CVEs published October 12, 2021
72 CVEs were published on October 12, 2021: 6 critical, 8 high.
- Published
- 72
- Critical
- 6
- High
- 8
- Medium
- 6
- Low
- 1
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Siemens SINEC NMS
- 15
- HPE Aruba Instant
- 6
- Moxa MXview Network Management Software
- 5
- SAP SE SAP NetWeaver AS ABAP and ABAP Platform
- 4
- zephyrproject-rtos zephyr
- 4
- TIBCO Software TIBCO JasperReports Server
- 3
- Anker
- 2
- IBM Data Risk Manager
- 2
- SAP SE SAP Business One
- 2
- Apache Software Foundation Apache Traffic Control · github.…
- 1
Critical 6
- CVE-2021-35495TIBCO JasperReports FTP Password exposedTIBCO Software TIBCO JasperReports Server
- CVE-2021-38458Moxa MXview Network Management SoftwareMoxa MXview Network Management Software
- CVE-2021-38454Moxa MXview Network Management SoftwareMoxa MXview Network Management Software
- CVE-2021-38456Moxa MXview Network Management SoftwareMoxa MXview Network Management Software
- CVE-2021-21941A use-after-free vulnerability exists in the pushMuxer CreatePushThread functionality of Anker Eufy Homebase 2 2.1.6.9h.Anker
- CVE-2021-21940A heap-based buffer overflow vulnerability exists in the pushMuxer processRtspInfo functionality of Anker Eufy Homebase 2 2.1.6.9h.Anker
High 8
- CVE-2021-3330RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyrzephyrproject-rtos zephyr
- CVE-2021-3323Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyrzephyrproject-rtos zephyr
- CVE-2021-3321Integer Underflow in Zephyr in IEEE 802154 Fragment Reassembly Header Removalzephyrproject-rtos zephyr
- CVE-2021-29645Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading
- CVE-2021-29644Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow.
- CVE-2021-35496TIBCO JasperReports XML Eternal Entity (XXE) vulnerabilityTIBCO Software TIBCO JasperReports Server
- CVE-2021-38460Moxa MXview Network Management SoftwareMoxa MXview Network Management Software
- CVE-2021-38452Moxa MXview Network Management SoftwareMoxa MXview Network Management Software
Medium, low and unrated 58
- CVE-2021-20031A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary wSonicWall SonicOS
- CVE-2021-3322Unexpected Pointer Aliasing in IEEE 802154 Fragment Reassembly in Zephyrzephyrproject-rtos zephyr
- CVE-2020-22673Memory leak in the senc_Parse function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input.
- CVE-2020-22674An issue was discovered in gpac 0.8.0.
- CVE-2020-22675An issue was discovered in gpac 0.8.0.
- CVE-2020-22677An issue was discovered in gpac 0.8.0.
- CVE-2020-22678An issue was discovered in gpac 0.8.0.
- CVE-2020-22679Memory leak in the sgpd_parse_entry function in MP4Box in gpac 0.8.0 allows attackers to cause a denial of service (DoS) via a crafted input
- CVE-2021-39184Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage APIelectron
- CVE-2021-42325Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.froxlor/froxlor
- CVE-2021-38915IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user.IBM Data Risk Manager
- CVE-2021-38862IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitiIBM Data Risk Manager
- CVE-2021-42326Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
- CVE-2021-27003Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a cliClustered Data ONTAP
- CVE-2021-40618An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT
- CVE-2021-35494TIBCO JasperReports unauthorized access to temporary objectTIBCO Software TIBCO JasperReports Server
- CVE-2021-40292A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.
- CVE-2021-41136Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in pumapuma
- CVE-2021-35214Session Management VulnerabilitySolarWinds Pingdom
- CVE-2021-37734A remote unauthorized read access to files vulnerability was discovered in Aruba Instant version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and below; ArHPE Aruba Instant
- CVE-2021-37735A remote denial of service vulnerability was discovered in Aruba Instant version(s): Aruba Instant 6.5.x.x: 6.5.4.18 and below; Aruba InstanHPE Aruba Instant
- CVE-2021-37732A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.HPE Aruba Instant
- CVE-2021-37727A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): 6.4.x.x: 6.4.4.8-4.2.4.18 and belowHPE Aruba Instant
- CVE-2021-37730A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 6.4.x.x: 6.4.4.8-4.2.HPE Aruba Instant
- CVE-2021-37726A remote buffer overflow vulnerability was discovered in HPE Aruba Instant (IAP) version(s): Aruba Instant 8.7.x.x: 8.7.0.0 through 8.7.1.2.HPE Aruba Instant
- CVE-2021-40500SAP BusinessObjects Business Intelligence Platform (Crystal Reports) - versions 420, 430, allows an unauthenticated attacker to exploit missSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2021-40498A vulnerability has been identified in SAP SuccessFactors Mobile Application for Android - versions older than 2108, which allows an attackeSAP SE SAP SuccessFactors Mobile Application
- CVE-2021-38183SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential SAP SE SAP NetWeaver
- CVE-2021-40499Client-side printing services SAP Cloud Print Manager and SAPSprint for SAP NetWeaver Application Server for ABAP - versions 7.70, 7.70 PI, SAP SE SAP NetWeaver Application Server for ABAP
- CVE-2021-40496SAP Internet Communication framework (ICM) - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 785, allows an attackSAP SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-38180SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel (CSV injection) due to improper sanitatiSAP SE SAP Business One
- CVE-2021-38178The software logistics system of SAP NetWeaver AS ABAP and ABAP Platform versions - 700, 701, 702, 710, 730, 731, 740, 750, 751, 752, 753, 7SAP SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-40497SAP BusinessObjects Analysis (edition for OLAP) - versions 420, 430, allows an attacker to exploit certain application endpoints to read senSAP SE SAP BusinessObjects Analysis,
- CVE-2021-40495There are multiple Denial-of Service vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 740, 750, 751SAP SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-38181SAP NetWeaver AS ABAP and ABAP Platform - versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allows an attacker to prSAP SE SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2021-38179Debug function of Admin UI of SAP Business One Integration is enabled by default.SAP SE SAP Business One
- CVE-2021-25634Timestamp Manipulation with Signature WrappingThe Document Foundation LibreOffice
- CVE-2020-28145Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attacker
- CVE-2021-41546A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.14.1), RUGGEDCOM ROX RX1400 (All versions < V2.14.1), RUGGEDCSiemens RUGGEDCOM ROX MX5000 · Siemens RUGGEDCOM ROX RX1… +8
- CVE-2021-37199A vulnerability has been identified in SINUMERIK 808D (All versions), SINUMERIK 828D (All versions < V4.95).Siemens SINUMERIK
- CVE-2021-33736A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33734A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33735A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33733A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33732A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33731A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33730A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33729A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33728A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33726A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33727A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33725A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33724A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33723A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-33722A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).Siemens SINEC NMS
- CVE-2021-27395A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versioSiemens SIMATIC Process Historian 2013 and earlier · Siemen…
- CVE-2021-42009Apache Traffic Control Traffic Ops Email Injection VulnerabilityApache Software Foundation Apache Traffic Control · github.…
- CVE-2021-3671A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ (Ticket Granting Server - Request).Samba