# CVEs published 2021-10-25

84 CVEs were published on October 25, 2021: 0 critical, 16 high. Days are UTC.

- [CVE-2021-41105](https://cve.now/CVE-2021-41105.md): FreeSWITCH susceptible to Denial of Service via invalid SRTP packets (CVSS 7.5, signalwire freeswitch)
- [CVE-2021-41145](https://cve.now/CVE-2021-41145.md): FreeSWITCH susceptible to Denial of Service via SIP flooding (CVSS 8.6, signalwire freeswitch)
- [CVE-2021-41179](https://cve.now/CVE-2021-41179.md): Two-Factor Authentication not enforced for pages marked as public (CVSS 6.5, nextcloud security-advisories)
- [CVE-2021-41178](https://cve.now/CVE-2021-41178.md): File Traversal affecting SVG files on Nextcloud Server (CVSS 8.8, nextcloud security-advisories)
- [CVE-2021-41177](https://cve.now/CVE-2021-41177.md): Rate-limits not working on instances without configured memory cache backend (CVSS 8.1, nextcloud security-advisories)
- [CVE-2021-39224](https://cve.now/CVE-2021-39224.md): File path disclosure of shared files in OfficeOnline application (CVSS 3.5, nextcloud security-advisories)
- [CVE-2021-39225](https://cve.now/CVE-2021-39225.md): Missing permission check on Deck API (CVSS 8.1, nextcloud security-advisories)
- [CVE-2021-39223](https://cve.now/CVE-2021-39223.md): File path disclosure of shared files in Richdocuments application (CVSS 4.8, nextcloud security-advisories)
- [CVE-2021-38260](https://cve.now/CVE-2021-38260.md): NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB\_HostParseDeviceConfigurationDescriptor(). (no CVSS)
- [CVE-2021-38258](https://cve.now/CVE-2021-38258.md): NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB\_HostProcessCallback(). (no CVSS)
- [CVE-2021-39221](https://cve.now/CVE-2021-39221.md): XSS in Contacts (CVSS 6.4, nextcloud security-advisories)
- [CVE-2021-39220](https://cve.now/CVE-2021-39220.md): Bypass of image blocking in Nextcloud Mail (CVSS 3.5, nextcloud security-advisories)
- [CVE-2021-34864](https://cve.now/CVE-2021-34864.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). (CVSS 8.8, Parallels Desktop)
- [CVE-2021-34863](https://cve.now/CVE-2021-34863.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 router (CVSS 8.8, D-Link DAP-2020)
- [CVE-2021-34862](https://cve.now/CVE-2021-34862.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 router (CVSS 8.8, D-Link DAP-2020)
- [CVE-2021-34861](https://cve.now/CVE-2021-34861.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 router (CVSS 8.8, D-Link DAP-2020)
- [CVE-2021-34860](https://cve.now/CVE-2021-34860.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 1.01rc00 (CVSS 6.5, D-Link DAP-2020)
- [CVE-2021-34859](https://cve.now/CVE-2021-34859.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0. (CVSS 7.8, TeamViewer)
- [CVE-2021-34857](https://cve.now/CVE-2021-34857.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). (CVSS 8.2, Parallels Desktop)
- [CVE-2021-34856](https://cve.now/CVE-2021-34856.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). (CVSS 8.2, Parallels Desktop)
- [CVE-2021-34855](https://cve.now/CVE-2021-34855.md): This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). (CVSS 6.5, Parallels Desktop)
- [CVE-2021-34854](https://cve.now/CVE-2021-34854.md): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). (CVSS 7.8, Parallels Desktop)
- [CVE-2021-41176](https://cve.now/CVE-2021-41176.md): logout CSRF in Pterodactyl Panel (CVSS 4.3, pterodactyl panel · pterodactyl/panel)
- [CVE-2021-37624](https://cve.now/CVE-2021-37624.md): FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing (CVSS 7.5, signalwire freeswitch)
- [CVE-2021-21319](https://cve.now/CVE-2021-21319.md): Several stored XSS (CVSS 6.8, galette)
- [CVE-2021-41035](https://cve.now/CVE-2021-41035.md): In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface meth (no CVSS, The Eclipse Foundation Eclipse OMR)
- [CVE-2020-20908](https://cve.now/CVE-2020-20908.md): Akaunting v1.3.17 was discovered to contain a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary we (no CVSS)
- [CVE-2017-20007](https://cve.now/CVE-2017-20007.md): Information Exposure in INGEPAC DA AU (CVSS 5.3, Ingeteam INGEPAC DA AU)
- [CVE-2021-24885](https://cve.now/CVE-2021-24885.md): YOP Poll \< 6.1.2 - Reflected Cross-Site Scripting (no CVSS, YOP Poll)
- [CVE-2021-24884](https://cve.now/CVE-2021-24884.md): Formidable Form Builder \< 4.09.05 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Formidable Form Builder – Contact Form, Survey & Quiz Forms…)
- [CVE-2021-24785](https://cve.now/CVE-2021-24785.md): Great Quotes \<= 1.0.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Great Quotes)
- [CVE-2021-24779](https://cve.now/CVE-2021-24779.md): WP Debugging \< 2.11.0 - Unauthenticated Plugin's Settings Update (no CVSS, WP Debugging)
- [CVE-2021-24774](https://cve.now/CVE-2021-24774.md): Check & Log Email \< 1.0.3 - Admin+ SQL Injections (no CVSS, Check & Log Email)
- [CVE-2021-24769](https://cve.now/CVE-2021-24769.md): Permalink Manager Lite \< 2.2.13.1 - Admin+ SQL Injection (no CVSS, Permalink Manager Lite)
- [CVE-2021-0939](https://cve.now/CVE-2021-0939.md): In set\_default\_passthru\_cfg of passthru.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-24744](https://cve.now/CVE-2021-24744.md): WordPress Contact Forms by Cimatti \< 1.4.12 - Admin+ Stored Cross-Site Scripting (no CVSS, WordPress Contact Forms by Cimatti)
- [CVE-2021-24699](https://cve.now/CVE-2021-24699.md): Easy Media Download \< 1.1.7 - Contributor+ Stored Cross-Site Scripting (no CVSS, Easy Media Download)
- [CVE-2021-24662](https://cve.now/CVE-2021-24662.md): Game Server Status \<= 1.0 - Admin+ SQL Injection (no CVSS, Game Server Status)
- [CVE-2021-24653](https://cve.now/CVE-2021-24653.md): Cookie Bar \< 1.8.9 - Admin+ Stored Cross-Site Scripting (no CVSS, Cookie Bar)
- [CVE-2021-0936](https://cve.now/CVE-2021-0936.md): In acc\_read of f\_accessory.c, there is a possible memory corruption due to a use after free. (no CVSS, Android)
- [CVE-2021-24608](https://cve.now/CVE-2021-24608.md): Formidable Form Builder \< 5.0.07 - Admin+ Stored Cross-Site Scripting (no CVSS, Formidable Form Builder – Contact Form, Survey & Quiz Forms…)
- [CVE-2021-24544](https://cve.now/CVE-2021-24544.md): Responsive WordPress Slider \<= 2.2.0 - Subscriber+ Stored Cross-Site Scripting (no CVSS, Responsive WordPress Slider)
- [CVE-2021-24543](https://cve.now/CVE-2021-24543.md): jQuery Reply to Comment \<= 1.31 - CSRF to Stored Cross-Site Scripting (no CVSS, jQuery Reply to Comment)
- [CVE-2021-24515](https://cve.now/CVE-2021-24515.md): Video Gallery - Vimeo and YouTube Gallery \< 1.1.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Video Gallery - Vimeo and YouTube Gallery)
- [CVE-2021-0938](https://cve.now/CVE-2021-0938.md): In memzero\_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. (no CVSS, Android)
- [CVE-2021-24514](https://cve.now/CVE-2021-24514.md): Visual Form Builder \< 3.0.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Visual Form Builder)
- [CVE-2021-24489](https://cve.now/CVE-2021-24489.md): Request a Quote \< 2.3.9 - Admin+ Stored Cross-Site Scripting (no CVSS, Request a Quote)
- [CVE-2021-24487](https://cve.now/CVE-2021-24487.md): St Daily Tip \<= 4.7 - CSRF to Stored Cross-Site Scripting (no CVSS, St-Daily-Tip)
- [CVE-2021-24485](https://cve.now/CVE-2021-24485.md): Special Text Boxes \< 5.9.110 - Admin+ Stored Cross-Site Scripting (no CVSS, Special Text Boxes)
- [CVE-2021-24414](https://cve.now/CVE-2021-24414.md): YT Player \< 1.4 - Contributor+ Stored Cross-Site Scripting (no CVSS, Video Player for YouTube)
- [CVE-2021-24381](https://cve.now/CVE-2021-24381.md): NinjaForms \< 3.5.8.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-0940](https://cve.now/CVE-2021-0940.md): In TBD of TBD, there is a possible out of bounds write due to improper locking. (no CVSS, Android)
- [CVE-2021-0935](https://cve.now/CVE-2021-0935.md): In ip6\_xmit of ip6\_output.c, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-0941](https://cve.now/CVE-2021-0941.md): In bpf\_skb\_change\_head of filter.c, there is a possible out of bounds read due to a use after free. (no CVSS, Android)
- [CVE-2021-0663](https://cve.now/CVE-2021-0663.md): In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…)
- [CVE-2021-0662](https://cve.now/CVE-2021-0662.md): In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…)
- [CVE-2021-0661](https://cve.now/CVE-2021-0661.md): In audio DSP, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…)
- [CVE-2021-0634](https://cve.now/CVE-2021-0634.md): In display driver, there is a possible memory corruption due to uninitialized data. (no CVSS, MT6735, MT6739, MT6761, MT6765, MT6771, MT6779, MT6785, MT8…)
- [CVE-2021-0633](https://cve.now/CVE-2021-0633.md): In display driver, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT6762, MT6…)
- [CVE-2021-0632](https://cve.now/CVE-2021-0632.md): In wifi driver, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MT6739, MT6761, MT6762, MT6765, MT6768, MT6771, MT6779, MT6…)
- [CVE-2021-0631](https://cve.now/CVE-2021-0631.md): In wifi driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6761, MT6762, MT6765, MT6768, MT6779, MT6785, MT6833, MT6…)
- [CVE-2021-0630](https://cve.now/CVE-2021-0630.md): In wifi driver, there is a possible system crash due to a missing bounds check. (no CVSS, MT6761, MT6762, MT6765, MT6768, MT6779, MT6785, MT6833, MT6…)
- [CVE-2021-0625](https://cve.now/CVE-2021-0625.md): In ccu, there is a possible memory corruption due to improper locking. (no CVSS, MT6762, MT6765, MT6768, MT6771, MT6779, MT6785, MT8183, MT8…)
- [CVE-2021-0618](https://cve.now/CVE-2021-0618.md): In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT6739, MT6758, MT6761, MT6762, MT6763, MT6765, MT6768, MT6…)
- [CVE-2021-0617](https://cve.now/CVE-2021-0617.md): In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6739, MT6761, MT6…)
- [CVE-2021-0616](https://cve.now/CVE-2021-0616.md): In ape extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6739, MT6758, MT6…)
- [CVE-2021-0615](https://cve.now/CVE-2021-0615.md): In flv extractor, there is a possible out of bounds read due to an integer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0614](https://cve.now/CVE-2021-0614.md): In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0613](https://cve.now/CVE-2021-0613.md): In asf extractor, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0414](https://cve.now/CVE-2021-0414.md): In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0413](https://cve.now/CVE-2021-0413.md): In flv extractor, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0412](https://cve.now/CVE-2021-0412.md): In flv extractor, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0411](https://cve.now/CVE-2021-0411.md): In flv extractor, there is a possible out of bounds read due to an integer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0410](https://cve.now/CVE-2021-0410.md): In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0409](https://cve.now/CVE-2021-0409.md): In flv extractor, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-25977](https://cve.now/CVE-2021-25977.md): Piranha CMS - Stored XSS in Page Title (CVSS 5.4, PiranhaCMS Piranha · Piranha)
- [CVE-2020-14264](https://cve.now/CVE-2020-14264.md): "HCL Traveler Companion is vulnerable to an iOS weak cryptographic process vulnerability via the included MobileIron AppConnect SDK" (no CVSS, "HCL Traveler Companion")
- [CVE-2021-35231](https://cve.now/CVE-2021-35231.md): Unquoted Path (SMB Login) Vulnerability (CVSS 6.7, SolarWinds Kiwi Syslog Server)
- [CVE-2021-40865](https://cve.now/CVE-2021-40865.md): Unsafe Pre-Authentication Deserialization In Workers (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2021-38294](https://cve.now/CVE-2021-38294.md): Shell Command Injection Vulnerability in Nimbus Thrift Server (no CVSS, Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2021-40526](https://cve.now/CVE-2021-40526.md): Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial (CVSS 4.8)
- [CVE-2021-40527](https://cve.now/CVE-2021-40527.md): Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7. (CVSS 8.6)
- [CVE-2021-40371](https://cve.now/CVE-2021-40371.md): Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution, as demonstrated by . (no CVSS)
- [CVE-2021-21703](https://cve.now/CVE-2021-21703.md): PHP-FPM memory access in root process leading to privilege escalation (CVSS 7.8, PHP Group PHP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.