# CVEs published 2021-10-06

128 CVEs were published on October 6, 2021: 2 critical, 23 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-21684](https://cve.now/CVE-2021-21684.md): Jenkins Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them (no CVSS, Jenkins project Jenkins Git Plugin · org.jenkins-ci.plugins…)
- [CVE-2021-21683](https://cve.now/CVE-2021-21683.md): The file browser in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows, resulting i (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-21682](https://cve.now/CVE-2021-21682.md): Jenkins 2.314 and earlier, LTS 2.303.1 and earlier accepts names of jobs and other entities with a trailing dot character, potentially repla (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2020-21658](https://cve.now/CVE-2020-21658.md): A Cross-Site Request Forgery (CSRF) in WDJA CMS v1.5.2 allows attackers to arbitrarily add administrator accounts via a crafted URL. (no CVSS)
- [CVE-2020-21656](https://cve.now/CVE-2020-21656.md): XYHCMS v3.6 contains a stored cross-site scripting (XSS) vulnerability in the component xyhai.php?s=/Link/index. (no CVSS)
- [CVE-2020-21654](https://cve.now/CVE-2020-21654.md): emlog v6.0 contains a vulnerability in the component admin\\template.php, which allows attackers to getshell via a crafted Zip file. (no CVSS)
- [CVE-2020-21653](https://cve.now/CVE-2020-21653.md): Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \\controller\\index.php, which can be exploited via the sj() meth (no CVSS)
- [CVE-2020-21651](https://cve.now/CVE-2020-21651.md): Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\point.php, which can be exploited via the ad (no CVSS)
- [CVE-2020-21652](https://cve.now/CVE-2020-21652.md): Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php, which can be exploited via the a (no CVSS)
- [CVE-2020-21650](https://cve.now/CVE-2020-21650.md): Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php, which can be exploited via the a (no CVSS)
- [CVE-2020-21649](https://cve.now/CVE-2020-21649.md): Myucms v2.2.1 contains a server-side request forgery (SSRF) in the component \\controller\\index.php, which can be exploited via the sql() met (no CVSS)
- [CVE-2020-21648](https://cve.now/CVE-2020-21648.md): WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php. (no CVSS)
- [CVE-2021-42045](https://cve.now/CVE-2021-42045.md): An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42046](https://cve.now/CVE-2021-42046.md): An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42047](https://cve.now/CVE-2021-42047.md): An issue was discovered in the Growth extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42048](https://cve.now/CVE-2021-42048.md): An issue was discovered in the Growth extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42049](https://cve.now/CVE-2021-42049.md): An issue was discovered in the Translate extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42040](https://cve.now/CVE-2021-42040.md): An issue was discovered in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42041](https://cve.now/CVE-2021-42041.md): An issue was discovered in CentralAuth in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42042](https://cve.now/CVE-2021-42042.md): An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42043](https://cve.now/CVE-2021-42043.md): An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-42044](https://cve.now/CVE-2021-42044.md): An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. (no CVSS)
- [CVE-2021-41129](https://cve.now/CVE-2021-41129.md): Authentication bypass in Pterodactyl (CVSS 8.1, pterodactyl panel · pterodactyl/panel)
- [CVE-2021-1594](https://cve.now/CVE-2021-1594.md): Cisco Identity Services Engine Privilege Escalation Vulnerability (CVSS 7.5, Cisco Identity Services Engine Software)
- [CVE-2021-34698](https://cve.now/CVE-2021-34698.md): Cisco Web Security Appliance Proxy Service Denial of Service Vulnerability (CVSS 8.6, Cisco Web Security Appliance)
- [CVE-2021-34702](https://cve.now/CVE-2021-34702.md): Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2021-34706](https://cve.now/CVE-2021-34706.md): Cisco Identity Services Engine XML External Entity Injection Vulnerability (CVSS 6.4, Cisco Identity Services Engine Software)
- [CVE-2021-34710](https://cve.now/CVE-2021-34710.md): Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities (CVSS 8.8, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2021-34711](https://cve.now/CVE-2021-34711.md): Cisco IP Phone Software Arbitrary File Read Vulnerability (CVSS 5.5, Cisco IP Phones with Multiplatform Firmware)
- [CVE-2021-34735](https://cve.now/CVE-2021-34735.md): Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities (CVSS 8.8, Cisco Analog Telephone Adaptor (ATA) Software)
- [CVE-2021-34742](https://cve.now/CVE-2021-34742.md): Cisco Vision Dynamic Signage Director Reflected Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Vision Dynamic Signage Director)
- [CVE-2021-34744](https://cve.now/CVE-2021-34744.md): Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities (CVSS 4.9, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2021-34748](https://cve.now/CVE-2021-34748.md): Cisco Intersight Virtual Appliance Command Injection Vulnerability (CVSS 8.8, Cisco Intersight Virtual Appliance)
- [CVE-2021-34757](https://cve.now/CVE-2021-34757.md): Cisco Business 220 Series Smart Switches Static Key and Password Vulnerabilities (CVSS 4.9, Cisco Small Business 220 Series Smart Plus Switches)
- [CVE-2021-34758](https://cve.now/CVE-2021-34758.md): Cisco TelePresence Collaboration Endpoint and RoomOS Software Denial of Service Vulnerability (CVSS 4.4, Cisco RoomOS Software)
- [CVE-2021-34766](https://cve.now/CVE-2021-34766.md): Cisco Smart Software Manager Privilege Escalation Vulnerability (CVSS 5.4, Cisco Smart Software Manager On-Prem)
- [CVE-2021-34772](https://cve.now/CVE-2021-34772.md): Cisco Orbital Open Redirect Vulnerability (CVSS 4.7, Cisco Orbital)
- [CVE-2021-34775](https://cve.now/CVE-2021-34775.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34776](https://cve.now/CVE-2021-34776.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34777](https://cve.now/CVE-2021-34777.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34778](https://cve.now/CVE-2021-34778.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34779](https://cve.now/CVE-2021-34779.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34780](https://cve.now/CVE-2021-34780.md): Cisco Small Business 220 Series Smart Switches Link Layer Discovery Protocol Vulnerabilities (CVSS 4.3, Cisco Small Business 200 Series Smart Switches)
- [CVE-2021-34782](https://cve.now/CVE-2021-34782.md): Cisco DNA Center Information Disclosure Vulnerability (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2021-34788](https://cve.now/CVE-2021-34788.md): Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability (CVSS 7.0, Cisco AnyConnect Secure Mobility Client)
- [CVE-2021-1534](https://cve.now/CVE-2021-1534.md): Cisco Email Security Appliance URL Filtering Bypass Vulnerability (CVSS 5.8, Cisco Email Security Appliance)
- [CVE-2021-38923](https://cve.now/CVE-2021-38923.md): IBM PowerVM Hypervisor FW1010 could allow a privileged user to gain access to another VM due to assigning duplicate WWPNs. (CVSS 8.0, IBM PowerVM Hypervisor)
- [CVE-2021-29908](https://cve.now/CVE-2021-29908.md): The IBM TS7700 Management Interface is vulnerable to unauthenticated access. (CVSS 9.1, IBM Virtualization Engine TS7700 3957-VED · IBM Virtualizat…)
- [CVE-2021-41128](https://cve.now/CVE-2021-41128.md): CSV Injection Vulnerability in Hygeia (CVSS 9.1, jshmrtn hygeia)
- [CVE-2021-41126](https://cve.now/CVE-2021-41126.md): Deleted Admin Can Sign In to Admin Interface (CVSS 7.2, octobercms october · october/october +1)
- [CVE-2021-41125](https://cve.now/CVE-2021-41125.md): HTTP authentication credential leak to target websites in scrapy (CVSS 5.7, scrapy)
- [CVE-2021-25499](https://cve.now/CVE-2021-25499.md): Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access cont (CVSS 7.1, Samsung Mobile Galaxy Store)
- [CVE-2021-25498](https://cve.now/CVE-2021-25498.md): A possible buffer overflow vulnerability in maetd\_eco\_cb\_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2021-25497](https://cve.now/CVE-2021-25497.md): A possible buffer overflow vulnerability in maetd\_cpy\_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2021-25496](https://cve.now/CVE-2021-25496.md): A possible buffer overflow vulnerability in maetd\_dec\_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2021-25495](https://cve.now/CVE-2021-25495.md): A possible heap buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitra (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2021-25494](https://cve.now/CVE-2021-25494.md): A possible buffer overflow vulnerability in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows arbitrary co (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2021-25493](https://cve.now/CVE-2021-25493.md): Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2021-25492](https://cve.now/CVE-2021-25492.md): Lack of boundary checking of a buffer in libSPenBase library of Samsung Notes prior to Samsung Note version 4.3.02.61 allows OOB read. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2021-25491](https://cve.now/CVE-2021-25491.md): A vulnerability in mfc driver prior to SMR Oct-2021 Release 1 allows memory corruption via NULL-pointer dereference. (CVSS 2.3, Samsung Mobile Devices)
- [CVE-2021-41121](https://cve.now/CVE-2021-41121.md): Memory corruption in Vyper (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2021-38925](https://cve.now/CVE-2021-38925.md): IBM Sterling B2B Integrator Standard Edition 5.2.0. (CVSS 5.9, IBM Sterling B2B Integrator)
- [CVE-2021-25490](https://cve.now/CVE-2021-25490.md): A keyblob downgrade attack in keymaster prior to SMR Oct-2021 Release 1 allows attacker to trigger IV reuse vulnerability with privileged pr (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2021-29903](https://cve.now/CVE-2021-29903.md): IBM Sterling B2B Integrator Standard Edition 5.2.6.0 through 6.1.1.0 is vulnerable to SQL injection. (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2021-29855](https://cve.now/CVE-2021-29855.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2021-29837](https://cve.now/CVE-2021-29837.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attack (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-29836](https://cve.now/CVE-2021-29836.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0. (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2021-25489](https://cve.now/CVE-2021-25489.md): Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format st (CVSS 3.3, KEV, Samsung Mobile Devices)
- [CVE-2021-29798](https://cve.now/CVE-2021-29798.md): IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.1.0 is vulnerable to SQL injection. (CVSS 6.3, IBM Sterling B2B Integrator)
- [CVE-2021-29764](https://cve.now/CVE-2021-29764.md): IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. (CVSS 6.4, IBM Sterling B2B Integrator)
- [CVE-2021-29761](https://cve.now/CVE-2021-29761.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-29760](https://cve.now/CVE-2021-29760.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files throug (CVSS 5.4, IBM Sterling B2B Integrator)
- [CVE-2021-25488](https://cve.now/CVE-2021-25488.md): Lack of boundary checking of a buffer in recv\_data() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2021-29758](https://cve.now/CVE-2021-29758.md): IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should n (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-25487](https://cve.now/CVE-2021-25487.md): Lack of boundary checking of a buffer in set\_skb\_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it res (CVSS 7.3, KEV, Samsung Mobile Devices)
- [CVE-2021-25486](https://cve.now/CVE-2021-25486.md): Exposure of information vulnerability in ipcdump prior to SMR Oct-2021 Release 1 allows an attacker detect device information via analyzing (CVSS 2.5, Samsung Mobile Devices)
- [CVE-2021-25485](https://cve.now/CVE-2021-25485.md): Path traversal vulnerability in FactoryAirCommnadManger prior to SMR Oct-2021 Release 1 allows attackers to write file as system UID via BT (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2021-25484](https://cve.now/CVE-2021-25484.md): Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25483](https://cve.now/CVE-2021-25483.md): Lack of boundary checking of a buffer in livfivextractor library prior to SMR Oct-2021 Release 1 allows OOB read. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25482](https://cve.now/CVE-2021-25482.md): SQL injection vulnerabilities in CMFA framework prior to SMR Oct-2021 Release 1 allow untrusted application to overwrite some CMFA framework (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2021-25481](https://cve.now/CVE-2021-25481.md): An improper error handling in Exynos CP booting driver prior to SMR Oct-2021 Release 1 allows local attackers to bypass a Secure Memory Prot (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2021-25480](https://cve.now/CVE-2021-25480.md): A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead t (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25479](https://cve.now/CVE-2021-25479.md): A possible heap-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and c (CVSS 7.2, Samsung Mobile Devices)
- [CVE-2021-25478](https://cve.now/CVE-2021-25478.md): A possible stack-based buffer overflow vulnerability in Exynos CP Chipset prior to SMR Oct-2021 Release 1 allows arbitrary memory write and (CVSS 7.2, Samsung Mobile Devices)
- [CVE-2021-25477](https://cve.now/CVE-2021-25477.md): An improper error handling in Mediatek RRC Protocol stack prior to SMR Oct-2021 Release 1 allows modem crash and remote denial of service. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25476](https://cve.now/CVE-2021-25476.md): An information disclosure vulnerability in Widevine TA log prior to SMR Oct-2021 Release 1 allows attackers to bypass the ASLR protection me (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2021-25475](https://cve.now/CVE-2021-25475.md): A possible heap-based buffer overflow vulnerability in DSP kernel driver prior to SMR Oct-2021 Release 1 allows arbitrary memory write and c (CVSS 3.9, Samsung Mobile Devices)
- [CVE-2021-25474](https://cve.now/CVE-2021-25474.md): Assuming a shell privilege is gained, an improper exception handling for multi\_sim\_bar\_show\_on\_qspanel value in SystemUI prior to SMR Oct-20 (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25473](https://cve.now/CVE-2021-25473.md): Assuming a shell privilege is gained, an improper exception handling for multi\_sim\_bar\_hide\_by\_meadia\_full value in SystemUI prior to SMR Oc (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25472](https://cve.now/CVE-2021-25472.md): An improper access control vulnerability in BluetoothSettingsProvider prior to SMR Oct-2021 Release 1 allows untrusted application to overwr (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2021-25471](https://cve.now/CVE-2021-25471.md): A lack of replay attack protection in Security Mode Command process prior to SMR Oct-2021 Release 1 can lead to denial of service on mobile (CVSS 3.7, Samsung Mobile Devices)
- [CVE-2021-25470](https://cve.now/CVE-2021-25470.md): An improper caller check logic of SMC call in TEEGRIS secure OS prior to SMR Oct-2021 Release 1 can be used to compromise TEE. (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2021-25469](https://cve.now/CVE-2021-25469.md): A possible stack-based buffer overflow vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows arbitrary code execution. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2021-25468](https://cve.now/CVE-2021-25468.md): A possible guessing and confirming a byte memory vulnerability in Widevine trustlet prior to SMR Oct-2021 Release 1 allows attackers to read (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2021-25467](https://cve.now/CVE-2021-25467.md): Assuming system privilege is gained, possible buffer overflow vulnerabilities in the Vision DSP kernel driver prior to SMR Oct-2021 Release (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2021-39351](https://cve.now/CVE-2021-39351.md): WP Bannerize 2.0.0 - 4.0.2 - Authenticated SQL Injection (CVSS 7.7, WP Bannerize)
- [CVE-2021-39350](https://cve.now/CVE-2021-39350.md): FV Flowplayer Video Player \<= 7.5.0.727 - 7.5.2.727 Reflected Cross-Site Scripting (CVSS 6.1, FV Flowplayer Video Player)
- [CVE-2021-20264](https://cve.now/CVE-2021-20264.md): An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. (no CVSS, containers/openjdk)
- [CVE-2021-0680](https://cve.now/CVE-2021-0680.md): In system properties, there is a possible information disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0681](https://cve.now/CVE-2021-0681.md): In system properties, there is a possible information disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0685](https://cve.now/CVE-2021-0685.md): In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserializatio (no CVSS, Android)
- [CVE-2021-0689](https://cve.now/CVE-2021-0689.md): In RGB\_to\_BGR1\_portable of SkSwizzler\_opts.h, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0635](https://cve.now/CVE-2021-0635.md): When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and (no CVSS, Android)
- [CVE-2021-0636](https://cve.now/CVE-2021-0636.md): When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, and (no CVSS, Android)
- [CVE-2021-0687](https://cve.now/CVE-2021-0687.md): In ellipsize of Layout.java, there is a possible ANR due to improper input validation. (no CVSS, Android)
- [CVE-2021-0691](https://cve.now/CVE-2021-0691.md): In the SELinux policy configured in system\_app.te, there is a possible way for system\_app to gain code execution in other processes due to a (no CVSS, Android)
- [CVE-2021-0683](https://cve.now/CVE-2021-0683.md): In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0693](https://cve.now/CVE-2021-0693.md): In openFile of HeapDumpProvider.java, there is a possible way to retrieve generated heap dumps from debuggable apps due to an unprotected pr (no CVSS, Android)
- [CVE-2021-0695](https://cve.now/CVE-2021-0695.md): In get\_sock\_stat of xt\_qtaguid.c, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2021-0690](https://cve.now/CVE-2021-0690.md): In ih264d\_mark\_err\_slice\_skip of ih264d\_parse\_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0644](https://cve.now/CVE-2021-0644.md): In conditionallyRemoveIdentifiers of SubscriptionController.java, there is a possible way to retrieve a trackable identifier due to a missin (no CVSS, Android)
- [CVE-2021-0598](https://cve.now/CVE-2021-0598.md): In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-0684](https://cve.now/CVE-2021-0684.md): In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0692](https://cve.now/CVE-2021-0692.md): In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-0686](https://cve.now/CVE-2021-0686.md): In getDefaultSmsPackage of RoleManagerService.java, there is a possible way to get information about the default sms app of a different devi (no CVSS, Android)
- [CVE-2021-0595](https://cve.now/CVE-2021-0595.md): In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after loggin (no CVSS, Android)
- [CVE-2021-0688](https://cve.now/CVE-2021-0688.md): In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. (no CVSS, Android)
- [CVE-2021-0682](https://cve.now/CVE-2021-0682.md): In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due to a missing permissio (no CVSS, Android)
- [CVE-2021-28702](https://cve.now/CVE-2021-28702.md): PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Res (no CVSS, xen)
- [CVE-2020-19003](https://cve.now/CVE-2020-19003.md): An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances u (no CVSS, gateone)
- [CVE-2021-33602](https://cve.now/CVE-2021-33602.md): Denial-of-Service (DoS) Vulnerability (CVSS 5.5, F-Secure endpoint protection products on Windows and Mac. F…)
- [CVE-2021-3848](https://cve.now/CVE-2021-3848.md): An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Securit (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-24021](https://cve.now/CVE-2021-24021.md): An improper neutralization of input vulnerability \[CWE-79\] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below m (CVSS 4.3, Fortinet FortiAnalyzer)
- [CVE-2021-24019](https://cve.now/CVE-2021-24019.md): An insufficient session expiration vulnerability \[CWE- 613\] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacke (CVSS 8.1, Fortinet FortiClientEMS)
- [CVE-2021-36175](https://cve.now/CVE-2021-36175.md): An improper neutralization of input vulnerability \[CWE-79\] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote a (CVSS 4.1, Fortinet FortiWebManager)
- [CVE-2020-15941](https://cve.now/CVE-2020-15941.md): A path traversal vulnerability \[CWE-22\] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authenticated attacker to i (CVSS 5.4, Fortinet FortiClientEMS)
- [CVE-2021-36170](https://cve.now/CVE-2021-36170.md): An information disclosure vulnerability \[CWE-200\] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and below may allow an auth (CVSS 3.2, Fortinet FortiManager, FortiAnalyzer)
- [CVE-2021-36178](https://cve.now/CVE-2021-36178.md): A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose third-party devices (CVSS 4.3, Fortinet FortiSDNConnector)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.