# CVEs published 2021-10-11

66 CVEs were published on October 11, 2021: 1 critical, 3 high. Days are UTC.

- [CVE-2021-23448](https://cve.now/CVE-2021-23448.md): Prototype Pollution (CVSS 6.5, config-handler)
- [CVE-2021-25738](https://cve.now/CVE-2021-25738.md): Code exec via yaml parsing (CVSS 6.7, Kubernetes Java Client · io.kubernetes:client-java)
- [CVE-2021-42252](https://cve.now/CVE-2021-42252.md): An issue was discovered in aspeed\_lpc\_ctrl\_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. (no CVSS)
- [CVE-2021-40188](https://cve.now/CVE-2021-40188.md): PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. (no CVSS)
- [CVE-2021-40617](https://cve.now/CVE-2021-40617.md): An SQL Injection vulnerability exists in openSIS Community Edition version 8.0 via ForgotPassUserName.php. (no CVSS)
- [CVE-2021-40189](https://cve.now/CVE-2021-40189.md): PHPFusion 9.03.110 is affected by a remote code execution vulnerability. (no CVSS)
- [CVE-2021-40239](https://cve.now/CVE-2021-40239.md): A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do\_retr function in ftpproto.c (no CVSS)
- [CVE-2020-27372](https://cve.now/CVE-2020-27372.md): A buffer overflow vulnerability exists in Brandy Basic V Interpreter 1.21 in the run\_interpreter function. (no CVSS)
- [CVE-2021-41117](https://cve.now/CVE-2021-41117.md): Insecure random number generation (CVSS 8.7, juliangruber keypair · keypair)
- [CVE-2021-20122](https://cve.now/CVE-2021-20122.md): The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multi (no CVSS, Telus Wi-Fi Hub)
- [CVE-2021-20121](https://cve.now/CVE-2021-20121.md): The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. (no CVSS, Telus Wi-Fi Hub)
- [CVE-2021-22263](https://cve.now/CVE-2021-22263.md): An issue has been discovered in GitLab affecting all versions starting from 13.0 before 14.0.9, all versions starting from 14.1 before 14.1. (CVSS 5.5, GitLab)
- [CVE-2021-26588](https://cve.now/CVE-2021-26588.md): A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmwar (no CVSS, HP 3PAR StoreServ 10000 Storage; HP 3PAR StoreServ 7000 Sto…)
- [CVE-2021-25633](https://cve.now/CVE-2021-25633.md): Content Manipulation with Double Certificate Attack (no CVSS, The Document Foundation LibreOffice)
- [CVE-2021-27002](https://cve.now/CVE-2021-27002.md): NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retr (no CVSS, Cloud Manager)
- [CVE-2021-37123](https://cve.now/CVE-2021-37123.md): There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. (no CVSS, Hero-CT060)
- [CVE-2021-0583](https://cve.now/CVE-2021-0583.md): In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-39317](https://cve.now/CVE-2021-39317.md): AccessPress Themes - Authenticated Malicious File Upload (CVSS 8.8, AccessPress Themes Access Demo Importer · AccessPress T… +37)
- [CVE-2021-27665](https://cve.now/CVE-2021-27665.md): exacqVision Server 32-bit (CVSS 7.5, Johnson Controls exacqVision Web Service)
- [CVE-2021-27664](https://cve.now/CVE-2021-27664.md): exacqVision Web Service (CVSS 9.8, Johnson Controls exacqVision Web Service)
- [CVE-2021-40191](https://cve.now/CVE-2021-40191.md): Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in we (no CVSS)
- [CVE-2021-40541](https://cve.now/CVE-2021-40541.md): PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An aut (no CVSS)
- [CVE-2021-40542](https://cve.now/CVE-2021-40542.md): Opensis-Classic Version 8.0 is affected by cross-site scripting (XSS). (no CVSS)
- [CVE-2021-40543](https://cve.now/CVE-2021-40543.md): Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $\_GET (no CVSS)
- [CVE-2021-29005](https://cve.now/CVE-2021-29005.md): Insecure permission of chmod command on rConfig server 3.9.6 exists. (no CVSS)
- [CVE-2021-29006](https://cve.now/CVE-2021-29006.md): rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. (no CVSS)
- [CVE-2021-29004](https://cve.now/CVE-2021-29004.md): rConfig 3.9.6 is affected by SQL Injection. (no CVSS)
- [CVE-2021-40884](https://cve.now/CVE-2021-40884.md): Projectsend version r1295 is affected by sensitive information disclosure. (no CVSS)
- [CVE-2021-24737](https://cve.now/CVE-2021-24737.md): Comments - wpDiscuz \<= 7.3.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Comments – wpDiscuz)
- [CVE-2021-24720](https://cve.now/CVE-2021-24720.md): GeoDirectory \< 2.1.1.3 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Business Directory Plugin | GeoDirectory)
- [CVE-2021-24719](https://cve.now/CVE-2021-24719.md): Enfold Theme \< 4.8.4 - Reflected Cross-Site Scripting (XSS) (no CVSS, Enfold)
- [CVE-2021-24712](https://cve.now/CVE-2021-24712.md): Appointment Hour Booking – WordPress Booking Plugin \< 1.3.17 - Authenticated Stored XSS (no CVSS, Appointment Hour Booking – WordPress Booking Plugin)
- [CVE-2021-24711](https://cve.now/CVE-2021-24711.md): Software License Manager \< 4.5.1 - Arbitrary Domain Deletion via CSRF (no CVSS, Software License Manager)
- [CVE-2021-24709](https://cve.now/CVE-2021-24709.md): Weather Effect \< 1.3.6 - Admin+ Stored Cross-Site Scripting (no CVSS, Weather Effect – Christmas Santa Snow Falling)
- [CVE-2021-24691](https://cve.now/CVE-2021-24691.md): Quiz And Survey Master \< 7.3.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Quiz And Survey Master – Best Quiz, Exam and Survey Plugin…)
- [CVE-2021-24690](https://cve.now/CVE-2021-24690.md): Chained Quiz \< 1.2.7.2 - Authenticated Stored Cross Site Scripting (no CVSS, Chained Quiz)
- [CVE-2021-24683](https://cve.now/CVE-2021-24683.md): Weather Effect \< 1.3.4 - CSRF to Stored Cross-Site Scripting (no CVSS, Weather Effect – Christmas Santa Snow Falling)
- [CVE-2021-24681](https://cve.now/CVE-2021-24681.md): Duplicate Page \<= 4.4.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Duplicate Page)
- [CVE-2021-24656](https://cve.now/CVE-2021-24656.md): Simple Social Media Share Buttons \< 3.2.4 - Authenticated Stored Cross-Site Scripting (no CVSS, Simple Social Media Share Buttons – Social Sharing for Ever…)
- [CVE-2021-24651](https://cve.now/CVE-2021-24651.md): Poll Maker \< 3.4.2 - Unauthenticated Time Based SQL Injection (no CVSS, Poll Maker)
- [CVE-2021-24577](https://cve.now/CVE-2021-24577.md): Coming Soon and Maintenance Mode \< 3.5.3 - Authenticated Stored XSS (no CVSS, Coming soon and Maintenance mode)
- [CVE-2021-24576](https://cve.now/CVE-2021-24576.md): Easy Accordion \< 2.0.22 - Authenticated Stored XSS (no CVSS, Easy Accordion – Best Accordion FAQ Plugin for WordPress)
- [CVE-2021-24563](https://cve.now/CVE-2021-24563.md): Frontend Uploader \<= 1.3.2 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Frontend Uploader)
- [CVE-2021-24546](https://cve.now/CVE-2021-24546.md): EditorsKit \< 1.31.6 - Contributor+ Arbitrary PHP Code Execution (no CVSS, Gutenberg Block Editor Toolkit – EditorsKit)
- [CVE-2021-24545](https://cve.now/CVE-2021-24545.md): WP HTML Author Bio \<= 1.2.0 - Author+ Stored Cross-Site Scripting (no CVSS, WP HTML Author Bio)
- [CVE-2021-40886](https://cve.now/CVE-2021-40886.md): Projectsend version r1295 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-40887](https://cve.now/CVE-2021-40887.md): Projectsend version r1295 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-40888](https://cve.now/CVE-2021-40888.md): Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() fu (no CVSS)
- [CVE-2021-40889](https://cve.now/CVE-2021-40889.md): CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. (no CVSS)
- [CVE-2021-35060](https://cve.now/CVE-2021-35060.md): /way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response differences to discover whethe (no CVSS)
- [CVE-2021-35059](https://cve.now/CVE-2021-35059.md): OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter. (no CVSS)
- [CVE-2021-41832](https://cve.now/CVE-2021-41832.md): Content Manipulation with Certificate Validation Attack (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2021-41831](https://cve.now/CVE-2021-41831.md): Timestamp Manipulation with Signature Wrapping (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2021-41830](https://cve.now/CVE-2021-41830.md): Double Certificate Attack (no CVSS, Apache Software Foundation Apache OpenOffice)
- [CVE-2021-41801](https://cve.now/CVE-2021-41801.md): The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. (no CVSS)
- [CVE-2021-42139](https://cve.now/CVE-2021-42139.md): Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations. (no CVSS)
- [CVE-2021-42137](https://cve.now/CVE-2021-42137.md): An issue was discovered in Zammad before 5.0.1. (no CVSS)
- [CVE-2021-42135](https://cve.now/CVE-2021-42135.md): HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Clo (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-41055](https://cve.now/CVE-2021-41055.md): Gajim 1.2.x and 1.3.x before 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted XMPP Last Message Correction ( (no CVSS)
- [CVE-2021-42134](https://cve.now/CVE-2021-42134.md): The Unicorn framework before 0.36.1 for Django allows XSS via a component. (no CVSS, django-unicorn)
- [CVE-2021-32028](https://cve.now/CVE-2021-32028.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-41798](https://cve.now/CVE-2021-41798.md): MediaWiki before 1.36.2 allows XSS. (no CVSS)
- [CVE-2021-41799](https://cve.now/CVE-2021-41799.md): MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). (no CVSS)
- [CVE-2021-41800](https://cve.now/CVE-2021-41800.md): MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). (no CVSS, mediawiki/core)
- [CVE-2021-42257](https://cve.now/CVE-2021-42257.md): check\_smart before 6.9.1 allows unintended drive access by an unprivileged user because it only checks for a substring match of a device pat (no CVSS)
- [CVE-2021-42260](https://cve.now/CVE-2021-42260.md): TinyXML through 2.6.2 has an infinite loop in TiXmlParsingData::Stamp in tinyxmlparser.cpp via the TIXML\_UTF\_LEAD\_0 case. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.