CVEs published October 1, 2021
70 CVEs were published on October 1, 2021: 2 critical, 10 high.
- Published
- 70
- Critical
- 2
- High
- 10
- Medium
- 5
- Low
- 0
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Esri Portal for ArcGIS
- 3
- QNAP Systems Photo Station
- 3
- Canonical apport
- 2
- Canonical Multipass
- 2
- com.googlecode.aviator:aviator
- 1
- common-workflow-language cwlviewer
- 1
- Dell Enterprise SONiC OS
- 1
- Dell Isilon InsightIQ
- 1
- hjue/justwriting
- 1
- james-heinrich/getid3
- 1
Critical 2
High 10
- CVE-2021-36309Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability.Dell Enterprise SONiC OS
- CVE-2021-36298Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component.Dell Isilon InsightIQ
- CVE-2021-29108There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below.Esri Portal for ArcGIS
- CVE-2021-23893Privilege Escalation vulnerability in McAfee Drive Encryption (MDE)McAfee Drive Encryption
- CVE-2021-34356Stored XSS Vulnerability in Photo StationQNAP Systems Photo Station
- CVE-2021-34355Stored XSS Vulnerability in Photo StationQNAP Systems Photo Station
- CVE-2021-34354Stored Cross-site Scripting Vulnerability in Photo StationQNAP Systems Photo Station
- CVE-2021-34352Command Injection Vulnerability in QVRQNAP Systems QVR
- CVE-2021-3747MacOS version of Multipass incorrect owner for application directoryCanonical Multipass
- CVE-2021-3626Windows version of Multipass unauthenticated localhost tcp control socket can perform mountsCanonical Multipass
Medium, low and unrated 58
- CVE-2021-41864prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel before 5.14.12 allows unprivileged users to trigger an eBPF multipl
- CVE-2021-41862AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).com.googlecode.aviator:aviator
- CVE-2021-38107CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38109Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38108Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38105IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38110Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-38102IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38106UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38100Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-38098Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file.
- CVE-2021-38101CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-41847An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security.
- CVE-2020-21228JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitraril
- CVE-2020-21014emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
- CVE-2020-21013emlog v6.0.0 contains a SQL injection via /admin/comment.php.
- CVE-2020-21012Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execut
- CVE-2021-41845A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007.
- CVE-2021-38103IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-38104IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file.
- CVE-2021-38099CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-38096Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-38097Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file.
- CVE-2021-41467Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to injhjue/justwriting
- CVE-2021-41464Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke
- CVE-2021-41465Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attac
- CVE-2021-41462Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke
- CVE-2021-41463Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 a
- CVE-2021-41461Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attacke
- CVE-2021-40973Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40975Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codei
- CVE-2021-40971Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40972Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40969Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40970Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40928Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web scr
- CVE-2021-40968Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject
- CVE-2021-40926Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary james-heinrich/getid3
- CVE-2021-40927Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary
- CVE-2021-40924Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web
- CVE-2021-40925Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject a
- CVE-2021-40923Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web
- CVE-2021-40922Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web
- CVE-2021-40921Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbit
- CVE-2021-29110Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.Esri Portal for ArcGIS
- CVE-2021-29109A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9.Esri Portal for ArcGIS
- CVE-2021-41647An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0.
- CVE-2021-41648An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter.
- CVE-2021-41649An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.
- CVE-2021-40960Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow.
- CVE-2021-35297Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overfl
- CVE-2021-38675Stored XSS Vulnerability in Image2PDFQNAP Systems Image2PDF
- CVE-2021-3710Apport info disclosure via path traversal bug in read_fileCanonical apport
- CVE-2021-3709Apport file permission bypass through emacs byte compilation errorsCanonical apport
- CVE-2021-33626A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate th
- CVE-2021-41456There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter whi
- CVE-2021-41457There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulner
- CVE-2021-41459There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter w