# CVEs published 2021-10-05

57 CVEs were published on October 5, 2021: 2 critical, 10 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-41122](https://cve.now/CVE-2021-41122.md): Bounds check missing for decimal args in Vyper (CVSS 4.3, vyperlang vyper · vyper)
- [CVE-2021-31988](https://cve.now/CVE-2021-31988.md): A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and (no CVSS, Axis Communications AB AXIS OS)
- [CVE-2021-31987](https://cve.now/CVE-2021-31987.md): A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recip (no CVSS, Axis Communications AB AXIS OS)
- [CVE-2021-31986](https://cve.now/CVE-2021-31986.md): User controlled parameters related to SMTP notifications are not correctly validated. (no CVSS, Axis Communications AB AXIS OS)
- [CVE-2021-33849](https://cve.now/CVE-2021-33849.md): A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a tru (no CVSS, Zoho CRM Lead Magnet)
- [CVE-2020-21506](https://cve.now/CVE-2020-21506.md): waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add. (no CVSS)
- [CVE-2020-21505](https://cve.now/CVE-2020-21505.md): waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave. (no CVSS)
- [CVE-2020-21504](https://cve.now/CVE-2020-21504.md): waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=login. (no CVSS)
- [CVE-2020-21503](https://cve.now/CVE-2020-21503.md): waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet captu (no CVSS)
- [CVE-2021-41124](https://cve.now/CVE-2021-41124.md): Splash authentication credentials potentially leaked to target websites in scrapy-splash (CVSS 7.4, scrapy-plugins scrapy-splash · scrapy-splash)
- [CVE-2021-3625](https://cve.now/CVE-2021-3625.md): Buffer overflow in Zephyr USB DFU DNLOAD (CVSS 9.6, zephyrproject-rtos zephyr)
- [CVE-2021-3581](https://cve.now/CVE-2021-3581.md): Buffer Access with Incorrect Length Value in zephyr (CVSS 7.0, zephyrproject-rtos zephyr)
- [CVE-2021-3510](https://cve.now/CVE-2021-3510.md): Zephyr JSON decoder incorrectly decodes array of array (CVSS 7.5, zephyrproject-rtos zephyr)
- [CVE-2021-3436](https://cve.now/CVE-2021-3436.md): BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known (CVSS 4.3, zephyrproject-rtos zephyr)
- [CVE-2021-3319](https://cve.now/CVE-2021-3319.md): DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses (CVSS 6.5, zephyrproject-rtos zephyr)
- [CVE-2021-41120](https://cve.now/CVE-2021-41120.md): Unauthorized access to Credit card form in sylius/paypal-plugin (CVSS 7.5, Sylius PayPalPlugin · sylius/paypal-plugin)
- [CVE-2021-41116](https://cve.now/CVE-2021-41116.md): Command injection in composer on Windows (CVSS 8.2, composer · composer/composer)
- [CVE-2021-39226](https://cve.now/CVE-2021-39226.md): Snapshot authentication bypass in grafana (CVSS 9.8, KEV, grafana · github.com/grafana/grafana)
- [CVE-2021-35497](https://cve.now/CVE-2021-35497.md): TIBCO FTL unvalidated SAN in client certificates (CVSS 7.5, TIBCO Software TIBCO ActiveSpaces - Community Edition ·… +7)
- [CVE-2021-41113](https://cve.now/CVE-2021-41113.md): Cross-Site-Request-Forgery in Backend URI Handling in Typo3 (CVSS 8.8, typo3 · typo3/cms-core +1)
- [CVE-2021-41114](https://cve.now/CVE-2021-41114.md): HTTP Host Header Injection in Request Handling in Typo3 (CVSS 4.8, typo3 · typo3/cms-core +1)
- [CVE-2021-41286](https://cve.now/CVE-2021-41286.md): Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. (no CVSS)
- [CVE-2021-35492](https://cve.now/CVE-2021-35492.md): Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources via the /enginemanager (no CVSS)
- [CVE-2021-35491](https://cve.now/CVE-2021-35491.md): A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to delete a user accou (no CVSS)
- [CVE-2021-41553](https://cve.now/CVE-2021-41553.md): In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be a (no CVSS)
- [CVE-2021-41554](https://cve.now/CVE-2021-41554.md): ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affe (no CVSS)
- [CVE-2021-41555](https://cve.now/CVE-2021-41555.md): In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because th (no CVSS)
- [CVE-2021-39880](https://cve.now/CVE-2021-39880.md): A Denial Of Service vulnerability in the apollo\_upload\_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all ve (CVSS 6.5, GitLab · apollo\_upload\_server)
- [CVE-2021-22261](https://cve.now/CVE-2021-22261.md): A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.0.9, all versions st (CVSS 7.3, GitLab)
- [CVE-2021-22258](https://cve.now/CVE-2021-22258.md): The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses (CVSS 4.3, GitLab)
- [CVE-2021-22262](https://cve.now/CVE-2021-22262.md): Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all vers (CVSS 5.4, GitLab)
- [CVE-2021-22257](https://cve.now/CVE-2021-22257.md): An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1. (CVSS 5.3, GitLab)
- [CVE-2021-22264](https://cve.now/CVE-2021-22264.md): An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1. (CVSS 6.8, GitLab)
- [CVE-2021-39889](https://cve.now/CVE-2021-39889.md): In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protec (CVSS 4.3, GitLab)
- [CVE-2021-39870](https://cve.now/CVE-2021-39870.md): In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by a (CVSS 4.3, GitLab)
- [CVE-2021-39881](https://cve.now/CVE-2021-39881.md): In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client application with arbitrar (CVSS 3.5, GitLab)
- [CVE-2021-39886](https://cve.now/CVE-2021-39886.md): Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up t (CVSS 2.6, GitLab)
- [CVE-2021-39891](https://cve.now/CVE-2021-39891.md): In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the e (CVSS 5.9, GitLab)
- [CVE-2021-39866](https://cve.now/CVE-2021-39866.md): A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens. (CVSS 5.4, GitLab)
- [CVE-2021-39872](https://cve.now/CVE-2021-39872.md): In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still acc (CVSS 6.5, GitLab)
- [CVE-2021-39894](https://cve.now/CVE-2021-39894.md): In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers t (CVSS 5.4, GitLab)
- [CVE-2021-39869](https://cve.now/CVE-2021-39869.md): In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project. (CVSS 6.5, GitLab)
- [CVE-2021-39867](https://cve.now/CVE-2021-39867.md): In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to trigg (CVSS 6.5, GitLab)
- [CVE-2021-39875](https://cve.now/CVE-2021-39875.md): In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visit (CVSS 5.3, GitLab)
- [CVE-2021-39884](https://cve.now/CVE-2021-39884.md): In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privileg (CVSS 4.3, GitLab)
- [CVE-2021-39882](https://cve.now/CVE-2021-39882.md): In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information about any GitLab user. (CVSS 5.3, GitLab)
- [CVE-2021-39888](https://cve.now/CVE-2021-39888.md): In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting fro (CVSS 4.3, GitLab)
- [CVE-2021-39893](https://cve.now/CVE-2021-39893.md): A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. (CVSS 5.3, GitLab)
- [CVE-2021-39878](https://cve.now/CVE-2021-39878.md): A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowed an attacker to exe (CVSS 5.8, GitLab)
- [CVE-2021-35506](https://cve.now/CVE-2021-35506.md): Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit (no CVSS)
- [CVE-2021-35505](https://cve.now/CVE-2021-35505.md): Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary. (no CVSS)
- [CVE-2021-37223](https://cve.now/CVE-2021-37223.md): Nagios Enterprises NagiosXI \<= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php. (no CVSS)
- [CVE-2021-35504](https://cve.now/CVE-2021-35504.md): Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary. (no CVSS)
- [CVE-2021-35503](https://cve.now/CVE-2021-35503.md): Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. (no CVSS)
- [CVE-2021-39887](https://cve.now/CVE-2021-39887.md): A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowed an attacker to exe (CVSS 7.3, GitLab)
- [CVE-2021-41773](https://cve.now/CVE-2021-41773.md): Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVSS 7.5, KEV, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-41524](https://cve.now/CVE-2021-41524.md): null pointer dereference in h2 fuzzing (no CVSS, Apache Software Foundation Apache HTTP Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.