CVEs published October 26, 2021
43 CVEs were published on October 26, 2021: 1 critical, 13 high.
- Published
- 43
- Critical
- 1
- High
- 13
- Medium
- 10
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- CODESYS
- 7
- Atlassian Jira Server · Atlassian Jira Data Center
- 5
- jquery-ui · org.webjars.npm:jquery-ui +2
- 2
- signalwire freeswitch
- 2
- Six Apart Movable Type
- 2
- caml-light
- 1
- distributed · dask
- 1
- Facebook HHVM
- 1
- froala-editor
- 1
- go-ethereum · github.com/ethereum/go-ethereum
- 1
Critical 1
High 13
- CVE-2021-35499TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilitiesTIBCO Software TIBCO Nimbus
- CVE-2021-41185Download file outside intended directorykizniche Mycodo
- CVE-2021-41175Stored XSS in Client Groups Management (Authenticated)pi-hole AdminLTE
- CVE-2021-26609WordPress Mangboard SQL-Injection vulnerabilityWordPress Mangboard
- CVE-2021-26607TOBESOFT NEXACRO17 arbitrary command execution vulnerabilityTOBESOFT NEXACRO17
- CVE-2021-34595CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-serviceCODESYS
- CVE-2021-34593CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-serviceCODESYS
- CVE-2021-34586CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)CODESYS
- CVE-2021-34585CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)CODESYS
- CVE-2021-34583CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)CODESYS
- CVE-2021-41307Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-41306Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an Atlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-41305Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filterAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 29
- CVE-2021-23877McAfee Total Protection (MTP) - Privilege Escalation vulnerabilityMcAfee Total Protection
- CVE-2021-41866MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.
- CVE-2020-22864A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitraryfroala-editor
- CVE-2019-3556HHVM supports the use of an "admin" server which accepts administrative requests over HTTP.Facebook HHVM
- CVE-2021-41188Authenticated Stored XSS in Administrationshopware · shopware/shopware
- CVE-2021-41173DoS via maliciously crafted p2p messagego-ethereum · github.com/ethereum/go-ethereum
- CVE-2021-41172Self-XSS in AS_RedisMedicean AS_Redis
- CVE-2021-41158FreeSWITCH vulnerable to SIP digest leak for configured gatewayssignalwire freeswitch
- CVE-2021-41157FreeSWITCH does not authenticate SIP SUBSCRIBE requests by defaultsignalwire freeswitch
- CVE-2021-37364OpenClinic GA 5.194.18 is affected by Insecure Permissions.
- CVE-2021-37363An Insecure Permissions issue exists in Gestionale Open 11.00.00.
- CVE-2021-37372Online Student Admission System 1.0 is affected by an insecure file upload vulnerability.
- CVE-2021-37371Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php.
- CVE-2011-4119caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.caml-light
- CVE-2011-2195A flaw was found in WebSVN 2.3.2.websvn
- CVE-2021-41078Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.nameko
- CVE-2021-41873Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital.
- CVE-2021-40344An issue was discovered in Nagios XI 5.8.5.
- CVE-2021-40343An issue was discovered in Nagios XI 5.8.5.
- CVE-2021-42343An issue was discovered in the Dask distributed package before 2021.10.0 for Python.distributed · dask
- CVE-2020-5669Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier Six Apart Movable Type
- CVE-2021-34596CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-serviceCODESYS
- CVE-2021-20837Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 rSix Apart Movable Type
- CVE-2021-41308Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File RepliAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-41304Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-40345An issue was discovered in Nagios XI 5.8.5.
- CVE-2021-41182XSS in the `altField` option of the Datepicker widgetjquery-ui · jQuery.UI.Combined +2
- CVE-2021-41183XSS in `*Text` options of the Datepicker widgetjquery-ui · org.webjars.npm:jquery-ui +2
- CVE-2021-41184XSS in the `of` option of the `.position()` utiljquery-ui · org.webjars.npm:jquery-ui +2