.now/CVE-2021-39356.md): Content Staging \<= 2.0.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Content Staging)
- [CVE-2021-39357](https://cve.now/CVE-2021-39357.md): Leaky Paywall \<= 4.16.5 Authenticated Stored Cross-Site Scripting (CVSS 5.5, Leaky Paywall)
- [CVE-2021-39348](https://cve.now/CVE-2021-39348.md): LearnPress – WordPress LMS Plugin \<= 4.1.3.1 Authenticated Stored Cross-Site Scripting (CVSS 5.5, LearnPress)
- [CVE-2021-22034](https://cve.now/CVE-2021-22034.md): Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability. (no CVSS, VMware vRealize Operations Tenant App for VMware Cloud Dire…)
- [CVE-2021-40719](https://cve.now/CVE-2021-40719.md): Adobe Connect Deserialization of Untrusted Data Remote Code Execution (CVSS 9.8, Adobe Connect)
- [CVE-2021-42716](https://cve.now/CVE-2021-42716.md): An issue was discovered in stb stb\_image.h 2.27. (no CVSS)
- [CVE-2021-35228](https://cve.now/CVE-2021-35228.md): Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388 (CVSS 5.5, SolarWinds)
- [CVE-2021-35227](https://cve.now/CVE-2021-35227.md): Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM (CVSS 4.7, SolarWinds Access Rights Manager)
- [CVE-2021-35225](https://cve.now/CVE-2021-35225.md): Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 (CVSS 5.0, SolarWinds NPM)
- [CVE-2021-41146](https://cve.now/CVE-2021-41146.md): Arbitrary command execution on Windows in qutebrowser (CVSS 8.8, qutebrowser)
- [CVE-2021-28496](https://cve.now/CVE-2021-28496.md): In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device. (CVSS 5.7, Arista Networks Arista EOS)
- [CVE-2021-29883](https://cve.now/CVE-2021-29883.md): IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization token (CVSS 4.3, IBM Transformation Extender Advanced)
- [CVE-2021-29873](https://cve.now/CVE-2021-29873.md): IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted (CVSS 8.8, IBM FlashSystem · IBM Storwize +3)
- [CVE-2020-14263](https://cve.now/CVE-2020-14263.md): "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" (no CVSS, "HCL Traveler Companion")
- [CVE-2021-20120](https://cve.now/CVE-2021-20120.md): The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. (no CVSS, Arris SurfBoard SB8200)
- [CVE-2021-28975](https://cve.now/CVE-2021-28975.md): WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst\_servers page, for a crafted server\_host, server\_name, (no CVSS)
- [CVE-2020-27304](https://cve.now/CVE-2020-27304.md): The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-ba (no CVSS, civetweb\_project civetweb)
- [CVE-2021-42740](https://cve.now/CVE-2021-42740.md): The shell-quote package before 1.7.3 for Node.js allows command injection. (no CVSS, shell-quote)
- [CVE-2021-35512](https://cve.now/CVE-2021-35512.md): An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200. (no CVSS)
- [CVE-2021-41792](https://cve.now/CVE-2021-41792.md): An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services throu (no CVSS)
- [CVE-2021-41791](https://cve.now/CVE-2021-41791.md): An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. (no CVSS)
- [CVE-2021-41790](https://cve.now/CVE-2021-41790.md): An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. (no CVSS)
- [CVE-2021-42108](https://cve.now/CVE-2021-42108.md): Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10. (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42107](https://cve.now/CVE-2021-42107.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free B (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42106](https://cve.now/CVE-2021-42106.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free B (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42105](https://cve.now/CVE-2021-42105.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free B (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42104](https://cve.now/CVE-2021-42104.md): Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free B (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-42103](https://cve.now/CVE-2021-42103.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escala (no CVSS, Trend Micro Apex One)
- [CVE-2021-42102](https://cve.now/CVE-2021-42102.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to (no CVSS, Trend Micro Apex One)
- [CVE-2021-42101](https://cve.now/CVE-2021-42101.md): An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escala (no CVSS, Trend Micro Apex One)
- [CVE-2021-42011](https://cve.now/CVE-2021-42011.md): An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DL (no CVSS, Trend Micro Apex One)
- [CVE-2021-42012](https://cve.now/CVE-2021-42012.md): A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could a (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-23139](https://cve.now/CVE-2021-23139.md): A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI prog (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-34736](https://cve.now/CVE-2021-34736.md): Cisco Integrated Management Controller GUI Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Computing System)
- [CVE-2021-40123](https://cve.now/CVE-2021-40123.md): Cisco Identity Services Engine File Download Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2021-40122](https://cve.now/CVE-2021-40122.md): Cisco Meeting Server Call Bridge Denial of Service Vulnerability (CVSS 5.9, Cisco Meeting Server)
- [CVE-2021-40121](https://cve.now/CVE-2021-40121.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2021-34789](https://cve.now/CVE-2021-34789.md): Cisco Tetration Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Secure Workload)
- [CVE-2021-34760](https://cve.now/CVE-2021-34760.md): Cisco TelePresence Management Suite Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco TelePresence Management Suite)
- [CVE-2021-34743](https://cve.now/CVE-2021-34743.md): Cisco Webex Software Application Authorization Bypass Vulnerability (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2021-34738](https://cve.now/CVE-2021-34738.md): Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Identity Services Engine Software)
- [CVE-2021-39126](https://cve.now/CVE-2021-39126.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forge (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-1529](https://cve.now/CVE-2021-1529.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 7.8, Cisco IOS XE SD-WAN Software)
- [CVE-2021-39127](https://cve.now/CVE-2021-39127.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a Broken (CVSS 5.3, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-42097](https://cve.now/CVE-2021-42097.md): GNU Mailman before 2.1.35 may allow remote Privilege Escalation. (no CVSS)
- [CVE-2021-42096](https://cve.now/CVE-2021-42096.md): GNU Mailman before 2.1.35 may allow remote Privilege Escalation. (no CVSS)
- [CVE-2021-41159](https://cve.now/CVE-2021-41159.md): Improper client input validation for FreeRDP gateway connections allows to overwrite memory (CVSS 5.8, FreeRDP)
- [CVE-2021-41160](https://cve.now/CVE-2021-41160.md): Improper region checks in FreeRDP allow out of bound write to memory (CVSS 5.3, FreeRDP)
- [CVE-2021-42327](https://cve.now/CVE-2021-42327.md): dp\_link\_settings\_write in drivers/gpu/drm/amd/display/amdgpu\_dm/amdgpu\_dm\_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based (no CVSS)
- [CVE-2021-42715](https://cve.now/CVE-2021-42715.md): An issue was discovered in stb stb\_image.h 1.33 through 2.27. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.