CVEs published October 11, 2021
66 CVEs were published on October 11, 2021: 1 critical, 3 high.
- Published
- 66
- Critical
- 1
- High
- 3
- Medium
- 3
- Low
- 0
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Apache Software Foundation Apache OpenOffice
- 3
- Johnson Controls exacqVision Web Service
- 2
- Telus Wi-Fi Hub
- 2
- Weather Effect – Christmas Santa Snow Falling
- 2
- AccessPress Themes Access Demo Importer · AccessPress T… +37
- 1
- Android
- 1
- Appointment Hour Booking – WordPress Booking Plugin
- 1
- Business Directory Plugin | GeoDirectory
- 1
- Chained Quiz
- 1
- Cloud Manager
- 1
Critical 1
High 3
Medium, low and unrated 62
- CVE-2021-23448Prototype Pollutionconfig-handler
- CVE-2021-25738Code exec via yaml parsingKubernetes Java Client · io.kubernetes:client-java
- CVE-2021-42252An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6.
- CVE-2021-40188PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability.
- CVE-2021-40617An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php.
- CVE-2021-40189PHPFusion 9.03.110 is affected by a remote code execution vulnerability.
- CVE-2021-40239A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c
- CVE-2020-27372A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run_interpreter function.
- CVE-2021-20122The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multiTelus Wi-Fi Hub
- CVE-2021-20121The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read.Telus Wi-Fi Hub
- CVE-2021-22263An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1.GitLab
- CVE-2021-26588A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmwarHP 3PAR StoreServ 10000 Storage; HP 3PAR StoreServ 7000 Sto…
- CVE-2021-25633Content Manipulation with Double Certificate AttackThe Document Foundation LibreOffice
- CVE-2021-27002NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrCloud Manager
- CVE-2021-37123There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200.Hero-CT060
- CVE-2021-0583In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack.Android
- CVE-2021-40191Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in we
- CVE-2021-40541PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An aut
- CVE-2021-40542Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS).
- CVE-2021-40543Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET
- CVE-2021-29005Insecure permission of chmod command on rConfig server 3.9.6 exists.
- CVE-2021-29006rConfig 3.9.6 is affected by a Local File Disclosure vulnerability.
- CVE-2021-29004rConfig 3.9.6 is affected by SQL Injection.
- CVE-2021-40884Projectsend version r1295 is affected by sensitive information disclosure.
- CVE-2021-24737Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site ScriptingComments – wpDiscuz
- CVE-2021-24720GeoDirectory < 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS)Business Directory Plugin | GeoDirectory
- CVE-2021-24719Enfold Theme < 4.8.4 - Reflected Cross-Site Scripting (XSS)Enfold
- CVE-2021-24712Appointment Hour Booking – WordPress Booking Plugin < 1.3.17 - Authenticated Stored XSSAppointment Hour Booking – WordPress Booking Plugin
- CVE-2021-24711Software License Manager < 4.5.1 - Arbitrary Domain Deletion via CSRFSoftware License Manager
- CVE-2021-24709Weather Effect < 1.3.6 - Admin+ Stored Cross-Site ScriptingWeather Effect – Christmas Santa Snow Falling
- CVE-2021-24691Quiz And Survey Master < 7.3.2 - Admin+ Stored Cross-Site ScriptingQuiz And Survey Master – Best Quiz, Exam and Survey Plugin…
- CVE-2021-24690Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site ScriptingChained Quiz
- CVE-2021-24683Weather Effect < 1.3.4 - CSRF to Stored Cross-Site ScriptingWeather Effect – Christmas Santa Snow Falling
- CVE-2021-24681Duplicate Page <= 4.4.2 - Admin+ Stored Cross-Site ScriptingDuplicate Page
- CVE-2021-24656Simple Social Media Share Buttons < 3.2.4 - Authenticated Stored Cross-Site ScriptingSimple Social Media Share Buttons – Social Sharing for Ever…
- CVE-2021-24651Poll Maker < 3.4.2 - Unauthenticated Time Based SQL InjectionPoll Maker
- CVE-2021-24577Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSSComing soon and Maintenance mode
- CVE-2021-24576Easy Accordion < 2.0.22 - Authenticated Stored XSSEasy Accordion – Best Accordion FAQ Plugin for WordPress
- CVE-2021-24563Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site ScriptingFrontend Uploader
- CVE-2021-24546EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code ExecutionGutenberg Block Editor Toolkit – EditorsKit
- CVE-2021-24545WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site ScriptingWP HTML Author Bio
- CVE-2021-40886Projectsend version r1295 is affected by a directory traversal vulnerability.
- CVE-2021-40887Projectsend version r1295 is affected by a directory traversal vulnerability.
- CVE-2021-40888Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() fu
- CVE-2021-40889CMSUno version 1.7.2 is affected by a PHP code execution vulnerability.
- CVE-2021-35060/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whethe
- CVE-2021-35059OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.
- CVE-2021-41832Content Manipulation with Certificate Validation AttackApache Software Foundation Apache OpenOffice
- CVE-2021-41831Timestamp Manipulation with Signature WrappingApache Software Foundation Apache OpenOffice
- CVE-2021-41830Double Certificate AttackApache Software Foundation Apache OpenOffice
- CVE-2021-41801The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control.
- CVE-2021-42139Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.
- CVE-2021-42137An issue was discovered in Zammad before 5.0.1.
- CVE-2021-42135HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Clogithub.com/hashicorp/vault
- CVE-2021-41055Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction (
- CVE-2021-42134The Unicorn framework before 0.36.1 for Django allows XSS via a component.django-unicorn
- CVE-2021-32028A flaw was found in postgresql.postgresql
- CVE-2021-41798MediaWiki before 1.36.2 allows XSS.
- CVE-2021-41799MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time).
- CVE-2021-41800MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time).mediawiki/core
- CVE-2021-42257check_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device pat
- CVE-2021-42260TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML_UTF_LEAD_0 case.