CVEs published October 19, 2021
120 CVEs were published on October 19, 2021: 6 critical, 36 high. 1 is now in CISA KEV.
- Published
- 120
- Critical
- 6
- High
- 36
- Medium
- 38
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 85
Most affected products
- Juniper Networks Junos OS
- 32
- Apple macOS
- 13
- InHand Networks IR615 Router
- 13
- Apple iOS and iPadOS
- 6
- Juniper Networks Junos OS Evolved
- 5
- Juniper Networks SRC Series
- 3
- snipe/snipe-it
- 3
- Apple iOS and iPadOS · Apple tvOS +1
- 2
- awslabs tough · tough
- 2
- bfabiszewski/libmobi
- 2
Critical 6
- CVE-2021-31349Session Smart Router: Authentication Bypass VulnerabilityJuniper Networks 128 Technology Session Smart Router
- CVE-2021-38478InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38480InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38484InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38462InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38470InHand Networks IR615 RouterInHand Networks IR615 Router
High 36
- CVE-2021-41150Improper sanitization of delegated role names in toughawslabs tough · tough
- CVE-2021-31385Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to rootJuniper Networks Junos OS
- CVE-2021-31384Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the serviceJuniper Networks Junos OS
- CVE-2021-31383Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core.Juniper Networks Junos OS
- CVE-2021-31379Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.Juniper Networks Junos OS
- CVE-2021-31376Junos OS: ACX Series: Packet Forwarding Engine manager (FXPC) process crashes when processing DHCPv6 packetsJuniper Networks Junos OS
- CVE-2021-31375Junos OS: Receipt of a specific BGP update may cause RPKI policy-checks to be bypassedJuniper Networks Junos OS
- CVE-2021-31374Junos OS and Junos OS Evolved: RPD crash while processing a specially crafted BGP UPDATE or KEEPALIVE message.Juniper Networks Junos OS
- CVE-2021-31373Junos OS: SRX Series: Persistent XSS vulnerability in J-WebJuniper Networks Junos OS
- CVE-2021-31372Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root.Juniper Networks Junos OS
- CVE-2021-31368Junos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of-band management port receives a flood of trafficJuniper Networks Junos OS
- CVE-2021-31360Junos OS and Junos OS Evolved: Denial of Service vulnerability in local file processingJuniper Networks Junos OS
- CVE-2021-31359Junos OS and Junos OS Evolved: Local Privilege Escalation vulnerabilityJuniper Networks Junos OS
- CVE-2021-31358Junos OS Evolved: shell-injection vulnerabilities in evo_sftp UI wrapper scriptJuniper Networks Junos OS Evolved
- CVE-2021-31357Junos OS Evolved: shell-injection vulnerabilities in evo_tcpdump UI wrapper scriptJuniper Networks Junos OS Evolved
- CVE-2021-31356Junos OS Evolved: Multiple shell-injection vulnerabilities in EVO UI wrapper scriptsJuniper Networks Junos OS Evolved
- CVE-2021-31355Junos OS: Stored Cross-Site Scripting (XSS) vulnerability in captive portalJuniper Networks Junos OS
- CVE-2021-31354Junos OS and Junos OS Evolved: A vulnerability in the Juniper Agile License Client may allow an attacker to perform Remote Code Execution (RCE)Juniper Networks Junos OS
- CVE-2021-31353Junos OS and Junos OS Evolved: RPD core upon receipt of specific BGP updateJuniper Networks Junos OS
- CVE-2021-31351Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card resetJuniper Networks Junos OS
- CVE-2021-31350Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET)Juniper Networks Junos OS
- CVE-2021-0299Junos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packetJuniper Networks Junos OS
- CVE-2021-0296CTPView: HSTS not being enforced on CTPView server.Juniper Networks CTPView
- CVE-2021-41149Improper sanitization of target names in toughawslabs tough · tough
- CVE-2021-41131Client metadata path-traversal in python-tuftheupdateframework python-tuf · tuf
- CVE-2021-32664Reflected XSS in Combodo/iTopCombodo iTop
- CVE-2021-32663Unauthorized setup leads to SSRF in Combodo/iTopCombodo iTop
- CVE-2021-30807A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2021-3889Use of Out-of-range Pointer Offset in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2021-3888Use of Out-of-range Pointer Offset in bfabiszewski/libmobibfabiszewski/libmobi
- CVE-2021-3872Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-3869Improper Restriction of XML External Entity Reference in stanfordnlp/corenlpstanfordnlp/corenlp · edu.stanford.nlp:stanford-corenlp
- CVE-2021-38486InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38482InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38466InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38468InHand Networks IR615 RouterInHand Networks IR615 Router
Medium, low and unrated 78
- CVE-2021-3454Truncated L2CAP K-frame causes assertion failurezephyrproject-rtos zephyr
- CVE-2021-3455Disconnecting L2CAP channel right after invalid ATT request leads freezezephyrproject-rtos zephyr
- CVE-2021-31386Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.Juniper Networks Junos OS
- CVE-2021-31382Junos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfacesJuniper Networks Junos OS
- CVE-2021-31381SRC Series: A remote attacker sending a specially crafted query may cause the web server to delete filesJuniper Networks SRC Series
- CVE-2021-31380SRC Series: A remote attacker sending a specially crafted query may cause the web server to disclose sensitive informationJuniper Networks SRC Series
- CVE-2021-31378Junos OS: An attacker sending spoofed RADIUS messages to a Junos OS device configured for broadband services may cause broadband subscribers to remain stuck in a "Terminating" state.Juniper Networks Junos OS
- CVE-2021-31377Junos OS: A local authenticated attacker can cause RPD to coreJuniper Networks Junos OS
- CVE-2021-31371Junos OS: QFX5000 Series: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfaces.Juniper Networks Junos OS
- CVE-2021-31370Junos OS: QFX5000 Series and EX4600 Series: Control traffic might be dropped if a high rate of specific multicast traffic is receivedJuniper Networks Junos OS
- CVE-2021-31369Junos OS: MX Series: Traffic drops will be observed if MS-MPC/MS-PIC resources are consumed by certain traffic causing a partial DoSJuniper Networks Junos OS
- CVE-2021-31367Junos OS: PTX Series: An FPC heap memory leak will be triggered by certain Flowspec route operations which can lead to an FPC crashJuniper Networks Junos OS
- CVE-2021-31366Junos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoSJuniper Networks Junos OS
- CVE-2021-31365Junos OS: EX2300, EX3400 and EX4300 Series: An Aggregated Ethernet (AE) interface will go down due to a stream of specific layer 2 framesJuniper Networks Junos OS
- CVE-2021-31364Junos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedJuniper Networks Junos OS
- CVE-2021-31363Junos OS and Junos OS Evolved: Receipt of a specific LDP message will cause a Denial of ServiceJuniper Networks Junos OS
- CVE-2021-31362Junos OS and Junos OS Evolved: An IS-IS adjacency might be taken down if a bad hello PDU is received for an existing adjacency causing a DoSJuniper Networks Junos OS
- CVE-2021-31361Junos OS: QFX Series and PTX Series: FPC resource usage increases when certain packets are processed which are being VXLAN encapsulatedJuniper Networks Junos OS
- CVE-2021-31352SRC Series: NETCONF over SSH allows negotiation of weak ciphersJuniper Networks SRC Series
- CVE-2021-0298Junos OS Evolved: PTX10003, PTX10008: picd core while executing the "show chassis pic" command under certain conditionsJuniper Networks Junos OS Evolved
- CVE-2021-0297Junos OS Evolved: BGP and LDP sessions with TCP MD5 authentication established with peers not configured for authenticationJuniper Networks Junos OS Evolved
- CVE-2021-41140Reactions leak for secure category topics and private messagesdiscourse-reactions
- CVE-2021-35323Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.
- CVE-2021-33988Cross Site Scripting (XSS).microweber/microweber
- CVE-2020-12141An out-of-bounds read in the SNMP stack in Contiki-NG 4.4 and earlier allows an attacker to cause a denial of service and potentially disclo
- CVE-2021-38911IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged usIBM Cloud Pak for Security
- CVE-2021-29912IBM Security Risk Manager on CP4S 1.7.0.0 is vulnerable to cross-site scripting.IBM Cloud Pak for Security
- CVE-2021-39355Indeed Job Importer <= 1.0.5 Authenticated Stored Cross-Site ScriptingIndeed Job Importer
- CVE-2021-39343MPL-Publisher – Self-publish your book & ebook <= 1.30.2 Authenticated Stored Cross-Site ScriptingMPL-Publisher
- CVE-2021-39329JobBoardWP – Job Board Listings and Submissions <= 1.0.7 Authenticated Stored Cross-Site ScriptingJobBoardWP
- CVE-2021-36832WordPress Icegram plugin <= 2.0.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityPopups, Welcome Bar, Optins and Lead Generation Plugin – Ic…
- CVE-2021-27001Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow anClustered Data ONTAP
- CVE-2021-26589A potential security vulnerability has been identified in HPE Superdome Flex Servers.HPE Superdome Flex Server
- CVE-2011-1075FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new vFreeBSD/crontab
- CVE-2021-3746A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers.libtpms
- CVE-2021-30358Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from othCheck Point Mobile Access Portal Agent
- CVE-2011-1497A cross-site scripting vulnerability flaw was found in the auto_link function in Rails before version 3.0.6.rails · actionpack
- CVE-2020-29622A race condition was addressed with additional validation.Apple Security Update - Catalina
- CVE-2021-30811This issue was addressed with improved checks.Apple iOS and iPadOS · Apple watchOS
- CVE-2021-30815A lock screen issue allowed access to contacts on a locked device.Apple iOS and iPadOS
- CVE-2021-30820A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2021-30810An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2021-30825This issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2021-30819An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2021-30826A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2021-30827A permissions issue existed.Apple macOS
- CVE-2021-30829A URI parsing issue was addressed with improved parsing.Apple macOS
- CVE-2021-30828This issue was addressed with improved checks.Apple macOS
- CVE-2021-30830A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2021-30832A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2021-30837A memory consumption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2021-30835This issue was addressed with improved checks.Apple Security Update - Catalina · Apple iOS and iPadOS +3
- CVE-2021-30842This issue was addressed with improved checks.Apple macOS
- CVE-2021-30838A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2021-30841This issue was addressed with improved checks.Apple macOS
- CVE-2021-30844A logic issue was addressed with improved state management.Apple macOS
- CVE-2021-30845An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2021-30843This issue was addressed with improved checks.Apple macOS
- CVE-2021-30847This issue was addressed with improved checks.Apple macOS
- CVE-2021-30846A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2021-30848A memory corruption issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple Safari
- CVE-2021-30850An access issue was addressed with improved access restrictions.Apple macOS
- CVE-2021-30849Multiple memory corruption issues were addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +3
- CVE-2021-3879Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2021-3863Cross-site Scripting (XSS) - Generic in snipe/snipe-itsnipe/snipe-it
- CVE-2021-3858Cross-Site Request Forgery (CSRF) in snipe/snipe-itsnipe/snipe-it
- CVE-2021-3851Open Redirect in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-3846Unrestricted Upload of File with Dangerous Type in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-38472InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38476InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38464InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-38474InHand Networks IR615 RouterInHand Networks IR615 Router
- CVE-2021-36512An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive inf
- CVE-2021-42261Revisor Video Management System (VMS) before 2.0.0 has a directory traversal vulnerability.
- CVE-2021-25968OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemaporg.opencms opencms-core
- CVE-2021-20836Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause informaOMRON CX-Supervisor
- CVE-2021-37136The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocatiThe Netty project Netty · io.netty:netty-codec +2
- CVE-2021-37137The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.The Netty project Netty · io.netty:netty-codec +2