# CVEs published 2021-10-14 34 CVEs were published on October 14, 2021: 3 critical, 2 high. Days are UTC. - [CVE-2021-42340](https://cve.now/CVE-2021-42340.md): DoS via memory leak with WebSocket connections (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…) - [CVE-2021-38295](https://cve.now/CVE-2021-38295.md): Privilege escalation vulnerability when using HTML attachments (no CVSS, Apache Software Foundation Apache CouchDB · Apache Software…) - [CVE-2021-36389](https://cve.now/CVE-2021-36389.md): In Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an Insecure Direct Object Reference vulnerability (no CVSS) - [CVE-2021-36388](https://cve.now/CVE-2021-36388.md): In Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through an Insecure Direct Object Reference vulner (no CVSS) - [CVE-2021-36387](https://cve.now/CVE-2021-36387.md): In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specia (CVSS 5.4) - [CVE-2021-32571](https://cve.now/CVE-2021-32571.md): In OSS-RC systems of the release 18B and older during data migration procedures certain files containing usernames and passwords are left in (no CVSS) - [CVE-2021-32569](https://cve.now/CVE-2021-32569.md): In OSS-RC systems of the release 18B and older customer documentation browsing libraries under ALEX are subject to Cross-Site Scripting. (no CVSS) - [CVE-2021-42228](https://cve.now/CVE-2021-42228.md): A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html. (no CVSS, kindeditor) - [CVE-2021-42227](https://cve.now/CVE-2021-42227.md): Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html (no CVSS, kindeditor) - [CVE-2021-41142](https://cve.now/CVE-2021-41142.md): XSS via the name of a deleted attachment (CVSS 5.4, Enalean tuleap) - [CVE-2021-38346](https://cve.now/CVE-2021-38346.md): Brizy \<= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal (CVSS 8.8, Brizy.io Brizy - Page Builder) - [CVE-2021-38345](https://cve.now/CVE-2021-38345.md): Brizy \<= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification (CVSS 7.1, Brizy.io Brizy - Page Builder) - [CVE-2021-38344](https://cve.now/CVE-2021-38344.md): Brizy \<= 2.3.11 Authenticated Stored Cross-Site Scripting (CVSS 6.4, Brizy.io Brizy - Page Builder) - [CVE-2021-41132](https://cve.now/CVE-2021-41132.md): Inconsistent input sanitisation leads to XSS vectors (CVSS 9.8, omero-web · omero-figure) - [CVE-2021-37933](https://cve.now/CVE-2021-37933.md): An LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could allow an unauthenticated, remote user to modify (no CVSS) - [CVE-2021-33179](https://cve.now/CVE-2021-33179.md): The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. (no CVSS, Nagios XI) - [CVE-2021-33178](https://cve.now/CVE-2021-33178.md): The Manage Backgrounds functionality within NagVis versions prior to 1.9.29 is vulnerable to an authenticated path traversal vulnerability. (no CVSS, NagVis) - [CVE-2021-33177](https://cve.now/CVE-2021-33177.md): The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. (no CVSS, Nagios XI) - [CVE-2021-22963](https://cve.now/CVE-2021-22963.md): A redirect vulnerability in the fastify-static module version \< 4.2.4 allows remote attackers to redirect users to arbitrary websites via a (no CVSS, https://github.com/fastify/fastify-static · fastify-static) - [CVE-2021-22964](https://cve.now/CVE-2021-22964.md): A redirect vulnerability in the \`fastify-static\` module version \>= 4.2.4 and \< 4.4.1 allows remote attackers to redirect Mozilla Firefox use (no CVSS, https://github.com/fastify/fastify-static · fastify-static) - [CVE-2020-19954](https://cve.now/CVE-2020-19954.md): An XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which allows attackers to read arbitrary files. (no CVSS) - [CVE-2020-19957](https://cve.now/CVE-2020-19957.md): A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the id parame (no CVSS) - [CVE-2020-19959](https://cve.now/CVE-2020-19959.md): A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid para (no CVSS) - [CVE-2020-19960](https://cve.now/CVE-2020-19960.md): A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the dlid para (no CVSS) - [CVE-2020-19961](https://cve.now/CVE-2020-19961.md): A SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers to retrieve sensitive data via the component (no CVSS) - [CVE-2020-19962](https://cve.now/CVE-2020-19962.md): A stored cross-site scripting (XSS) vulnerability in the getClientIp function in /lib/tinwin.class.php of Chaoji CMS 2.39, allows attackers (no CVSS) - [CVE-2020-19964](https://cve.now/CVE-2020-19964.md): A Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows attackers to create a new administrator accou (no CVSS) - [CVE-2020-22724](https://cve.now/CVE-2020-22724.md): A remote command execution vulnerability exists in add\_server\_service of PPTP\_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER (no CVSS) - [CVE-2021-3882](https://cve.now/CVE-2021-3882.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb (CVSS 5.9, ledgersmb/ledgersmb) - [CVE-2021-42342](https://cve.now/CVE-2021-42342.md): An issue was discovered in GoAhead 4.x and 5.x before 5.1.5. (no CVSS) - [CVE-2021-42341](https://cve.now/CVE-2021-42341.md): checkpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which does not account for the '\\0' byte at the en (no CVSS) - [CVE-2021-40854](https://cve.now/CVE-2021-40854.md): AnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator privileges by using the Open Chat Log feature to lau (no CVSS) - [CVE-2021-20599](https://cve.now/CVE-2021-20599.md): Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CP (CVSS 9.1, Mitsubishi Electric MELSEC iQ-R Series Safety CPU R08SFC… +6) - [CVE-2021-42369](https://cve.now/CVE-2021-42369.md): Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. (CVSS 9.9) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-10-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.