# CVEs published 2021-10-27

70 CVEs were published on October 27, 2021: 1 critical, 14 high. Days are UTC.

- [CVE-2021-3906](https://cve.now/CVE-2021-3906.md): Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (CVSS 5.4, bookstackapp/bookstack)
- [CVE-2021-3904](https://cve.now/CVE-2021-3904.md): Cross-site Scripting (XSS) - Stored in getgrav/grav (CVSS 6.3, getgrav/grav)
- [CVE-2021-25219](https://cve.now/CVE-2021-25219.md): Lame cache can be abused to severely degrade resolver performance (CVSS 5.3, ISC BIND9)
- [CVE-2021-3903](https://cve.now/CVE-2021-3903.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2021-3901](https://cve.now/CVE-2021-3901.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 3.5, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-1117](https://cve.now/CVE-2021-1117.md): Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an attacker through specific confi (CVSS 4.7, NVIDIA GPU Display Driver)
- [CVE-2021-1116](https://cve.now/CVE-2021-1116.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a NULL pointer dereference in (CVSS 5.5, NVIDIA GPU Display Driver)
- [CVE-2021-1115](https://cve.now/CVE-2021-1115.md): NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs, where an (CVSS 6.5, NVIDIA GPU Display Driver)
- [CVE-2021-41191](https://cve.now/CVE-2021-41191.md): API giving out files without key (CVSS 7.5, Redon-Tech Roblox-Purchasing-Hub)
- [CVE-2020-21250](https://cve.now/CVE-2020-21250.md): CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY\_Security.php. (no CVSS)
- [CVE-2021-40118](https://cve.now/CVE-2021-40118.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service Vulnerabilities (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-40117](https://cve.now/CVE-2021-40117.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-40116](https://cve.now/CVE-2021-40116.md): Multiple Cisco Products Snort Rule Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2021-40114](https://cve.now/CVE-2021-40114.md): Multiple Cisco Products Snort Memory Leak Denial of Service Vulnerability (CVSS 6.8, Cisco Firepower Threat Defense Software)
- [CVE-2021-34794](https://cve.now/CVE-2021-34794.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software SNMP Access Control Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34793](https://cve.now/CVE-2021-34793.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Transparent Mode Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34792](https://cve.now/CVE-2021-34792.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Resource Exhaustion Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34791](https://cve.now/CVE-2021-34791.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities (CVSS 4.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34790](https://cve.now/CVE-2021-34790.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities (CVSS 4.7, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34787](https://cve.now/CVE-2021-34787.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Identity-Based Rule Bypass Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34783](https://cve.now/CVE-2021-34783.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Software-Based SSL/TLS Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34781](https://cve.now/CVE-2021-34781.md): Cisco Firepower Threat Defense Software SSH Connections Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-34764](https://cve.now/CVE-2021-34764.md): Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2021-34763](https://cve.now/CVE-2021-34763.md): Cisco Firepower Management Center Software Cross-Site Scripting and Open Redirect Vulnerabilities (CVSS 4.8, Cisco Firepower Management Center)
- [CVE-2021-34762](https://cve.now/CVE-2021-34762.md): Cisco Firepower Management Center Software Authenticated Directory Traversal Vulnerability (CVSS 8.1, Cisco Firepower Management Center)
- [CVE-2021-34761](https://cve.now/CVE-2021-34761.md): Cisco Firepower Threat Defense Software CLI Arbitrary File Write Vulnerability (CVSS 4.4, Cisco Firepower Threat Defense Software)
- [CVE-2021-34756](https://cve.now/CVE-2021-34756.md): Cisco Firepower Threat Defense Software Command Injection Vulnerabilities (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2021-34755](https://cve.now/CVE-2021-34755.md): Cisco Firepower Threat Defense Software Command Injection Vulnerabilities (CVSS 6.7, Cisco Firepower Threat Defense Software)
- [CVE-2021-34754](https://cve.now/CVE-2021-34754.md): Cisco Firepower Threat Defense Software Ethernet Industrial Protocol Policy Bypass Vulnerabilities (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2021-40125](https://cve.now/CVE-2021-40125.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv2 Site-to-Site VPN Denial of Service Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2021-3900](https://cve.now/CVE-2021-3900.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 4.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-37808](https://cve.now/CVE-2021-37808.md): SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the (1) category, (2) subcategory, (3) sucatdescri (no CVSS)
- [CVE-2021-37807](https://cve.now/CVE-2021-37807.md): An SQL Injection vulneraility exists in https://phpgurukul.com Online Shopping Portal 3.1 via the email parameter on the /check\_availability (no CVSS)
- [CVE-2021-29868](https://cve.now/CVE-2021-29868.md): IBM i2 iBase 8.9.13 and 9.0.0 could allow a local attacker to obtain sensitive information due to insufficient session expiration. (CVSS 4.0, IBM i2 iBase)
- [CVE-2021-37806](https://cve.now/CVE-2021-37806.md): An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. (no CVSS)
- [CVE-2021-29844](https://cve.now/CVE-2021-29844.md): IBM Jazz Team Server products is vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM Engineering Workflow Management · IBM Rational DOORS… +4)
- [CVE-2021-29786](https://cve.now/CVE-2021-29786.md): IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. (CVSS 6.5, IBM Engineering Lifecycle Optimization · IBM Rational Co… +4)
- [CVE-2021-29774](https://cve.now/CVE-2021-29774.md): IBM Jazz Team Server products could allow an authenticated user to obtain elevated privileges under certain configurations. (CVSS 7.5, IBM Rational Collaborative Lifecycle Management · IBM En… +4)
- [CVE-2021-29713](https://cve.now/CVE-2021-29713.md): IBM Jazz Team Server products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Collaborative Lifecycle Management · IBM En… +4)
- [CVE-2021-29673](https://cve.now/CVE-2021-29673.md): IBM Jazz Team Server products are vulnerable to cross-site scripting. (CVSS 5.4, IBM Rational Team Concert · IBM Rational DOORS Next Gene… +4)
- [CVE-2021-20526](https://cve.now/CVE-2021-20526.md): IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. (CVSS 3.7, IBM Planning Analytics)
- [CVE-2021-37805](https://cve.now/CVE-2021-37805.md): A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the a (no CVSS)
- [CVE-2021-37803](https://cve.now/CVE-2021-37803.md): An SQL Injection vulnerability exists in Sourcecodester Online Covid Vaccination Scheduler System 1.0 via the username in lognin.php . (no CVSS)
- [CVE-2021-36756](https://cve.now/CVE-2021-36756.md): CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation. (no CVSS)
- [CVE-2021-38379](https://cve.now/CVE-2021-38379.md): The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure. (no CVSS)
- [CVE-2021-37221](https://cve.now/CVE-2021-37221.md): A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer cr (no CVSS)
- [CVE-2021-22101](https://cve.now/CVE-2021-22101.md): Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated a (no CVSS, Cloud Foundry Cloud Controller)
- [CVE-2020-24932](https://cve.now/CVE-2020-24932.md): An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in complaint-details.php. (no CVSS)
- [CVE-2021-41589](https://cve.now/CVE-2021-41589.md): In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code executi (no CVSS)
- [CVE-2021-41619](https://cve.now/CVE-2021-41619.md): An issue was discovered in Gradle Enterprise before 2021.1.2. (no CVSS)
- [CVE-2021-41590](https://cve.now/CVE-2021-41590.md): In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. (no CVSS)
- [CVE-2021-41872](https://cve.now/CVE-2021-41872.md): Skyworth Digital Technology Penguin Aurora Box 41502 has a denial of service vulnerability, which can be exploited by attackers to cause a d (no CVSS)
- [CVE-2021-34580](https://cve.now/CVE-2021-34580.md): Remote user enumeration in mymbCONNECT24, mbCONNECT24 \<= 2.9.0 (CVSS 7.5, MB connect line mymbCONNECT24 · MB connect line mbCONNECT24)
- [CVE-2021-35236](https://cve.now/CVE-2021-35236.md): Missing Secure Flag From SSL Cookie (CVSS 3.1, SolarWinds Kiwi Syslog Server)
- [CVE-2021-35235](https://cve.now/CVE-2021-35235.md): ASP.NET Debug Feature Enabled (CVSS 5.3, SolarWinds Kiwi Syslog Server)
- [CVE-2021-32951](https://cve.now/CVE-2021-32951.md): Advantech WebAccess/NMS Improper Authentication (CVSS 5.3, Advantech WebAccess/NMS)
- [CVE-2011-4574](https://cve.now/CVE-2011-4574.md): PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. (no CVSS, PolarSSL)
- [CVE-2021-35233](https://cve.now/CVE-2021-35233.md): HTTP TRACK & TRACE Methods Enabled (CVSS 5.3, SolarWinds Kiwi Syslog Server)
- [CVE-2011-4126](https://cve.now/CVE-2011-4126.md): Race condition issues were found in Calibre at devices/linux\_mount\_helper.c allowing unprivileged users the ability to mount any device to a (no CVSS, Calibre)
- [CVE-2011-4125](https://cve.now/CVE-2011-4125.md): A untrusted search path issue was found in Calibre at devices/linux\_mount\_helper.c leading to the ability of unprivileged users to execute a (no CVSS, Calibre)
- [CVE-2011-4124](https://cve.now/CVE-2011-4124.md): Input validation issues were found in Calibre at devices/linux\_mount\_helper.c which can lead to argument injection and elevation of privileg (no CVSS, Calibre)
- [CVE-2021-38450](https://cve.now/CVE-2021-38450.md): Trane Tracer Code Injection (CVSS 9.9, Trane Tracer SC · Trane Tracer SC+ +1)
- [CVE-2021-26610](https://cve.now/CVE-2021-26610.md): godomall5 remote code execution vulnerability (CVSS 7.2, NHN COMMERCE godomall5 Std, godomall5 Pro)
- [CVE-2020-7867](https://cve.now/CVE-2020-7867.md): Helpu arbitrary file creation vulnerability (CVSS 8.0, HelpuViewer.exe)
- [CVE-2021-37129](https://cve.now/CVE-2021-37129.md): There is an out of bounds write vulnerability in some Huawei products. (no CVSS, IIPS Module;NGFW Module;NIP6600;S12700;S1700;S2700;S5700;S6…)
- [CVE-2021-37122](https://cve.now/CVE-2021-37122.md): There is a use-after-free (UAF) vulnerability in Huawei products. (no CVSS, CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…)
- [CVE-2021-37130](https://cve.now/CVE-2021-37130.md): There is a path traversal vulnerability in Huawei FusionCube 6.0.2.The vulnerability is due to that the software uses external input to cons (no CVSS, FusionCube)
- [CVE-2021-37127](https://cve.now/CVE-2021-37127.md): There is a signature management vulnerability in some huawei products. (no CVSS, iManager NetEco;iManager NetEco)
- [CVE-2021-37124](https://cve.now/CVE-2021-37124.md): There is a path traversal vulnerability in Huawei PC product. (no CVSS, PC Smart Full Scene)
- [CVE-2021-37131](https://cve.now/CVE-2021-37131.md): There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. (no CVSS, ManageOne;iManager NetEco;iManager NetEco)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.