# CVEs published 2021-10-26

43 CVEs were published on October 26, 2021: 1 critical, 13 high. Days are UTC.

- [CVE-2021-23877](https://cve.now/CVE-2021-23877.md): McAfee Total Protection (MTP) - Privilege Escalation vulnerability (CVSS 6.7, McAfee Total Protection)
- [CVE-2021-41866](https://cve.now/CVE-2021-41866.md): MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly. (no CVSS)
- [CVE-2020-22864](https://cve.now/CVE-2020-22864.md): A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrary (no CVSS, froala-editor)
- [CVE-2019-3556](https://cve.now/CVE-2019-3556.md): HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. (no CVSS, Facebook HHVM)
- [CVE-2021-35499](https://cve.now/CVE-2021-35499.md): TIBCO Nimbus Stored Cross-site Scripting (XSS) vulnerabilities (CVSS 8.0, TIBCO Software TIBCO Nimbus)
- [CVE-2021-41188](https://cve.now/CVE-2021-41188.md): Authenticated Stored XSS in Administration (CVSS 5.7, shopware · shopware/shopware)
- [CVE-2021-41185](https://cve.now/CVE-2021-41185.md): Download file outside intended directory (CVSS 8.8, kizniche Mycodo)
- [CVE-2021-41175](https://cve.now/CVE-2021-41175.md): Stored XSS in Client Groups Management (Authenticated) (CVSS 7.3, pi-hole AdminLTE)
- [CVE-2021-41173](https://cve.now/CVE-2021-41173.md): DoS via maliciously crafted p2p message (CVSS 5.7, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2021-41172](https://cve.now/CVE-2021-41172.md): Self-XSS in AS\_Redis (CVSS 6.4, Medicean AS\_Redis)
- [CVE-2021-41158](https://cve.now/CVE-2021-41158.md): FreeSWITCH vulnerable to SIP digest leak for configured gateways (CVSS 5.8, signalwire freeswitch)
- [CVE-2021-41157](https://cve.now/CVE-2021-41157.md): FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default (CVSS 5.3, signalwire freeswitch)
- [CVE-2021-37364](https://cve.now/CVE-2021-37364.md): OpenClinic GA 5.194.18 is affected by Insecure Permissions. (no CVSS)
- [CVE-2021-37363](https://cve.now/CVE-2021-37363.md): An Insecure Permissions issue exists in Gestionale Open 11.00.00. (no CVSS)
- [CVE-2021-37372](https://cve.now/CVE-2021-37372.md): Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. (no CVSS)
- [CVE-2021-37371](https://cve.now/CVE-2021-37371.md): Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login.php. (no CVSS)
- [CVE-2011-4119](https://cve.now/CVE-2011-4119.md): caml-light \<= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install. (no CVSS, caml-light)
- [CVE-2011-2195](https://cve.now/CVE-2011-2195.md): A flaw was found in WebSVN 2.3.2. (no CVSS, websvn)
- [CVE-2021-26609](https://cve.now/CVE-2021-26609.md): WordPress Mangboard SQL-Injection vulnerability (CVSS 7.5, WordPress Mangboard)
- [CVE-2021-41078](https://cve.now/CVE-2021-41078.md): Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file. (no CVSS, nameko)
- [CVE-2021-26607](https://cve.now/CVE-2021-26607.md): TOBESOFT NEXACRO17 arbitrary command execution vulnerability (CVSS 8.1, TOBESOFT NEXACRO17)
- [CVE-2021-41873](https://cve.now/CVE-2021-41873.md): Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. (no CVSS)
- [CVE-2021-40344](https://cve.now/CVE-2021-40344.md): An issue was discovered in Nagios XI 5.8.5. (no CVSS)
- [CVE-2021-40343](https://cve.now/CVE-2021-40343.md): An issue was discovered in Nagios XI 5.8.5. (no CVSS)
- [CVE-2021-42343](https://cve.now/CVE-2021-42343.md): An issue was discovered in the Dask distributed package before 2021.10.0 for Python. (no CVSS, distributed · dask)
- [CVE-2020-5669](https://cve.now/CVE-2020-5669.md): Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier (no CVSS, Six Apart Movable Type)
- [CVE-2021-34596](https://cve.now/CVE-2021-34596.md): CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service (CVSS 6.5, CODESYS)
- [CVE-2021-34595](https://cve.now/CVE-2021-34595.md): CODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service (CVSS 8.1, CODESYS)
- [CVE-2021-34593](https://cve.now/CVE-2021-34593.md): CODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service (CVSS 7.5, CODESYS)
- [CVE-2021-34586](https://cve.now/CVE-2021-34586.md): CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS) (CVSS 7.5, CODESYS)
- [CVE-2021-34585](https://cve.now/CVE-2021-34585.md): CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS) (CVSS 7.5, CODESYS)
- [CVE-2021-34584](https://cve.now/CVE-2021-34584.md): CODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS) (CVSS 9.1, CODESYS)
- [CVE-2021-34583](https://cve.now/CVE-2021-34583.md): CODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS) (CVSS 7.5, CODESYS)
- [CVE-2021-20837](https://cve.now/CVE-2021-20837.md): Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r (no CVSS, Six Apart Movable Type)
- [CVE-2021-41308](https://cve.now/CVE-2021-41308.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File Repli (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41307](https://cve.now/CVE-2021-41307.md): Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41306](https://cve.now/CVE-2021-41306.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41305](https://cve.now/CVE-2021-41305.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filter (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41304](https://cve.now/CVE-2021-41304.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-40345](https://cve.now/CVE-2021-40345.md): An issue was discovered in Nagios XI 5.8.5. (no CVSS)
- [CVE-2021-41182](https://cve.now/CVE-2021-41182.md): XSS in the \`altField\` option of the Datepicker widget (CVSS 6.5, jquery-ui · jQuery.UI.Combined +2)
- [CVE-2021-41183](https://cve.now/CVE-2021-41183.md): XSS in \`\*Text\` options of the Datepicker widget (CVSS 6.5, jquery-ui · org.webjars.npm:jquery-ui +2)
- [CVE-2021-41184](https://cve.now/CVE-2021-41184.md): XSS in the \`of\` option of the \`.position()\` util (CVSS 6.5, jquery-ui · org.webjars.npm:jquery-ui +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.