CVEs published October 5, 2021
57 CVEs were published on October 5, 2021: 2 critical, 10 high. 2 are now in CISA KEV.
- Published
- 57
- Critical
- 2
- High
- 10
- Medium
- 23
- Low
- 2
- Unrated
- 20
- Now in CISA KEV
- 2
- Fix available
- 30
Most affected products
- GitLab
- 22
- zephyrproject-rtos zephyr
- 5
- Axis Communications AB AXIS OS
- 3
- Apache Software Foundation Apache HTTP Server
- 2
- typo3 · typo3/cms-core +1
- 2
- composer · composer/composer
- 1
- GitLab · apollo_upload_server
- 1
- grafana · github.com/grafana/grafana
- 1
- scrapy-plugins scrapy-splash · scrapy-splash
- 1
- Sylius PayPalPlugin · sylius/paypal-plugin
- 1
Critical 2
High 10
- CVE-2021-41124Splash authentication credentials potentially leaked to target websites in scrapy-splashscrapy-plugins scrapy-splash · scrapy-splash
- CVE-2021-3581Buffer Access with Incorrect Length Value in zephyrzephyrproject-rtos zephyr
- CVE-2021-3510Zephyr JSON decoder incorrectly decodes array of arrayzephyrproject-rtos zephyr
- CVE-2021-41120Unauthorized access to Credit card form in sylius/paypal-pluginSylius PayPalPlugin · sylius/paypal-plugin
- CVE-2021-41116Command injection in composer on Windowscomposer · composer/composer
- CVE-2021-35497TIBCO FTL unvalidated SAN in client certificatesTIBCO Software TIBCO ActiveSpaces - Community Edition ·… +7
- CVE-2021-41113Cross-Site-Request-Forgery in Backend URI Handling in Typo3typo3 · typo3/cms-core +1
- CVE-2021-22261A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions stGitLab
- CVE-2021-39887A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to exeGitLab
- CVE-2021-41773Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49Apache Software Foundation Apache HTTP Server
Medium, low and unrated 45
- CVE-2021-41122Bounds check missing for decimal args in Vypervyperlang vyper · vyper
- CVE-2021-31988A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Axis Communications AB AXIS OS
- CVE-2021-31987A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipAxis Communications AB AXIS OS
- CVE-2021-31986User controlled parameters related to SMTP notifications are not correctly validated.Axis Communications AB AXIS OS
- CVE-2021-33849A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a truZoho CRM Lead Magnet
- CVE-2020-21506waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add.
- CVE-2020-21505waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.
- CVE-2020-21504waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login.
- CVE-2020-21503waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet captu
- CVE-2021-3436BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is knownzephyrproject-rtos zephyr
- CVE-2021-3319DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresseszephyrproject-rtos zephyr
- CVE-2021-41114HTTP Host Header Injection in Request Handling in Typo3typo3 · typo3/cms-core +1
- CVE-2021-41286Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism.
- CVE-2021-35492Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager
- CVE-2021-35491A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user accou
- CVE-2021-41553In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be a
- CVE-2021-41554ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affe
- CVE-2021-41555In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because th
- CVE-2021-39880A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all veGitLab · apollo_upload_server
- CVE-2021-22258The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addressesGitLab
- CVE-2021-22262Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versGitLab
- CVE-2021-22257An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.GitLab
- CVE-2021-22264An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.GitLab
- CVE-2021-39889In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protecGitLab
- CVE-2021-39870In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by aGitLab
- CVE-2021-39881In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrarGitLab
- CVE-2021-39886Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up tGitLab
- CVE-2021-39891In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the eGitLab
- CVE-2021-39866A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.GitLab
- CVE-2021-39872In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still accGitLab
- CVE-2021-39894In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers tGitLab
- CVE-2021-39869In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.GitLab
- CVE-2021-39867In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to triggGitLab
- CVE-2021-39875In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visitGitLab
- CVE-2021-39884In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privilegGitLab
- CVE-2021-39882In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user.GitLab
- CVE-2021-39888In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting froGitLab
- CVE-2021-39893A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation.GitLab
- CVE-2021-39878A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to exeGitLab
- CVE-2021-35506Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit
- CVE-2021-35505Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.
- CVE-2021-37223Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php.
- CVE-2021-35504Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.
- CVE-2021-35503Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.
- CVE-2021-41524null pointer dereference in h2 fuzzingApache Software Foundation Apache HTTP Server