CVEs published October 14, 2021
34 CVEs were published on October 14, 2021: 3 critical, 2 high.
- Published
- 34
- Critical
- 3
- High
- 2
- Medium
- 4
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Brizy.io Brizy - Page Builder
- 3
- https://github.com/fastify/fastify-static · fastify-static
- 2
- kindeditor
- 2
- Nagios XI
- 2
- Apache Software Foundation Apache CouchDB · Apache Software…
- 1
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 1
- Enalean tuleap
- 1
- ledgersmb/ledgersmb
- 1
- Mitsubishi Electric MELSEC iQ-R Series Safety CPU R08SFC… +6
- 1
- NagVis
- 1
Critical 3
- CVE-2021-41132Inconsistent input sanitisation leads to XSS vectorsomero-web · omero-figure
- CVE-2021-20599Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPMitsubishi Electric MELSEC iQ-R Series Safety CPU R08SFC… +6
- CVE-2021-42369Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection.
High 2
Medium, low and unrated 29
- CVE-2021-42340DoS via memory leak with WebSocket connectionsApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2021-38295Privilege escalation vulnerability when using HTML attachmentsApache Software Foundation Apache CouchDB · Apache Software…
- CVE-2021-36389In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability
- CVE-2021-36388In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulner
- CVE-2021-36387In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specia
- CVE-2021-32571In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in
- CVE-2021-32569In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting.
- CVE-2021-42228A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.kindeditor
- CVE-2021-42227Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .htmlkindeditor
- CVE-2021-41142XSS via the name of a deleted attachmentEnalean tuleap
- CVE-2021-38344Brizy <= 2.3.11 Authenticated Stored Cross-Site ScriptingBrizy.io Brizy - Page Builder
- CVE-2021-37933An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify
- CVE-2021-33179The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting.Nagios XI
- CVE-2021-33178The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability.NagVis
- CVE-2021-33177The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection.Nagios XI
- CVE-2021-22963A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a https://github.com/fastify/fastify-static · fastify-static
- CVE-2021-22964A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox usehttps://github.com/fastify/fastify-static · fastify-static
- CVE-2020-19954An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files.
- CVE-2020-19957A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parame
- CVE-2020-19959A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid para
- CVE-2020-19960A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid para
- CVE-2020-19961A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component
- CVE-2020-19962A stored cross-site scripting (XSS) vulnerability in the getClientIp function in /lib/tinwin.class.php of Chaoji CMS 2.39, allows attackers
- CVE-2020-19964A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator accou
- CVE-2020-22724A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER
- CVE-2021-3882Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmbledgersmb/ledgersmb
- CVE-2021-42342An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.
- CVE-2021-42341checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\0' byte at the en
- CVE-2021-40854AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to lau