CVEs published October 22, 2021
99 CVEs were published on October 22, 2021: 7 critical, 16 high. 1 is now in CISA KEV.
- Published
- 99
- Critical
- 7
- High
- 16
- Medium
- 7
- Low
- 0
- Unrated
- 69
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- AUVESY Versiondog
- 17
- Android
- 10
- Emerson WirelessHART Gateway
- 6
- McAfee ePolicy Orchestrator
- 2
- Check Point Harmony Browse and SandBlast Agent for Browsers
- 1
- elabftw
- 1
- forkcms/forkcms
- 1
- froxlor/froxlor
- 1
- github.com/tidwall/gjson
- 1
- IBM Business Automation Workflow
- 1
Critical 7
- CVE-2021-42258BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th
- CVE-2021-38449AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38457AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38453AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38471AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38469AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38477AUVESY VersiondogAUVESY Versiondog
High 16
- CVE-2021-38485Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-42542Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-42540Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-42536Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-42539Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-42538Emerson WirelessHART GatewayEmerson WirelessHART Gateway
- CVE-2021-38455AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38459AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38461AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38465AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38463AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38467AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38481AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38473AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38475AUVESY VersiondogAUVESY Versiondog
- CVE-2021-34362Command Injection Vulnerability in Media Streaming Add-onQNAP Systems Media Streaming add-on
Medium, low and unrated 76
- CVE-2020-23039Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'crea
- CVE-2020-23040Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via
- CVE-2020-23038Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter.
- CVE-2020-23037Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary w
- CVE-2020-23036MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password`
- CVE-2020-23041Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `
- CVE-2020-23042Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of
- CVE-2020-23043Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module.
- CVE-2020-23044DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `a
- CVE-2020-23045Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter
- CVE-2020-23046DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`,
- CVE-2020-23047Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerability in the search
- CVE-2020-23048SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via th
- CVE-2020-23049Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field whforkcms/forkcms
- CVE-2020-23050TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of t
- CVE-2020-23051Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilit
- CVE-2020-23052Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component groupfile
- CVE-2020-23054A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web script
- CVE-2020-23055ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scripting (XSS) vulnerab
- CVE-2020-23058An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data.
- CVE-2020-23061Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and `download` module w
- CVE-2020-23060Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function.
- CVE-2020-28955SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module.
- CVE-2020-28956Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web script
- CVE-2020-28957Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web froxlor/froxlor
- CVE-2020-28961Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the comp
- CVE-2020-28960Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via the id and cid param
- CVE-2020-28963Passcovery Co.
- CVE-2020-28964Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function.
- CVE-2020-28967FlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function.
- CVE-2020-28968Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module.
- CVE-2020-28969Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file
- CVE-2020-36485Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module.
- CVE-2020-36486Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of
- CVE-2020-36488An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands.
- CVE-2020-36489Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the devicename parameter.
- CVE-2020-36490DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the
- CVE-2020-36491DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activ
- CVE-2020-36492DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `ac
- CVE-2020-36493DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `acti
- CVE-2020-36494DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `
- CVE-2020-36495DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the
- CVE-2020-36496DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via
- CVE-2020-36497DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml_homepage.php via th
- CVE-2020-36498Macrob7 Macs Framework Content Management System - 1.14f contains a cross-site scripting (XSS) vulnerability in the account reset function,
- CVE-2020-36499TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content paramete
- CVE-2020-36501Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scri
- CVE-2020-36502Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which al
- CVE-2021-29835IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting.IBM Business Automation Workflow
- CVE-2021-41171Bypass bruteforce protection on login form in elabftwelabftw
- CVE-2021-42556Rasa X before 0.42.4 allows Directory Traversal during archive extraction.
- CVE-2021-42840SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.
- CVE-2021-42836GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.github.com/tidwall/gjson
- CVE-2021-30359The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation.Check Point Harmony Browse and SandBlast Agent for Browsers
- CVE-2021-0702In RevertActiveSessions of apexd.cpp, there is a possible way to share the wrong file due to an unintentional MediaStore downgrade.Android
- CVE-2021-0706In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check.Android
- CVE-2021-0870In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition.Android
- CVE-2021-0705In sanitizeSbn of NotificationManagerService.java, there is a possible way to keep service running in foreground and keep granted permissionAndroid
- CVE-2021-0652In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due to sharing of not thrAndroid
- CVE-2021-0703In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage.Android
- CVE-2021-0643In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissiAndroid
- CVE-2021-0708In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy.Android
- CVE-2021-0483In multiple methods of AAudioService, there is a possible use-after-free due to a race condition.Android
- CVE-2021-0651In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to incorrect input validaAndroid
- CVE-2021-42534Trane Building Automation Controllers Cross-site ScriptingTrane Tracer SC
- CVE-2021-42169The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injec
- CVE-2021-41745ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.showdoc/showdoc
- CVE-2021-41747Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such
- CVE-2021-41744All versions of yongyou PLM are affected by a command injection issue.
- CVE-2021-31682The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks
- CVE-2021-38451AUVESY VersiondogAUVESY Versiondog
- CVE-2021-38479AUVESY VersiondogAUVESY Versiondog
- CVE-2021-35230Unquoted Path Vulnerability (SMB Login) in Kiwi CatToolsSolarWinds Kiwi CatTools
- CVE-2021-36357An issue was discovered in OpenPOWER 2.6 firmware.
- CVE-2021-31834McAfee ePO Cross-Site Scripting vulnerabilityMcAfee ePolicy Orchestrator
- CVE-2021-31835McAfee ePO Cross-Site Scripting vulnerabilityMcAfee ePolicy Orchestrator