CVEs published October 18, 2021
64 CVEs were published on October 18, 2021: 3 critical, 12 high.
- Published
- 64
- Critical
- 3
- High
- 12
- Medium
- 3
- Low
- 2
- Unrated
- 44
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- FATEK Automation WinProladder
- 7
- Advantech WebAccess
- 2
- Apache Software Foundation Apache Superset · apache-superset
- 2
- Compact WP Audio Player
- 2
- Enalean tuleap
- 2
- Nitro Pro
- 2
- One User Avatar | User Profile Picture
- 2
- anuko timetracker
- 1
- backstage · @backstage/plugin-scaffolder-backend
- 1
- CatchThemes Essential Widgets · CatchThemes To Top +15
- 1
Critical 3
High 12
- CVE-2021-41154SQL injection in the "SVN core" commits browserEnalean tuleap
- CVE-2021-41155SQL injection in CVS revisions browserEnalean tuleap
- CVE-2021-41153Specification non-compliance in JUMPIrust-blockchain evm · evm
- CVE-2021-41152Path Traversal in Folder Component Leading to Local File InclusionOpenOLAT
- CVE-2021-21797An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.Nitro Pro
- CVE-2021-21796An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.Nitro Pro
- CVE-2021-38436FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2021-38438FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2021-38434FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2021-38442FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2021-38426FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2021-38430FATEK Automation WinProladderFATEK Automation WinProladder
Medium, low and unrated 49
- CVE-2021-41156Reflected XSS vulnerabilityanuko timetracker
- CVE-2021-42650Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1 via the node input box in Custom Templates.
- CVE-2021-41151Path Traversal in @backstage/plugin-scaffolder-backendbackstage · @backstage/plugin-scaffolder-backend
- CVE-2021-29878IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2021-42055ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.
- CVE-2021-36513An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view
- CVE-2021-42575The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.com.googlecode.owasp-java-html-sanitizer:owasp-java-html-sa…
- CVE-2021-42576The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated pybluemonday · github.com/microcosm-cc/bluemonday
- CVE-2021-41971Possible SQL Injection when template processing is enabledApache Software Foundation Apache Superset · apache-superset
- CVE-2021-32609XSS vulnerability on Explore pageApache Software Foundation Apache Superset · apache-superset
- CVE-2021-24760Gutenberg PDF Viewer Block < 1.0.1 - Contributor+ Stored Cross-Site ScriptingGutenberg PDF Viewer Block
- CVE-2021-24754MainWP Child Reports < 2.0.8 - Admin+ SQL InjectionMainWP Child Reports
- CVE-2021-24752Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting ChangeCatchThemes Essential Widgets · CatchThemes To Top +15
- CVE-2021-24743Podcast Subscribe Buttons < 1.4.2 - Contributor+ Stored XSSPodcast Subscribe Buttons
- CVE-2021-24740Tutor LMS < 1.9.9 - Multiple Admin+ Stored Cross-Site ScriptingTutor LMS – eLearning and online course solution
- CVE-2021-24736Shared Files < 1.6.57 - Admin+ Stored Cross-Site ScriptingEasy Download Manager and File Sharing Plugin with frontend…
- CVE-2021-24735Compact WP Audio Player < 1.9.7 - Setting Change via CSRFCompact WP Audio Player
- CVE-2021-24734Compact WP Audio Player < 1.9.7 - Contributor+ Stored Cross-Site ScriptingCompact WP Audio Player
- CVE-2021-24732Dflip Lite < 1.7.10 - Contributor+ Stored Cross-Site ScriptingPDF Flipbook, 3D Flipbook WordPress – DearFlip
- CVE-2021-24702LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site ScriptingLearnPress – WordPress LMS Plugin
- CVE-2021-24684PDF Light Viewer < 1.4.12 - Authenticated Command InjectionWordPress PDF Light Viewer Plugin
- CVE-2021-24677Find My Blocks < 3.4.0 - Private Post Titles DisclosureFind My Blocks
- CVE-2021-24675One User Avatar < 2.3.7 - Avatar Update via CSRFOne User Avatar | User Profile Picture
- CVE-2021-24672One User Avatar < 2.3.7 - Contributor+ Stored Cross-Site ScriptingOne User Avatar | User Profile Picture
- CVE-2021-24642Scroll Baner <= 1.0 - CSRF to RCEScroll Baner
- CVE-2021-24622WP Ticket < 5.10.4 - Admin+ Stored Cross-Site ScriptingCustomer Service Software & Support Ticket System
- CVE-2021-24617GamePress <= 1.1.0 - Reflected Cross-Site ScriptingGamePress – The Game Database Plugin
- CVE-2021-24615Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting微信打赏（Wechat Reward)
- CVE-2021-24612Sociable <= 4.3.4.1 - Admin+ Stored Cross-Site ScriptingSociable
- CVE-2021-24595WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site ScriptingWp Cookie Choice
- CVE-2021-24516PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site ScriptingPlanSo Forms
- CVE-2021-24416StreamCast < 2.1.1 - Contributor+ Stored Cross-Site ScriptingStreamCast – Radio Player for WordPress
- CVE-2021-24415Polo Video Gallery <= 1.2 - Contributor+ Stored Cross-Site ScriptingPolo Video Gallery – Best wordpress video gallery plugin
- CVE-2021-24413Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site ScriptingEasy Twitter Feed
- CVE-2021-24412Html5 Audio Player < 2.1.3 - Contributor+ Stored Cross-Site ScriptingHtml5 Audio Player – Audio Player for WordPress
- CVE-2021-41990The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS signature.
- CVE-2021-41991The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests with different certifi
- CVE-2021-42098An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via Devolutions Remote Desktop Manager
- CVE-2020-8291A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.Rocket.Chat server
- CVE-2021-22961A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary code execution from a GlassWire
- CVE-2021-38440FATEK Automation WinProladderFATEK Automation WinProladder
- CVE-2010-2496stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access t
- CVE-2021-41611An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2.
- CVE-2021-38562Best Practical Request Tracker (RT) 4.2 before 4.2.17, 4.4 before 4.4.5, and 5.0 before 5.0.2 allows sensitive information disclosure via a
- CVE-2021-42565myfactory.FMS before 7.1-912 allows XSS via the UID parameter.
- CVE-2021-42566myfactory.FMS before 7.1-912 allows XSS via the Error parameter.
- CVE-2021-36097Agents are able to lock the ticket without the "Owner" permissionOTRS AG OTRS
- CVE-2021-22942A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect uhttps://github.com/rails/rails · actionpack
- CVE-2021-38297Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCHtoolchain