CVEs published October 6, 2021
128 CVEs were published on October 6, 2021: 2 critical, 23 high. 2 are now in CISA KEV.
- Published
- 128
- Critical
- 2
- High
- 23
- Medium
- 51
- Low
- 6
- Unrated
- 46
- Now in CISA KEV
- 2
- Fix available
- 41
Most affected products
- Samsung Mobile Devices
- 25
- Android
- 20
- IBM Sterling B2B Integrator
- 10
- Samsung Mobile Samsung Notes
- 7
- Cisco Small Business 200 Series Smart Switches
- 6
- Cisco Identity Services Engine Software
- 3
- Cisco Analog Telephone Adaptor (ATA) Software
- 2
- Cisco Small Business 220 Series Smart Plus Switches
- 2
- Fortinet FortiClientEMS
- 2
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
Critical 2
High 23
- CVE-2021-41129Authentication bypass in Pterodactylpterodactyl panel · pterodactyl/panel
- CVE-2021-1594Cisco Identity Services Engine Privilege Escalation VulnerabilityCisco Identity Services Engine Software
- CVE-2021-34698Cisco Web Security Appliance Proxy Service Denial of Service VulnerabilityCisco Web Security Appliance
- CVE-2021-34710Cisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesCisco Analog Telephone Adaptor (ATA) Software
- CVE-2021-34735Cisco ATA 190 Series Analog Telephone Adapter Software VulnerabilitiesCisco Analog Telephone Adaptor (ATA) Software
- CVE-2021-34748Cisco Intersight Virtual Appliance Command Injection VulnerabilityCisco Intersight Virtual Appliance
- CVE-2021-34788Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-38923IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs.IBM PowerVM Hypervisor
- CVE-2021-41126Deleted Admin Can Sign In to Admin Interfaceoctobercms october · october/october +1
- CVE-2021-25499Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access contSamsung Mobile Galaxy Store
- CVE-2021-25498A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.Samsung Mobile Samsung Notes
- CVE-2021-25497A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61Samsung Mobile Samsung Notes
- CVE-2021-25496A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61Samsung Mobile Samsung Notes
- CVE-2021-25495A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitraSamsung Mobile Samsung Notes
- CVE-2021-25492Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read.Samsung Mobile Samsung Notes
- CVE-2021-41121Memory corruption in Vypervyperlang vyper · vyper
- CVE-2021-25487Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it resSamsung Mobile Devices
- CVE-2021-25485Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT Samsung Mobile Devices
- CVE-2021-25479A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and cSamsung Mobile Devices
- CVE-2021-25478A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and Samsung Mobile Devices
- CVE-2021-25470An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE.Samsung Mobile Devices
- CVE-2021-39351WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL InjectionWP Bannerize
- CVE-2021-24019An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attackeFortinet FortiClientEMS
Medium, low and unrated 103
- CVE-2021-21684Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying themJenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…
- CVE-2021-21683The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting iJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21682Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially replaJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2020-21658A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL.
- CVE-2020-21656XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index.
- CVE-2020-21654emlog v6.0 contains a vulnerability in the component admin\template.php, which allows attackers to getshell via a crafted Zip file.
- CVE-2020-21653Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sj() meth
- CVE-2020-21651Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\point.php, which can be exploited via the ad
- CVE-2020-21652Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the a
- CVE-2020-21650Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the a
- CVE-2020-21649Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \controller\index.php, which can be exploited via the sql() met
- CVE-2020-21648WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php.
- CVE-2021-42045An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2.
- CVE-2021-42046An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2.
- CVE-2021-42047An issue was discovered in the Growth extension in MediaWiki through 1.36.2.
- CVE-2021-42048An issue was discovered in the Growth extension in MediaWiki through 1.36.2.
- CVE-2021-42049An issue was discovered in the Translate extension in MediaWiki through 1.36.2.
- CVE-2021-42040An issue was discovered in MediaWiki through 1.36.2.
- CVE-2021-42041An issue was discovered in CentralAuth in MediaWiki through 1.36.2.
- CVE-2021-42042An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2.
- CVE-2021-42043An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2.
- CVE-2021-42044An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2.
- CVE-2021-34702Cisco Identity Services Engine Sensitive Information Disclosure VulnerabilityCisco Identity Services Engine Software
- CVE-2021-34706Cisco Identity Services Engine XML External Entity Injection VulnerabilityCisco Identity Services Engine Software
- CVE-2021-34711Cisco IP Phone Software Arbitrary File Read VulnerabilityCisco IP Phones with Multiplatform Firmware
- CVE-2021-34742Cisco Vision Dynamic Signage Director Reflected Cross-Site Scripting VulnerabilityCisco Vision Dynamic Signage Director
- CVE-2021-34744Cisco Business 220 Series Smart Switches Static Key and Password VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-34757Cisco Business 220 Series Smart Switches Static Key and Password VulnerabilitiesCisco Small Business 220 Series Smart Plus Switches
- CVE-2021-34758Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service VulnerabilityCisco RoomOS Software
- CVE-2021-34766Cisco Smart Software Manager Privilege Escalation VulnerabilityCisco Smart Software Manager On-Prem
- CVE-2021-34772Cisco Orbital Open Redirect VulnerabilityCisco Orbital
- CVE-2021-34775Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34776Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34777Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34778Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34779Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34780Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol VulnerabilitiesCisco Small Business 200 Series Smart Switches
- CVE-2021-34782Cisco DNA Center Information Disclosure VulnerabilityCisco Digital Network Architecture Center
- CVE-2021-1534Cisco Email Security Appliance URL Filtering Bypass VulnerabilityCisco Email Security Appliance
- CVE-2021-41125HTTP authentication credential leak to target websites in scrapyscrapy
- CVE-2021-25494A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary coSamsung Mobile Samsung Notes
- CVE-2021-25493Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB readSamsung Mobile Samsung Notes
- CVE-2021-25491A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference.Samsung Mobile Devices
- CVE-2021-38925IBM Sterling B2B Integrator Standard Edition 5.2.0.IBM Sterling B2B Integrator
- CVE-2021-25490A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged prSamsung Mobile Devices
- CVE-2021-29903IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection.IBM Sterling B2B Integrator
- CVE-2021-29855IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting.IBM Sterling B2B Integrator
- CVE-2021-29837IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attackIBM Sterling B2B Integrator
- CVE-2021-29836IBM Sterling B2B Integrator Standard Edition 5.2.0.0.IBM Sterling B2B Integrator
- CVE-2021-25489Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format stSamsung Mobile Devices
- CVE-2021-29798IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection.IBM Sterling B2B Integrator
- CVE-2021-29764IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting.IBM Sterling B2B Integrator
- CVE-2021-29761IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from IBM Sterling B2B Integrator
- CVE-2021-29760IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files througIBM Sterling B2B Integrator
- CVE-2021-25488Lack of boundary checking of a buffer in recv_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read.Samsung Mobile Devices
- CVE-2021-29758IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should nIBM Sterling B2B Integrator
- CVE-2021-25486Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing Samsung Mobile Devices
- CVE-2021-25484Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event.Samsung Mobile Devices
- CVE-2021-25483Lack of boundary checking of a buffer in livfivextractor library prior to SMR Oct-2021 Release 1 allows OOB read.Samsung Mobile Devices
- CVE-2021-25482SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA frameworkSamsung Mobile Devices
- CVE-2021-25481An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory ProtSamsung Mobile Devices
- CVE-2021-25480A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead tSamsung Mobile Devices
- CVE-2021-25477An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service.Samsung Mobile Devices
- CVE-2021-25476An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection meSamsung Mobile Devices
- CVE-2021-25475A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and cSamsung Mobile Devices
- CVE-2021-25474Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_show_on_qspanel value in SystemUI prior to SMR Oct-20Samsung Mobile Devices
- CVE-2021-25473Assuming a shell privilege is gained, an improper exception handling for multi_sim_bar_hide_by_meadia_full value in SystemUI prior to SMR OcSamsung Mobile Devices
- CVE-2021-25472An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwrSamsung Mobile Devices
- CVE-2021-25471A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile Samsung Mobile Devices
- CVE-2021-25469A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution.Samsung Mobile Devices
- CVE-2021-25468A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to readSamsung Mobile Devices
- CVE-2021-25467Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release Samsung Mobile Devices
- CVE-2021-39350FV Flowplayer Video Player <= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site ScriptingFV Flowplayer Video Player
- CVE-2021-20264An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers.containers/openjdk
- CVE-2021-0680In system properties, there is a possible information disclosure due to a missing permission check.Android
- CVE-2021-0681In system properties, there is a possible information disclosure due to a missing permission check.Android
- CVE-2021-0685In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserializatioAndroid
- CVE-2021-0689In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-0635When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, andAndroid
- CVE-2021-0636When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, andAndroid
- CVE-2021-0687In ellipsize of Layout.java, there is a possible ANR due to improper input validation.Android
- CVE-2021-0691In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to aAndroid
- CVE-2021-0683In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy.Android
- CVE-2021-0693In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected prAndroid
- CVE-2021-0695In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free.Android
- CVE-2021-0690In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2021-0644In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missinAndroid
- CVE-2021-0598In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack.Android
- CVE-2021-0684In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-0692In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent.Android
- CVE-2021-0686In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different deviAndroid
- CVE-2021-0595In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logginAndroid
- CVE-2021-0688In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition.Android
- CVE-2021-0682In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permissioAndroid
- CVE-2021-28702PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Resxen
- CVE-2020-19003An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances ugateone
- CVE-2021-33602Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…
- CVE-2021-3848An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business SecuritTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-24021An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below mFortinet FortiAnalyzer
- CVE-2021-36175An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote aFortinet FortiWebManager
- CVE-2020-15941A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to iFortinet FortiClientEMS
- CVE-2021-36170An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an authFortinet FortiManager, FortiAnalyzer
- CVE-2021-36178A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devicesFortinet FortiSDNConnector