CVEs published October 25, 2021
84 CVEs were published on October 25, 2021: 0 critical, 16 high.
- Published
- 84
- Critical
- 0
- High
- 16
- Medium
- 11
- Low
- 2
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- 9
- nextcloud security-advisories
- 8
- Android
- 6
- Parallels Desktop
- 5
- D-Link DAP-2020
- 4
- MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…
- 3
- signalwire freeswitch
- 3
- Apache Software Foundation Apache Storm · org.apache.storm:…
- 2
- Formidable Form Builder – Contact Form, Survey & Quiz Forms…
- 2
- MT6761, MT6762, MT6765, MT6768, MT6779, MT6785, MT6833, MT6…
- 2
High 16
- CVE-2021-41105FreeSWITCH susceptible to Denial of Service via invalid SRTP packetssignalwire freeswitch
- CVE-2021-41145FreeSWITCH susceptible to Denial of Service via SIP floodingsignalwire freeswitch
- CVE-2021-41178File Traversal affecting SVG files on Nextcloud Servernextcloud security-advisories
- CVE-2021-41177Rate-limits not working on instances without configured memory cache backendnextcloud security-advisories
- CVE-2021-39225Missing permission check on Deck APInextcloud security-advisories
- CVE-2021-34864This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).Parallels Desktop
- CVE-2021-34863This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routerD-Link DAP-2020
- CVE-2021-34862This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routerD-Link DAP-2020
- CVE-2021-34861This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routerD-Link DAP-2020
- CVE-2021-34859This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.TeamViewer
- CVE-2021-34857This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).Parallels Desktop
- CVE-2021-34856This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).Parallels Desktop
- CVE-2021-34854This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160).Parallels Desktop
- CVE-2021-37624FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofingsignalwire freeswitch
- CVE-2021-40527Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.
- CVE-2021-21703PHP-FPM memory access in root process leading to privilege escalationPHP Group PHP
Medium, low and unrated 68
- CVE-2021-41179Two-Factor Authentication not enforced for pages marked as publicnextcloud security-advisories
- CVE-2021-39224File path disclosure of shared files in OfficeOnline applicationnextcloud security-advisories
- CVE-2021-39223File path disclosure of shared files in Richdocuments applicationnextcloud security-advisories
- CVE-2021-38260NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor().
- CVE-2021-38258NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().
- CVE-2021-39221XSS in Contactsnextcloud security-advisories
- CVE-2021-39220Bypass of image blocking in Nextcloud Mailnextcloud security-advisories
- CVE-2021-34860This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc00D-Link DAP-2020
- CVE-2021-34855This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160).Parallels Desktop
- CVE-2021-41176logout CSRF in Pterodactyl Panelpterodactyl panel · pterodactyl/panel
- CVE-2021-21319Several stored XSSgalette
- CVE-2021-41035In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methThe Eclipse Foundation Eclipse OMR
- CVE-2020-20908Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary we
- CVE-2017-20007Information Exposure in INGEPAC DA AUIngeteam INGEPAC DA AU
- CVE-2021-24885YOP Poll < 6.1.2 - Reflected Cross-Site ScriptingYOP Poll
- CVE-2021-24884Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site ScriptingFormidable Form Builder – Contact Form, Survey & Quiz Forms…
- CVE-2021-24785Great Quotes <= 1.0.0 - Admin+ Stored Cross-Site ScriptingGreat Quotes
- CVE-2021-24779WP Debugging < 2.11.0 - Unauthenticated Plugin's Settings UpdateWP Debugging
- CVE-2021-24774Check & Log Email < 1.0.3 - Admin+ SQL InjectionsCheck & Log Email
- CVE-2021-24769Permalink Manager Lite < 2.2.13.1 - Admin+ SQL InjectionPermalink Manager Lite
- CVE-2021-0939In set_default_passthru_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2021-24744WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site ScriptingWordPress Contact Forms by Cimatti
- CVE-2021-24699Easy Media Download < 1.1.7 - Contributor+ Stored Cross-Site ScriptingEasy Media Download
- CVE-2021-24662Game Server Status <= 1.0 - Admin+ SQL InjectionGame Server Status
- CVE-2021-24653Cookie Bar < 1.8.9 - Admin+ Stored Cross-Site ScriptingCookie Bar
- CVE-2021-0936In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free.Android
- CVE-2021-24608Formidable Form Builder < 5.0.07 - Admin+ Stored Cross-Site ScriptingFormidable Form Builder – Contact Form, Survey & Quiz Forms…
- CVE-2021-24544Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site ScriptingResponsive WordPress Slider
- CVE-2021-24543jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site ScriptingjQuery Reply to Comment
- CVE-2021-24515Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site ScriptingVideo Gallery - Vimeo and YouTube Gallery
- CVE-2021-0938In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data.Android
- CVE-2021-24514Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingVisual Form Builder
- CVE-2021-24489Request a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingRequest a Quote
- CVE-2021-24487St Daily Tip <= 4.7 - CSRF to Stored Cross-Site ScriptingSt-Daily-Tip
- CVE-2021-24485Special Text Boxes < 5.9.110 - Admin+ Stored Cross-Site ScriptingSpecial Text Boxes
- CVE-2021-24414YT Player < 1.4 - Contributor+ Stored Cross-Site ScriptingVideo Player for YouTube
- CVE-2021-24381NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site ScriptingNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-0940In TBD of TBD, there is a possible out of bounds write due to improper locking.Android
- CVE-2021-0935In ip6_xmit of ip6_output.c, there is a possible out of bounds write due to a use after free.Android
- CVE-2021-0941In bpf_skb_change_head of filter.c, there is a possible out of bounds read due to a use after free.Android
- CVE-2021-0663In audio DSP, there is a possible out of bounds write due to an incorrect bounds check.MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…
- CVE-2021-0662In audio DSP, there is a possible out of bounds write due to an incorrect bounds check.MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…
- CVE-2021-0661In audio DSP, there is a possible out of bounds write due to an incorrect bounds check.MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…
- CVE-2021-0634In display driver, there is a possible memory corruption due to uninitialized data.MT6735, MT6739, MT6761, MT6765, MT6771, MT6779, MT6785, MT8…
- CVE-2021-0633In display driver, there is a possible out of bounds write due to an incorrect bounds check.MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT6762, MT6…
- CVE-2021-0632In wifi driver, there is a possible out of bounds read due to a missing bounds check.MT6739, MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT6…
- CVE-2021-0631In wifi driver, there is a possible system crash due to a missing bounds check.MT6761, MT6762, MT6765, MT6768, MT6779, MT6785, MT6833, MT6…
- CVE-2021-0630In wifi driver, there is a possible system crash due to a missing bounds check.MT6761, MT6762, MT6765, MT6768, MT6779, MT6785, MT6833, MT6…
- CVE-2021-0625In ccu, there is a possible memory corruption due to improper locking.MT6762, MT6765, MT6768, MT6771, MT6779, MT6785, MT8183, MT8…
- CVE-2021-0618In ape extractor, there is a possible out of bounds read due to a heap buffer overflow.MT6739, MT6758, MT6761, MT6762, MT6763, MT6765, MT6768, MT6…
- CVE-2021-0617In ape extractor, there is a possible out of bounds read due to a heap buffer overflow.MT5522, MT5527, MT5597, MT5598, MT5599, MT6739, MT6761, MT6…
- CVE-2021-0616In ape extractor, there is a possible out of bounds read due to a heap buffer overflow.MT5522, MT5527, MT5597, MT5598, MT5599, MT6739, MT6758, MT6…
- CVE-2021-0615In flv extractor, there is a possible out of bounds read due to an integer overflow.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0614In asf extractor, there is a possible out of bounds read due to an incorrect bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0613In asf extractor, there is a possible out of bounds read due to an incorrect bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0414In flv extractor, there is a possible out of bounds read due to a heap buffer overflow.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0413In flv extractor, there is a possible out of bounds read due to a missing bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0412In flv extractor, there is a possible out of bounds read due to a missing bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0411In flv extractor, there is a possible out of bounds read due to an integer overflow.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0410In flv extractor, there is a possible out of bounds read due to an incorrect bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-0409In flv extractor, there is a possible out of bounds read due to an incorrect bounds check.MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…
- CVE-2021-25977Piranha CMS - Stored XSS in Page TitlePiranhaCMS Piranha · Piranha
- CVE-2020-14264"HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK""HCL Traveler Companion"
- CVE-2021-35231Unquoted Path (SMB Login) VulnerabilitySolarWinds Kiwi Syslog Server
- CVE-2021-40865Unsafe Pre-Authentication Deserialization In WorkersApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2021-38294Shell Command Injection Vulnerability in Nimbus Thrift ServerApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2021-40526Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial
- CVE-2021-40371Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by .