CVEs published October 21, 2021
59 CVEs were published on October 21, 2021: 1 critical, 6 high.
- Published
- 59
- Critical
- 1
- High
- 6
- Medium
- 24
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- 7
- Trend Micro Apex One
- 4
- Cisco Identity Services Engine Software
- 3
- Atlassian Jira Server · Atlassian Jira Data Center
- 2
- FreeRDP
- 2
- "HCL Connections"
- 1
- "HCL Traveler Companion"
- 1
- Adobe Connect
- 1
- Arista Networks Arista EOS
- 1
- Arris SurfBoard SB8200
- 1
Critical 1
High 6
- CVE-2021-41127Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasaRasaHQ rasa · rasa
- CVE-2021-39321Sassy Social Share 3.3.23 PHP Object InjectionSassy Social Share
- CVE-2021-39352Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File UploadCatch Themes Demo Import
- CVE-2021-41146Arbitrary command execution on Windows in qutebrowserqutebrowser
- CVE-2021-29873IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restrictedIBM FlashSystem · IBM Storwize +3
- CVE-2021-1529Cisco IOS XE SD-WAN Software Command Injection VulnerabilityCisco IOS XE SD-WAN Software
Medium, low and unrated 52
- CVE-2021-27746"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability""HCL Connections"
- CVE-2021-41169Improper Neutralization HTML tags in sulu/sulusulu · sulu/sulu
- CVE-2021-36869WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerabilityIvory Search
- CVE-2021-41168Hash-Collision Denial-of-Service Vulnerability in snudownreddit snudown
- CVE-2021-39354Easy Digital Downloads <= 2.11.2 Authenticated Reflected Cross-Site ScriptingEasy Digital Downloads
- CVE-2021-39328Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site ScriptingSimple Job Board
- CVE-2021-39356Content Staging <= 2.0.1 Authenticated Stored Cross-Site ScriptingContent Staging
- CVE-2021-39357Leaky Paywall <= 4.16.5 Authenticated Stored Cross-Site ScriptingLeaky Paywall
- CVE-2021-39348LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site ScriptingLearnPress
- CVE-2021-22034Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.VMware vRealize Operations Tenant App for VMware Cloud Dire…
- CVE-2021-42716An issue was discovered in stb stb_image.h 2.27.
- CVE-2021-35228Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388SolarWinds
- CVE-2021-35227Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARMSolarWinds Access Rights Manager
- CVE-2021-35225Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5SolarWinds NPM
- CVE-2021-28496In Arista's EOS software affected releases, the shared secret profiles sensitive configuration might be leaked when displaying output over eAPI or other JSON outputs to authenticated users on the device.Arista Networks Arista EOS
- CVE-2021-29883IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on authorization tokenIBM Transformation Extender Advanced
- CVE-2020-14263"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK""HCL Traveler Companion"
- CVE-2021-20120The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks.Arris SurfBoard SB8200
- CVE-2021-28975WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name,
- CVE-2020-27304The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-bacivetweb_project civetweb
- CVE-2021-42740The shell-quote package before 1.7.3 for Node.js allows command injection.shell-quote
- CVE-2021-35512An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.
- CVE-2021-41792An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services throu
- CVE-2021-41791An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0.
- CVE-2021-41790An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2.
- CVE-2021-42108Unnecessary privilege vulnerabilities in the Web Console of Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.Trend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-42107Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free BTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-42106Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free BTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-42105Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free BTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-42104Unnecessary privilege vulnerabilities in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1 and Worry-Free BTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-42103An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalaTrend Micro Apex One
- CVE-2021-42102An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker toTrend Micro Apex One
- CVE-2021-42101An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalaTrend Micro Apex One
- CVE-2021-42011An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLTrend Micro Apex One
- CVE-2021-42012A stack-based buffer overflow vulnerability in Trend Micro Apex One, Apex One as a Service and Worry-Free Business Security 10.0 SP1 could aTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-23139A null pointer vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an attacker to crash the CGI progTrend Micro Apex One · Trend Micro Worry-Free Business Secu…
- CVE-2021-34736Cisco Integrated Management Controller GUI Denial of Service VulnerabilityCisco Unified Computing System
- CVE-2021-40123Cisco Identity Services Engine File Download VulnerabilityCisco Identity Services Engine Software
- CVE-2021-40122Cisco Meeting Server Call Bridge Denial of Service VulnerabilityCisco Meeting Server
- CVE-2021-40121Cisco Identity Services Engine Cross-Site Scripting VulnerabilitiesCisco Identity Services Engine Software
- CVE-2021-34789Cisco Tetration Stored Cross-Site Scripting VulnerabilityCisco Secure Workload
- CVE-2021-34760Cisco TelePresence Management Suite Stored Cross-Site Scripting VulnerabilityCisco TelePresence Management Suite
- CVE-2021-34743Cisco Webex Software Application Authorization Bypass VulnerabilityCisco Webex Meetings
- CVE-2021-34738Cisco Identity Services Engine Cross-Site Scripting VulnerabilitiesCisco Identity Services Engine Software
- CVE-2021-39126Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request ForgeAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-39127Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to the query component JQL endpoint via a BrokenAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-42097GNU Mailman before 2.1.35 may allow remote Privilege Escalation.
- CVE-2021-42096GNU Mailman before 2.1.35 may allow remote Privilege Escalation.
- CVE-2021-41159Improper client input validation for FreeRDP gateway connections allows to overwrite memoryFreeRDP
- CVE-2021-41160Improper region checks in FreeRDP allow out of bound write to memoryFreeRDP
- CVE-2021-42327dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based
- CVE-2021-42715An issue was discovered in stb stb_image.h 1.33 through 2.27.