# CVEs published 2021-10-22

99 CVEs were published on October 22, 2021: 7 critical, 16 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-42258](https://cve.now/CVE-2021-42258.md): BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th (CVSS 9.8, KEV)
- [CVE-2020-23039](https://cve.now/CVE-2020-23039.md): Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'crea (no CVSS)
- [CVE-2020-23040](https://cve.now/CVE-2020-23040.md): Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via (no CVSS)
- [CVE-2020-23038](https://cve.now/CVE-2020-23038.md): Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. (no CVSS)
- [CVE-2020-23037](https://cve.now/CVE-2020-23037.md): Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary w (no CVSS)
- [CVE-2020-23036](https://cve.now/CVE-2020-23036.md): MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the \`password\` (no CVSS)
- [CVE-2020-23041](https://cve.now/CVE-2020-23041.md): Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the \` (no CVSS)
- [CVE-2020-23042](https://cve.now/CVE-2020-23042.md): Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of (no CVSS)
- [CVE-2020-23043](https://cve.now/CVE-2020-23043.md): Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. (no CVSS)
- [CVE-2020-23044](https://cve.now/CVE-2020-23044.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file\_pic\_view.php via the \`a (no CVSS)
- [CVE-2020-23045](https://cve.now/CVE-2020-23045.md): Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter (no CVSS)
- [CVE-2020-23046](https://cve.now/CVE-2020-23046.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the \`filename\`, (no CVSS)
- [CVE-2020-23047](https://cve.now/CVE-2020-23047.md): Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerability in the search (no CVSS)
- [CVE-2020-23048](https://cve.now/CVE-2020-23048.md): SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via th (no CVSS)
- [CVE-2020-23049](https://cve.now/CVE-2020-23049.md): Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the \`Displayname\` field wh (no CVSS, forkcms/forkcms)
- [CVE-2020-23050](https://cve.now/CVE-2020-23050.md): TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of t (no CVSS)
- [CVE-2020-23051](https://cve.now/CVE-2020-23051.md): Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilit (no CVSS)
- [CVE-2020-23052](https://cve.now/CVE-2020-23052.md): Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component groupfile (no CVSS)
- [CVE-2020-23054](https://cve.now/CVE-2020-23054.md): A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web script (no CVSS)
- [CVE-2020-23055](https://cve.now/CVE-2020-23055.md): ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scripting (XSS) vulnerab (no CVSS)
- [CVE-2020-23058](https://cve.now/CVE-2020-23058.md): An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data. (no CVSS)
- [CVE-2020-23061](https://cve.now/CVE-2020-23061.md): Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the \`list\` and \`download\` module w (no CVSS)
- [CVE-2020-23060](https://cve.now/CVE-2020-23060.md): Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function. (no CVSS)
- [CVE-2020-28955](https://cve.now/CVE-2020-28955.md): SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. (no CVSS)
- [CVE-2020-28956](https://cve.now/CVE-2020-28956.md): Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web script (no CVSS)
- [CVE-2020-28957](https://cve.now/CVE-2020-28957.md): Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web (no CVSS, froxlor/froxlor)
- [CVE-2020-28961](https://cve.now/CVE-2020-28961.md): Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the comp (no CVSS)
- [CVE-2020-28960](https://cve.now/CVE-2020-28960.md): Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product\_list.php via the id and cid param (no CVSS)
- [CVE-2020-28963](https://cve.now/CVE-2020-28963.md): Passcovery Co. (no CVSS)
- [CVE-2020-28964](https://cve.now/CVE-2020-28964.md): Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. (no CVSS)
- [CVE-2020-28967](https://cve.now/CVE-2020-28967.md): FlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function. (no CVSS)
- [CVE-2020-28968](https://cve.now/CVE-2020-28968.md): Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. (no CVSS)
- [CVE-2020-28969](https://cve.now/CVE-2020-28969.md): Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file (no CVSS)
- [CVE-2020-36485](https://cve.now/CVE-2020-36485.md): Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. (no CVSS)
- [CVE-2020-36486](https://cve.now/CVE-2020-36486.md): Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of (no CVSS)
- [CVE-2020-36488](https://cve.now/CVE-2020-36488.md): An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via \`/null//\` path commands. (no CVSS)
- [CVE-2020-36489](https://cve.now/CVE-2020-36489.md): Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the devicename parameter. (no CVSS)
- [CVE-2020-36490](https://cve.now/CVE-2020-36490.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file\_manage\_view.php via the (no CVSS)
- [CVE-2020-36491](https://cve.now/CVE-2020-36491.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags\_main.php via the \`activ (no CVSS)
- [CVE-2020-36492](https://cve.now/CVE-2020-36492.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select\_media.php via the \`ac (no CVSS)
- [CVE-2020-36493](https://cve.now/CVE-2020-36493.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media\_main.php via the \`acti (no CVSS)
- [CVE-2020-36494](https://cve.now/CVE-2020-36494.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel\_edit.php via the \` (no CVSS)
- [CVE-2020-36495](https://cve.now/CVE-2020-36495.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file\_manage\_view.php via the (no CVSS)
- [CVE-2020-36496](https://cve.now/CVE-2020-36496.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys\_admin\_user\_edit.php via (no CVSS)
- [CVE-2020-36497](https://cve.now/CVE-2020-36497.md): DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component makehtml\_homepage.php via th (no CVSS)
- [CVE-2020-36498](https://cve.now/CVE-2020-36498.md): Macrob7 Macs Framework Content Management System - 1.14f contains a cross-site scripting (XSS) vulnerability in the account reset function, (no CVSS)
- [CVE-2020-36499](https://cve.now/CVE-2020-36499.md): TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting (XSS) vulnerability in the content paramete (no CVSS)
- [CVE-2020-36501](https://cve.now/CVE-2020-36501.md): Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scri (no CVSS)
- [CVE-2020-36502](https://cve.now/CVE-2020-36502.md): Swift File Transfer Mobile v1.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the devicename parameter which al (no CVSS)
- [CVE-2021-29835](https://cve.now/CVE-2021-29835.md): IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2021-41171](https://cve.now/CVE-2021-41171.md): Bypass bruteforce protection on login form in elabftw (CVSS 5.9, elabftw)
- [CVE-2021-42556](https://cve.now/CVE-2021-42556.md): Rasa X before 0.42.4 allows Directory Traversal during archive extraction. (no CVSS)
- [CVE-2021-42840](https://cve.now/CVE-2021-42840.md): SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. (no CVSS)
- [CVE-2021-42836](https://cve.now/CVE-2021-42836.md): GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack. (no CVSS, github.com/tidwall/gjson)
- [CVE-2021-30359](https://cve.now/CVE-2021-30359.md): The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. (no CVSS, Check Point Harmony Browse and SandBlast Agent for Browsers)
- [CVE-2021-0702](https://cve.now/CVE-2021-0702.md): In RevertActiveSessions of apexd.cpp, there is a possible way to share the wrong file due to an unintentional MediaStore downgrade. (no CVSS, Android)
- [CVE-2021-0706](https://cve.now/CVE-2021-0706.md): In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0870](https://cve.now/CVE-2021-0870.md): In RW\_SetActivatedTagType of rw\_main.cc, there is possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0705](https://cve.now/CVE-2021-0705.md): In sanitizeSbn of NotificationManagerService.java, there is a possible way to keep service running in foreground and keep granted permission (no CVSS, Android)
- [CVE-2021-0652](https://cve.now/CVE-2021-0652.md): In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due to sharing of not thr (no CVSS, Android)
- [CVE-2021-0703](https://cve.now/CVE-2021-0703.md): In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared\_ptr usage. (no CVSS, Android)
- [CVE-2021-0643](https://cve.now/CVE-2021-0643.md): In getAllSubInfoList of SubscriptionController.java, there is a possible way to retrieve a long term identifier without the correct permissi (no CVSS, Android)
- [CVE-2021-0708](https://cve.now/CVE-2021-0708.md): In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0483](https://cve.now/CVE-2021-0483.md): In multiple methods of AAudioService, there is a possible use-after-free due to a race condition. (no CVSS, Android)
- [CVE-2021-0651](https://cve.now/CVE-2021-0651.md): In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to incorrect input valida (no CVSS, Android)
- [CVE-2021-38485](https://cve.now/CVE-2021-38485.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42542](https://cve.now/CVE-2021-42542.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42540](https://cve.now/CVE-2021-42540.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42536](https://cve.now/CVE-2021-42536.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42539](https://cve.now/CVE-2021-42539.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42538](https://cve.now/CVE-2021-42538.md): Emerson WirelessHART Gateway (CVSS 8.0, Emerson WirelessHART Gateway)
- [CVE-2021-42534](https://cve.now/CVE-2021-42534.md): Trane Building Automation Controllers Cross-site Scripting (CVSS 6.3, Trane Tracer SC)
- [CVE-2021-42169](https://cve.now/CVE-2021-42169.md): The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injec (no CVSS)
- [CVE-2021-41745](https://cve.now/CVE-2021-41745.md): ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions. (no CVSS, showdoc/showdoc)
- [CVE-2021-41747](https://cve.now/CVE-2021-41747.md): Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such (no CVSS)
- [CVE-2021-41744](https://cve.now/CVE-2021-41744.md): All versions of yongyou PLM are affected by a command injection issue. (no CVSS)
- [CVE-2021-31682](https://cve.now/CVE-2021-31682.md): The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks (no CVSS)
- [CVE-2021-38449](https://cve.now/CVE-2021-38449.md): AUVESY Versiondog (CVSS 9.8, AUVESY Versiondog)
- [CVE-2021-38457](https://cve.now/CVE-2021-38457.md): AUVESY Versiondog (CVSS 9.8, AUVESY Versiondog)
- [CVE-2021-38455](https://cve.now/CVE-2021-38455.md): AUVESY Versiondog (CVSS 7.3, AUVESY Versiondog)
- [CVE-2021-38451](https://cve.now/CVE-2021-38451.md): AUVESY Versiondog (CVSS 4.8, AUVESY Versiondog)
- [CVE-2021-38459](https://cve.now/CVE-2021-38459.md): AUVESY Versiondog (CVSS 8.1, AUVESY Versiondog)
- [CVE-2021-38453](https://cve.now/CVE-2021-38453.md): AUVESY Versiondog (CVSS 9.1, AUVESY Versiondog)
- [CVE-2021-38461](https://cve.now/CVE-2021-38461.md): AUVESY Versiondog (CVSS 8.2, AUVESY Versiondog)
- [CVE-2021-38465](https://cve.now/CVE-2021-38465.md): AUVESY Versiondog (CVSS 8.0, AUVESY Versiondog)
- [CVE-2021-38463](https://cve.now/CVE-2021-38463.md): AUVESY Versiondog (CVSS 7.3, AUVESY Versiondog)
- [CVE-2021-38467](https://cve.now/CVE-2021-38467.md): AUVESY Versiondog (CVSS 7.3, AUVESY Versiondog)
- [CVE-2021-38471](https://cve.now/CVE-2021-38471.md): AUVESY Versiondog (CVSS 9.1, AUVESY Versiondog)
- [CVE-2021-38479](https://cve.now/CVE-2021-38479.md): AUVESY Versiondog (CVSS 6.5, AUVESY Versiondog)
- [CVE-2021-38469](https://cve.now/CVE-2021-38469.md): AUVESY Versiondog (CVSS 9.1, AUVESY Versiondog)
- [CVE-2021-38477](https://cve.now/CVE-2021-38477.md): AUVESY Versiondog (CVSS 9.8, AUVESY Versiondog)
- [CVE-2021-38481](https://cve.now/CVE-2021-38481.md): AUVESY Versiondog (CVSS 8.1, AUVESY Versiondog)
- [CVE-2021-38473](https://cve.now/CVE-2021-38473.md): AUVESY Versiondog (CVSS 8.0, AUVESY Versiondog)
- [CVE-2021-38475](https://cve.now/CVE-2021-38475.md): AUVESY Versiondog (CVSS 7.3, AUVESY Versiondog)
- [CVE-2021-35230](https://cve.now/CVE-2021-35230.md): Unquoted Path Vulnerability (SMB Login) in Kiwi CatTools (CVSS 6.7, SolarWinds Kiwi CatTools)
- [CVE-2021-36357](https://cve.now/CVE-2021-36357.md): An issue was discovered in OpenPOWER 2.6 firmware. (no CVSS)
- [CVE-2021-31834](https://cve.now/CVE-2021-31834.md): McAfee ePO Cross-Site Scripting vulnerability (no CVSS, McAfee ePolicy Orchestrator)
- [CVE-2021-31835](https://cve.now/CVE-2021-31835.md): McAfee ePO Cross-Site Scripting vulnerability (CVSS 4.8, McAfee ePolicy Orchestrator)
- [CVE-2021-34362](https://cve.now/CVE-2021-34362.md): Command Injection Vulnerability in Media Streaming Add-on (CVSS 8.7, QNAP Systems Media Streaming add-on)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.