CVEs published October 4, 2021
96 CVEs were published on October 4, 2021: 2 critical, 16 high.
- Published
- 96
- Critical
- 2
- High
- 16
- Medium
- 25
- Low
- 5
- Unrated
- 48
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- GitLab
- 12
- redis
- 8
- Boston Scientific ZOOM LATITUDE
- 5
- cobbler
- 3
- PHP Group PHP
- 3
- moby · github.com/docker/docker +1
- 2
- onionshare-cli
- 2
- Rexroth IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22…
- 2
- wireapp wire-ios
- 2
- Adobe XMP Toolkit
- 1
Critical 2
High 16
- CVE-2021-41100Account takeover when having only access to a user's short lived token in wire-serverwireapp wire-server
- CVE-2021-41093Account takeover when having only access to a user's short lived tokenwireapp wire-ios
- CVE-2021-41099Integer overflow issue with strings in Redisredis
- CVE-2021-32762Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platformsredis
- CVE-2021-32687Integer overflow issue with intsets in Redisredis
- CVE-2021-32675DoS vulnerability in Redisredis
- CVE-2021-32627Integer overflow issue with Streams in Redisredis
- CVE-2021-32628Vulnerability in handling large ziplistsredis
- CVE-2021-23855Information disclosureRexroth IndraMotion MLC IndraMotion XLC
- CVE-2021-23858Information disclosureRexroth IndraMotion MLC L25, L45, L65, L75, L85, XM21, XM22…
- CVE-2021-32626Lua scripts can overflow the heap-based Lua stack in Redisredis
- CVE-2021-38618In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone (who knows a user's
- CVE-2021-39877A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with GitLab
- CVE-2021-39885A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7, all versions starting from 14.2 bGitLab
- CVE-2021-36051XMP Toolkit SDK Buffer Overflow Could Lead To Arbitrary Code ExecutionAdobe XMP Toolkit
- CVE-2021-32765Integer Overflow to Buffer Overflow in Hiredishiredis
Medium, low and unrated 78
- CVE-2021-42008The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds write.
- CVE-2021-42006An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault or possibly have uns
- CVE-2021-41123Exposure of Sensitive Information to an Unauthorized Actor in WB.UI.Headquarters.dllsurveysolutions
- CVE-2020-21496A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrar
- CVE-2020-21494A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to execute arbitrary web
- CVE-2020-21495A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers to execute arbitrar
- CVE-2020-21493An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.
- CVE-2020-21434Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module.
- CVE-2021-41089`docker cp` allows unexpected chmod of host filesmoby · github.com/docker/docker +1
- CVE-2020-21431HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.
- CVE-2021-41091Insufficiently restricted permissions on data directory in Docker Enginemoby · github.com/docker/docker +1
- CVE-2021-41092Docker CLI leaks private registry credentials to registry-1.docker.iodocker cli · github.com/docker/cli
- CVE-2020-21387A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and esc
- CVE-2020-21386A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator priv
- CVE-2021-39433A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file
- CVE-2021-41118ReDoS in DynamicPageList3Universal-Omega DynamicPageList3
- CVE-2021-41094Mandatory encryption at rest can be bypassed (UI) in Wire appwireapp wire-ios
- CVE-2021-41651A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system.
- CVE-2021-32672Vulnerability in Lua Debugger in Redisredis
- CVE-2021-41578mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files.
- CVE-2021-38400Use of Password Hash with Insufficient Computational Effort for Boston Scientific Zoom LatitudeBoston Scientific ZOOM LATITUDE
- CVE-2021-38396Missing Support Integrity Check for Boston Scientific Zoom LatitudeBoston Scientific ZOOM LATITUDE
- CVE-2021-38392Improper Access Control for Boston Scientific Zoom LatitudeBoston Scientific ZOOM LATITUDE
- CVE-2021-38398Reliance on Component that is not Updateable for Boston Scientific Zoom LatitudeBoston Scientific ZOOM LATITUDE
- CVE-2021-38394Missing Protection against Hardware Reverse Engineering Using Integrated Circuit Imaging Techniques for Boston Scientific Zoom LatitudeBoston Scientific ZOOM LATITUDE
- CVE-2021-41579LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal.
- CVE-2021-39347Stripe for WooCommerce 3.0.0 - 3.3.9 Missing Authorization Controls to Financial Account HijackingStripe for WooCommerce
- CVE-2020-28119Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into
- CVE-2021-41592Blockstream c-lightning through 0.10.1 allows loss of funds because of dust HTLC exposure.
- CVE-2021-41530Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerabilitForcepoint Next Generation Firewall
- CVE-2021-36850WordPress Media File Renamer – Auto & Manual Rename plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerabilityMeow Apps Media File Renamer – Auto & Manual Rename
- CVE-2021-39868In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited reposGitLab
- CVE-2021-41593Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure.
- CVE-2021-22259A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API.GitLab
- CVE-2021-39874In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.GitLab
- CVE-2021-39883Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5,GitLab
- CVE-2021-41596SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal.
- CVE-2021-39871In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed GitLab
- CVE-2021-41591ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure.
- CVE-2021-39899In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change pasGitLab
- CVE-2021-41595SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal.
- CVE-2021-39900Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with aGitLab
- CVE-2021-39896In all versions of GitLab CE/EE since version 8.0, when an admin uses the impersonate feature twice and stops impersonating, the admin may bGitLab
- CVE-2021-39873In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visitGitLab
- CVE-2021-39879Missing authentication in all versions of GitLab CE/EE since version 7.11.0 allows an attacker with access to a victim's session to disable GitLab
- CVE-2021-35296An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the c
- CVE-2021-40683In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an
- CVE-2021-25964Stored Cross-Site Scripting (XSS) in Calibre-web via Description Field in MetadataOzzieIsaacs calibreweb
- CVE-2021-41867An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of paonionshare-cli
- CVE-2021-38823The IceHrm 30.0.0 OS website was found vulnerable to Session Management Issue.
- CVE-2021-38822A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary
- CVE-2021-41868OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionalitonionshare-cli
- CVE-2021-39486A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0.
- CVE-2021-37777Gila CMS 2.2.0 is vulnerable to Insecure Direct Object Reference (IDOR).
- CVE-2021-37333Laravel Booking System Booking Core 2.0 is vulnerable to Session Management.
- CVE-2021-37331Laravel Booking System Booking Core 2.0 is vulnerable to Incorrect Access Control.
- CVE-2021-37330Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2021-41511The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to b
- CVE-2021-41878A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker
- CVE-2021-24687Modern Events Calendar Lite < 5.22.2 - Admin+ Stored Cross-Site ScriptingModern Events Calendar Lite
- CVE-2021-24679Bitcoin / AltCoin Payment Gateway for WooCommerce < 1.6.1 - Reflected Cross-Site ScriptingBitcoin / AltCoin Payment Gateway for WooCommerce & Multive…
- CVE-2021-24678CM Tooltip Glossary < 3.9.21 - Contributor+ Stored Cross-Site ScriptingCM Tooltip Glossary – Better SEO and UEX for your WP site
- CVE-2021-24676Better Find and Replace < 1.2.9 - Reflected Cross-Site ScriptingBetter Find and Replace
- CVE-2021-24673Appointment Hour Booking < 1.3.16 - Authenticated Stored Cross-Site ScriptingAppointment Hour Booking – WordPress Booking Plugin
- CVE-2021-24654User Registration < 2.0.2 - Low Privilege Stored Cross-Site ScriptingUser Registration – Custom Registration Form, Login And Use…
- CVE-2021-24465Meow Gallery < 4.1.9 - Contributor+ SQL InjectionMeow Gallery
- CVE-2021-22557Code execution in SLO Generator via YAML PayloadGoogle SLO Generator · slo-generator
- CVE-2021-41869SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation.
- CVE-2021-41322Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password res
- CVE-2021-41285Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component.
- CVE-2021-40325Cobbler before 3.3.0 allows authorization bypass for modification of settings.cobbler
- CVE-2021-40324Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.cobbler
- CVE-2021-40323Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template icobbler
- CVE-2021-21706ZipArchive::extractTo may extract outside of destination dirPHP Group PHP
- CVE-2021-21705Incorrect URL validation in FILTER_VALIDATE_URLPHP Group PHP
- CVE-2021-21704Multiple vulnerabilities in Firebird client extensionPHP Group PHP
- CVE-2021-41861The Telegram application 7.5.0 through 7.8.0 for Android does not properly implement image self-destruction, a different vulnerability than
- CVE-2021-41103Insufficiently restricted permissions on plugin directoriescontainerd · github.com/containerd/containerd