CVEs published October 13, 2021
116 CVEs were published on October 13, 2021: 2 critical, 51 high. 5 are now in CISA KEV.
- Published
- 116
- Critical
- 2
- High
- 51
- Medium
- 27
- Low
- 0
- Unrated
- 36
- Now in CISA KEV
- 5
- Fix available
- 74
Most affected products
- Microsoft Windows
- 39
- Cybozu Remote Service
- 13
- Draytek VigorConnect
- 7
- Microsoft Office · Microsoft 365 Apps for Enterprise
- 5
- Microsoft Windows Server
- 4
- Microsoft SharePoint Enterprise Server · Microsoft Share… +1
- 3
- Microsoft Windows Server · Microsoft Windows
- 3
- ManageEngine ADManager Plus Build
- 2
- Microsoft Dynamics 365 (on-premises)
- 2
- Microsoft Exchange Server 2016 Cumulative Update · Microsof…
- 2
Critical 2
High 51
- CVE-2021-41139Reflected XSS vulnerability in time.phpanuko timetracker
- CVE-2021-3057GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or GatewayPalo Alto Networks GlobalProtect App
- CVE-2021-20124A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint.Draytek VigorConnect
- CVE-2021-20123A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet eDraytek VigorConnect
- CVE-2021-41137Bypassing policy restrictions on regular usersminio
- CVE-2021-41357Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41352SCOM Information Disclosure VulnerabilityMicrosoft System Center 2016 Operations Manager · Micros… +1
- CVE-2021-41348Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2021-41347Windows AppX Deployment Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41345Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41344Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-41340Windows Graphics Component Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-41335Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41334Windows Desktop Bridge Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41331Windows Media Audio Decoder Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-41330Microsoft Windows Media Foundation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-40489Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40488Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40487Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-40486Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +2
- CVE-2021-40485Microsoft Excel Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server 2013 Service Pack… +2
- CVE-2021-40484Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2021-40483Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Server
- CVE-2021-40481Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-40480Microsoft Office Visio Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-40479Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-40478Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40477Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40476Windows AppContainer Elevation Of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40474Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-40473Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-40471Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2021-40470DirectX Graphics Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40469Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2021-40467Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40466Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40465Windows Text Shaping Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-40464Windows Nearby Sharing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40463Windows Network Address Translation (NAT) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-40462Windows Media Foundation Dolby Digital Atmos Decoders Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-40461Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-40457Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting VulnerabilityMicrosoft Dynamics 365 Customer Engagement
- CVE-2021-40450Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40449Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40443Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-38672Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-36970Windows Print Spooler Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-36953Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-34453Microsoft Exchange Server Denial of Service VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2021-26442Windows HTTP.sys Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-26441Storage Spaces Controller Elevation of Privilege VulnerabilityMicrosoft Windows
Medium, low and unrated 63
- CVE-2021-41075The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.
- CVE-2021-40493Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module.
- CVE-2021-26318Side-channels Related to the x86 PREFETCH InstructionAMD All supported processors
- CVE-2021-42224SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php.
- CVE-2021-42223Cross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in view-booking-detail.php.
- CVE-2021-20131ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uManageEngine ADManager Plus Build
- CVE-2021-20130ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uManageEngine ADManager Plus Build
- CVE-2021-40842Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console.
- CVE-2021-40843Proofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in the Web Console.
- CVE-2021-40732XMP Toolkit SDK Null Pointer DereferenceAdobe XMP Toolkit
- CVE-2021-22036VMware vRealize Orchestrator ((8.x prior to 8.6) contains an open redirect vulnerability due to improper path handling.VMware vRealize Orchestrator
- CVE-2021-22035VMware vRealize Log Insight (8.x prior to 8.6) contains a CSV(Comma Separated Value) injection vulnerability in interactive analytics exportVMware vRealize Log Insight
- CVE-2021-20129An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs.Draytek VigorConnect
- CVE-2021-20128The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as uDraytek VigorConnect
- CVE-2021-20127An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-Draytek VigorConnect
- CVE-2021-20126Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, coDraytek VigorConnect
- CVE-2021-20125An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigDraytek VigorConnect
- CVE-2021-22033Releases prior to VMware vRealize Operations 8.6 contain a Server Side Request Forgery (SSRF) vulnerability.VMware vRealize Operations
- CVE-2021-41138Validity check for signed Frontier-specific extrinsic not called in block executionparitytech frontier · pallet-ethereum
- CVE-2021-39304Proofpoint Enterprise Protection before 8.12.0-2108090000 allows security control bypass.
- CVE-2021-34814Proofpoint Spam Engine before 8.12.0-2106240000 has a Security Control Bypass.
- CVE-2021-33609Denial of service in DataCommunicator class in Vaadin 8Vaadin · vaadin-server +1
- CVE-2021-20834Improper authorization in handler for custom URL scheme vulnerability in Nike App for Android versions prior to 2.177 and Nike App for iOS vNike App for Android versions prior to 2.177 and Nike App f…
- CVE-2021-20833The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle atSODA SNKRDUNK Market Place App for iOS
- CVE-2021-20832InBody App for iOS versions prior to 2.3.30 and InBody App for Android versions prior to 2.2.90(510) contain a vulnerability which may lead InBody Japan InBody App for iOS versions prior to 2.3.30 an…
- CVE-2021-20831Cross-site request forgery (CSRF) vulnerability in OG Tags versions prior to 2.0.2 allows a remote attacker to hijack the authentication of Mario Valney OG Tags
- CVE-2021-20807Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.0.0 to 3.1.9 allows a remote attacker to inject an arCybozu Remote Service
- CVE-2021-20806Open redirect vulnerability in Cybozu Remote Service 3.0.0 to 3.1.9 allows remote attackers to redirect users to arbitrary web sites and conCybozu Remote Service
- CVE-2021-20805Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.7 to 3.1.9 allows a remote authenticated attacker tCybozu Remote Service
- CVE-2021-20804Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to cause a denial of service (DoS) condition via unspecified vecCybozu Remote Service
- CVE-2021-20803Operation restriction bypass in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to alteCybozu Remote Service
- CVE-2021-20802HTTP header injection vulnerability in Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker to alter the information stored in the Cybozu Remote Service
- CVE-2021-20801Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker to conduct XML External Entity (XXE) attacks and obtain the infoCybozu Remote Service
- CVE-2021-20800Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to inject Cybozu Remote Service
- CVE-2021-20799Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker tCybozu Remote Service
- CVE-2021-20798Cross-site scripting vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote authenticated attacker tCybozu Remote Service
- CVE-2021-20797Cross-site script inclusion vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to Cybozu Remote Service
- CVE-2021-20796Directory traversal vulnerability in the management screen of Cybozu Remote Service 3.1.8 allows a remote authenticated attacker to upload aCybozu Remote Service
- CVE-2021-20795Cross-site request forgery (CSRF) vulnerability in the management screen of Cybozu Remote Service 3.1.8 to 3.1.9 allows a remote attacker toCybozu Remote Service
- CVE-2021-41363Intune Management Extension Security Feature Bypass VulnerabilityMicrosoft Intune management extension
- CVE-2021-41361Active Directory Federation Server Spoofing VulnerabilityMicrosoft Windows Server
- CVE-2021-41355.NET Core and Visual Studio Information Disclosure VulnerabilityMicrosoft PowerShell · Microsoft Visual Studio +2
- CVE-2021-41354Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2021-41353Microsoft Dynamics 365 (on-premises) Spoofing VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2021-41350Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2021-41346Console Window Host Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-41343Windows Fast FAT File System Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-41342Windows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-41339Microsoft DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41338Windows AppContainer Firewall Rules Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-41337Active Directory Security Feature Bypass VulnerabilityMicrosoft Windows Server
- CVE-2021-41336Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2021-41332Windows Print Spooler Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-40482Microsoft SharePoint Server Information Disclosure VulnerabilityMicrosoft SharePoint Server
- CVE-2021-40475Windows Cloud Files Mini Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-40472Microsoft Excel Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2021-40468Windows Bind Filter Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-40460Windows Remote Procedure Call Runtime Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-40456Windows AD FS Security Feature Bypass VulnerabilityMicrosoft Windows Server
- CVE-2021-40455Windows Installer Spoofing VulnerabilityMicrosoft Windows
- CVE-2021-40454Rich Text Edit Control Information Disclosure VulnerabilityMicrosoft Windows · Microsoft Office +1
- CVE-2021-38663Windows exFAT File System Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-38662Windows Fast FAT File System Driver Information Disclosure VulnerabilityMicrosoft Windows