CVEs published October 7, 2021
70 CVEs were published on October 7, 2021: 3 critical, 2 high. 1 is now in CISA KEV.
- Published
- 70
- Critical
- 3
- High
- 2
- Medium
- 15
- Low
- 0
- Unrated
- 50
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- IBM Sterling File Gateway
- 9
- Ártica Integria IMS
- 3
- Adobe Acrobat Reader
- 2
- Apache Software Foundation Apache OpenOffice
- 2
- IBM Sterling B2B Integrator
- 2
- Apache Software Foundation Apache HTTP Server
- 1
- cloudendpoints esp
- 1
- django-unicorn
- 1
- https://github.com/concrete5/concrete5 · concrete5/concrete5
- 1
- mkdocs
- 1
Critical 3
- CVE-2021-42013Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)Apache Software Foundation Apache HTTP Server
- CVE-2021-3833Integria IMS incorrect authorizationÁrtica Integria IMS
- CVE-2021-3832Integria IMS Remote Code ExecutionÁrtica Integria IMS
High 2
Medium, low and unrated 65
- CVE-2021-25271A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.Sophos HitmanPro
- CVE-2021-25270A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.Sophos HitmanPro.Alert
- CVE-2021-41115Regular expression denial-of-service in Zulipzulip
- CVE-2021-38298Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.
- CVE-2020-21729JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which allows attackers to
- CVE-2020-21726OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid parameter.
- CVE-2020-21725OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid parameter.
- CVE-2021-42095Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.
- CVE-2020-21865ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.
- CVE-2021-42084An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42085An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42086An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42087An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42088An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42089An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42090An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42091An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42092An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42093An issue was discovered in Zammad before 4.1.1.
- CVE-2021-42094An issue was discovered in Zammad before 4.1.1.
- CVE-2021-41130X-Endpoint-API-UserInfo can be spoofed in cloudendpoints Extensible Service Proxycloudendpoints esp
- CVE-2021-29700IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sensitive information fIBM Sterling B2B Integrator
- CVE-2021-20584IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by improper access controlIBM Sterling File Gateway
- CVE-2021-20571IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting.IBM Sterling B2B Integrator
- CVE-2021-20561IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2021-20552IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical erIBM Sterling File Gateway
- CVE-2021-20489IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicIBM Sterling File Gateway
- CVE-2021-20481IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting.IBM Sterling File Gateway
- CVE-2021-20473IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could allow an authenticatedIBM Sterling File Gateway
- CVE-2021-20376IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to there being an observaIBM Sterling File Gateway
- CVE-2021-20375IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user IBM Sterling File Gateway
- CVE-2021-20372IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another user's service due toIBM Sterling File Gateway
- CVE-2021-23447Cross-site Scripting (XSS)teddy
- CVE-2021-42071In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/
- CVE-2021-40439Billion LaughsApache Software Foundation Apache OpenOffice
- CVE-2021-28129DEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupidApache Software Foundation Apache OpenOffice
- CVE-2021-37762Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file overwrite leading to remote code execution.
- CVE-2021-37919Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37920Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37921Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37923Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37924Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37922Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to path traversal which allows copying of files from one directory to
- CVE-2021-37918Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37931Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37930Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37929Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37928Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-37926Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.
- CVE-2021-3834Integria IMS vulnerable to Cross Site Scripting (XSS)Ártica Integria IMS
- CVE-2021-41794ogs_fqdn_parse in Open5GS 1.0.0 through 2.3.3 inappropriately trusts a client-supplied length value, leading to a buffer overflow.
- CVE-2021-33903In LCOS 10.40 to 10.42.0473-RU3 with SNMPv3 enabled on LANCOM devices, changing the password of the root user via the CLI does not change th
- CVE-2021-35067Meross MSG100 devices before 3.2.3 allow an attacker to replay the same data or similar data (e.g., an attacker who sniffs a Close message c
- CVE-2021-28661Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.silverstripe/graphql
- CVE-2021-36150SilverStripe Framework through 4.8.1 allows XSS.silverstripe/admin
- CVE-2021-41865HashiCorp Nomad and Nomad Enterprise 1.1.1 through 1.1.5 allowed authenticated users with job submission capabilities to cause denial of ser
- CVE-2021-22958A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the https://github.com/concrete5/concrete5 · concrete5/concrete5
- CVE-2021-40978The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive informkdocs
- CVE-2021-32172Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.
- CVE-2021-41770Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.
- CVE-2021-42054ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.
- CVE-2021-42053The Unicorn framework through 0.35.3 for Django allows XSS via component.name.django-unicorn
- CVE-2021-26557When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user Octopus Deploy Octopus Tentacle
- CVE-2021-26556When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user usOctopus Deploy Octopus Server
- CVE-2021-22930Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory cNodeJS Node