CVEs published October 27, 2021
70 CVEs were published on October 27, 2021: 1 critical, 14 high.
- Published
- 70
- Critical
- 1
- High
- 14
- Medium
- 27
- Low
- 3
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Cisco Adaptive Security Appliance (ASA) Software
- 11
- Cisco Firepower Threat Defense Software
- 6
- Calibre
- 3
- Cisco Firepower Management Center
- 3
- NVIDIA GPU Display Driver
- 3
- SolarWinds Kiwi Syslog Server
- 3
- firefly-iii/firefly-iii · grumpydictator/firefly-iii
- 2
- IBM Rational Collaborative Lifecycle Management · IBM En… +4
- 2
- Advantech WebAccess/NMS
- 1
- bookstackapp/bookstack
- 1
Critical 1
High 14
- CVE-2021-3903Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-41191API giving out files without keyRedon-Tech Roblox-Purchasing-Hub
- CVE-2021-40118Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40117Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-40116Multiple Cisco Products Snort Rule Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-34793Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Transparent Mode Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34792Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Resource Exhaustion Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34783Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34781Cisco Firepower Threat Defense Software SSH Connections Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34762Cisco Firepower Management Center Software Authenticated Directory Traversal VulnerabilityCisco Firepower Management Center
- CVE-2021-29774IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations.IBM Rational Collaborative Lifecycle Management · IBM En… +4
- CVE-2021-34580Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0MB connect line mymbCONNECT24 · MB connect line mbCONNECT24
- CVE-2021-26610godomall5 remote code execution vulnerabilityNHN COMMERCE godomall5 Std, godomall5 Pro
- CVE-2020-7867Helpu arbitrary file creation vulnerabilityHelpuViewer.exe
Medium, low and unrated 55
- CVE-2021-3906Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstackbookstackapp/bookstack
- CVE-2021-3904Cross-site Scripting (XSS) - Stored in getgrav/gravgetgrav/grav
- CVE-2021-25219Lame cache can be abused to severely degrade resolver performanceISC BIND9
- CVE-2021-3901Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-1117Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific confiNVIDIA GPU Display Driver
- CVE-2021-1116NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL pointer dereference in NVIDIA GPU Display Driver
- CVE-2021-1115NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs, where an NVIDIA GPU Display Driver
- CVE-2020-21250CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.
- CVE-2021-40114Multiple Cisco Products Snort Memory Leak Denial of Service VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-34794Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34791Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34790Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass VulnerabilitiesCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34787Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-34764Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect VulnerabilitiesCisco Firepower Management Center
- CVE-2021-34763Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect VulnerabilitiesCisco Firepower Management Center
- CVE-2021-34761Cisco Firepower Threat Defense Software CLI Arbitrary File Write VulnerabilityCisco Firepower Threat Defense Software
- CVE-2021-34756Cisco Firepower Threat Defense Software Command Injection VulnerabilitiesCisco Firepower Threat Defense Software
- CVE-2021-34755Cisco Firepower Threat Defense Software Command Injection VulnerabilitiesCisco Firepower Threat Defense Software
- CVE-2021-34754Cisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass VulnerabilitiesCisco Firepower Threat Defense Software
- CVE-2021-40125Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv2 Site-to-Site VPN Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2021-3900Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-37808SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescri
- CVE-2021-37807An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /check_availability
- CVE-2021-29868IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration.IBM i2 iBase
- CVE-2021-37806An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0.
- CVE-2021-29844IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF).IBM Engineering Workflow Management · IBM Rational DOORS… +4
- CVE-2021-29786IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user.IBM Engineering Lifecycle Optimization · IBM Rational Co… +4
- CVE-2021-29713IBM Jazz Team Server products are vulnerable to cross-site scripting.IBM Rational Collaborative Lifecycle Management · IBM En… +4
- CVE-2021-29673IBM Jazz Team Server products are vulnerable to cross-site scripting.IBM Rational Team Concert · IBM Rational DOORS Next Gene… +4
- CVE-2021-20526IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag.IBM Planning Analytics
- CVE-2021-37805A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the a
- CVE-2021-37803An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username in lognin.php .
- CVE-2021-36756CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.
- CVE-2021-38379The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.
- CVE-2021-37221A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer cr
- CVE-2021-22101Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated aCloud Foundry Cloud Controller
- CVE-2020-24932An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in complaint-details.php.
- CVE-2021-41589In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code executi
- CVE-2021-41619An issue was discovered in Gradle Enterprise before 2021.1.2.
- CVE-2021-41590In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test.
- CVE-2021-41872Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a d
- CVE-2021-35236Missing Secure Flag From SSL CookieSolarWinds Kiwi Syslog Server
- CVE-2021-35235ASP.NET Debug Feature EnabledSolarWinds Kiwi Syslog Server
- CVE-2021-32951Advantech WebAccess/NMS Improper AuthenticationAdvantech WebAccess/NMS
- CVE-2011-4574PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm.PolarSSL
- CVE-2021-35233HTTP TRACK & TRACE Methods EnabledSolarWinds Kiwi Syslog Server
- CVE-2011-4126Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to aCalibre
- CVE-2011-4125A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute aCalibre
- CVE-2011-4124Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privilegCalibre
- CVE-2021-37129There is an out of bounds write vulnerability in some Huawei products.IIPS Module;NGFW Module;NIP6600;S12700;S1700;S2700;S5700;S6…
- CVE-2021-37122There is a use-after-free (UAF) vulnerability in Huawei products.CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-37130There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to consFusionCube
- CVE-2021-37127There is a signature management vulnerability in some huawei products.iManager NetEco;iManager NetEco
- CVE-2021-37124There is a path traversal vulnerability in Huawei PC product.PC Smart Full Scene
- CVE-2021-37131There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000.ManageOne;iManager NetEco;iManager NetEco