# CVEs published 2021-10-28

105 CVEs were published on October 28, 2021: 1 critical, 5 high. Days are UTC.

- [CVE-2020-23549](https://cve.now/CVE-2020-23549.md): IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted .cr2 file, related to a "Da (no CVSS)
- [CVE-2020-23546](https://cve.now/CVE-2020-23546.md): IrfanView 4.54 allows attackers to cause a denial of service or possibly other unspecified impacts via a crafted XBM file, related to a "Dat (no CVSS)
- [CVE-2021-41194](https://cve.now/CVE-2021-41194.md): Improper Access Control in jupyterhub-firstuseauthenticator (CVSS 9.1, jupyterhub firstuseauthenticator · jupyterhub-firstuseauthe…)
- [CVE-2021-36551](https://cve.now/CVE-2021-36551.md): TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. (no CVSS)
- [CVE-2021-36550](https://cve.now/CVE-2021-36550.md): TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse\_categories.php. (no CVSS)
- [CVE-2021-36547](https://cve.now/CVE-2021-36547.md): A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitra (no CVSS)
- [CVE-2021-36548](https://cve.now/CVE-2021-36548.md): A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit\_template&filename=blog of Monstra v3.0.4 (no CVSS)
- [CVE-2020-25422](https://cve.now/CVE-2020-25422.md): A cross site scripting (XSS) vulnerability in menuedit.php of Mara CMS 7.5 allows attackers to execute arbitrary web scripts or HTML via a c (no CVSS)
- [CVE-2021-30834](https://cve.now/CVE-2021-30834.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2021-30836](https://cve.now/CVE-2021-30836.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2021-30833](https://cve.now/CVE-2021-30833.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2021-30840](https://cve.now/CVE-2021-30840.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2021-30821](https://cve.now/CVE-2021-30821.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2021-30824](https://cve.now/CVE-2021-30824.md): A memory corruption issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2021-30817](https://cve.now/CVE-2021-30817.md): A permissions issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2021-30831](https://cve.now/CVE-2021-30831.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2021-30823](https://cve.now/CVE-2021-30823.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2021-30814](https://cve.now/CVE-2021-30814.md): A memory corruption issue was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2021-30816](https://cve.now/CVE-2021-30816.md): The issue was addressed with improved permissions logic. (no CVSS, Apple iOS and iPadOS)
- [CVE-2021-30818](https://cve.now/CVE-2021-30818.md): A type confusion issue was addressed with improved state handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2021-30808](https://cve.now/CVE-2021-30808.md): This issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2021-30809](https://cve.now/CVE-2021-30809.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2021-1821](https://cve.now/CVE-2021-1821.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2021-30813](https://cve.now/CVE-2021-30813.md): This issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2020-29629](https://cve.now/CVE-2020-29629.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2020-9897](https://cve.now/CVE-2020-9897.md): An out-of-bounds write was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2021-3745](https://cve.now/CVE-2021-3745.md): Unrestricted Upload of File with Dangerous Type in flatcore/flatcore-cms (CVSS 8.0, flatcore/flatcore-cms)
- [CVE-2020-7875](https://cve.now/CVE-2020-7875.md): RAONWIZ DEXT5 Upload ActiveX remote file execution vulnerability (CVSS 7.5, RAONWIZ DEXT5 Upload)
- [CVE-2021-22097](https://cve.now/CVE-2021-22097.md): In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body (no CVSS, Spring AMQP · org.springframework.amqp:spring-amqp)
- [CVE-2021-22096](https://cve.now/CVE-2021-22096.md): In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious (no CVSS, Spring Framework · org.springframework:spring-core +1)
- [CVE-2021-22047](https://cve.now/CVE-2021-22047.md): In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers (no CVSS, Spring Data REST · org.springframework.data:spring-data-res…)
- [CVE-2021-22044](https://cve.now/CVE-2021-22044.md): In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level \`@Re (no CVSS, Spring Cloud OpenFeign · org.springframework.cloud:spring-c…)
- [CVE-2021-41728](https://cve.now/CVE-2021-41728.md): Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles. (no CVSS)
- [CVE-2020-22312](https://cve.now/CVE-2020-22312.md): A cross-site scripting (XSS) vulnerability was discovered in the OJ/admin-tool /cal\_scores.php function of HZNUOJ v1.0. (no CVSS)
- [CVE-2021-3823](https://cve.now/CVE-2021-3823.md): Path traversal vulnerability in Bitdefender GravitZone Update Server in relay mode (CVSS 7.1, Bitdefender GravityZone Update Server)
- [CVE-2021-3576](https://cve.now/CVE-2021-3576.md): Privilege escalation via SeImpersonatePrivilege (CVSS 7.8, Bitdefender Endpoint Security Tools · Bitdefender Total Sec…)
- [CVE-2021-3579](https://cve.now/CVE-2021-3579.md): Incorrect Default Permissions vulnerability in bdservicehost.exe and Vulnerability.Scan.exe (CVSS 7.8, Bitdefender ENdpoint Security Tools for Windows · Bitdefend…)
- [CVE-2021-37254](https://cve.now/CVE-2021-37254.md): In M-Files Web product with versions before 20.10.9524.1 and 20.10.9445.0, a remote attacker could use a flaw to obtain unauthenticated acce (no CVSS)
- [CVE-2021-22278](https://cve.now/CVE-2021-22278.md): Certificate verification vulnerability in Update Manager of PCM600 Engineering Tool (CVSS 6.7, ABB PCM600 · Hitachi Energy PCM600)
- [CVE-2021-22471](https://cve.now/CVE-2021-22471.md): A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22464](https://cve.now/CVE-2021-22464.md): A component of the HarmonyOS has a Out-of-bounds Read vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22461](https://cve.now/CVE-2021-22461.md): A component of the HarmonyOS has a Allocation of Resources Without Limits or Throttling vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22453](https://cve.now/CVE-2021-22453.md): A component of the HarmonyOS has a Improper Input Validation vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22467](https://cve.now/CVE-2021-22467.md): A component of the HarmonyOS has a Improper Input Validation vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22458](https://cve.now/CVE-2021-22458.md): A component of the HarmonyOS has a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22454](https://cve.now/CVE-2021-22454.md): A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22469](https://cve.now/CVE-2021-22469.md): A component of the HarmonyOS has a Out-of-bounds Read vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22468](https://cve.now/CVE-2021-22468.md): A component of the HarmonyOS has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22466](https://cve.now/CVE-2021-22466.md): A component of the HarmonyOS has a Use After Free vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22463](https://cve.now/CVE-2021-22463.md): A component of the HarmonyOS has a Use After Free vulnerability . (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22462](https://cve.now/CVE-2021-22462.md): A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22455](https://cve.now/CVE-2021-22455.md): A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22452](https://cve.now/CVE-2021-22452.md): A component of the HarmonyOS has a Improper Input Validation vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22465](https://cve.now/CVE-2021-22465.md): A component of the HarmonyOS has a Heap-based Buffer Overflow vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22456](https://cve.now/CVE-2021-22456.md): A component of the HarmonyOS has a Data Processing Errors vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22450](https://cve.now/CVE-2021-22450.md): A component of the HarmonyOS has a Incomplete Cleanup vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22470](https://cve.now/CVE-2021-22470.md): A component of the HarmonyOS has a Privileges Controls vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22460](https://cve.now/CVE-2021-22460.md): A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22459](https://cve.now/CVE-2021-22459.md): A component of the HarmonyOS has a NULL Pointer Dereference vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22457](https://cve.now/CVE-2021-22457.md): A component of the HarmonyOS has a Improper Input Validation vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-22451](https://cve.now/CVE-2021-22451.md): A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37002](https://cve.now/CVE-2021-37002.md): There is a Memory out-of-bounds access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause malicious (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37001](https://cve.now/CVE-2021-37001.md): There is a Register tampering vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow the register value (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36999](https://cve.now/CVE-2021-36999.md): There is a Buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by sending malicious images and (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36998](https://cve.now/CVE-2021-36998.md): There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to rea (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36997](https://cve.now/CVE-2021-36997.md): There is a Low memory error in Huawei Smartphone due to the unlimited size of images to be parsed.Successful exploitation of this vulnerabil (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36996](https://cve.now/CVE-2021-36996.md): There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission of (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36995](https://cve.now/CVE-2021-36995.md): There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft link (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36994](https://cve.now/CVE-2021-36994.md): There is a issue that trustlist strings being repeatedly inserted into the linked list in Huawei Smartphone due to race conditions. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36993](https://cve.now/CVE-2021-36993.md): There is a Memory leaks vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36992](https://cve.now/CVE-2021-36992.md): There is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confi (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36991](https://cve.now/CVE-2021-36991.md): There is an Unauthorized file access vulnerability in Huawei Smartphone due to unstandardized path input.Successful exploitation of this vul (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36990](https://cve.now/CVE-2021-36990.md): There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permis (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36989](https://cve.now/CVE-2021-36989.md): There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permissions. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36988](https://cve.now/CVE-2021-36988.md): There is a Parameter verification issue in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36987](https://cve.now/CVE-2021-36987.md): There is a issue that nodes in the linked list being freed for multiple times in Huawei Smartphone due to race conditions. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36986](https://cve.now/CVE-2021-36986.md): There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability may escalate permis (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-36985](https://cve.now/CVE-2021-36985.md): There is a Code injection vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may exhaust system resources and (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22491](https://cve.now/CVE-2021-22491.md): There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availabil (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22490](https://cve.now/CVE-2021-22490.md): There is a Permission verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect the device pe (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22488](https://cve.now/CVE-2021-22488.md): There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft link (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22487](https://cve.now/CVE-2021-22487.md): There is an Out-of-bounds read vulnerability in Huawei Smartphone. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22486](https://cve.now/CVE-2021-22486.md): There is a issue of Unstandardized field names in Huawei Smartphone. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22485](https://cve.now/CVE-2021-22485.md): There is a SSID vulnerability with Wi-Fi network connections in Huawei devices.Successful exploitation of this vulnerability may affect serv (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22483](https://cve.now/CVE-2021-22483.md): There is a issue of IP address spoofing in Huawei Smartphone. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22475](https://cve.now/CVE-2021-22475.md): There is an Improper permission management vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect servi (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22474](https://cve.now/CVE-2021-22474.md): There is an Out-of-bounds memory access in Huawei Smartphone.Successful exploitation of this vulnerability may cause process exceptions. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22473](https://cve.now/CVE-2021-22473.md): There is an Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiali (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22472](https://cve.now/CVE-2021-22472.md): There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confid (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22407](https://cve.now/CVE-2021-22407.md): There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22406](https://cve.now/CVE-2021-22406.md): There is an Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit u (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22405](https://cve.now/CVE-2021-22405.md): There is a Configuration defects in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availability. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22404](https://cve.now/CVE-2021-22404.md): There is a Directory traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confident (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22403](https://cve.now/CVE-2021-22403.md): There is a vulnerability of hijacking unverified providers in Huawei Smartphone.Successful exploitation of this vulnerability may allow atta (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22402](https://cve.now/CVE-2021-22402.md): There is a DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause DoS attacks. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22401](https://cve.now/CVE-2021-22401.md): There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability can affect service integrity. (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22482](https://cve.now/CVE-2021-22482.md): There is an Uninitialized variable vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause transmission o (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22481](https://cve.now/CVE-2021-22481.md): There is a Verification errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confident (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22436](https://cve.now/CVE-2021-22436.md): There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service integrity and av (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37915](https://cve.now/CVE-2021-37915.md): An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. (no CVSS)
- [CVE-2021-37748](https://cve.now/CVE-2021-37748.md): Multiple buffer overflows in the limited configuration shell (/sbin/gs\_config) on Grandstream HT801 devices before 1.0.29 allow remote authe (no CVSS)
- [CVE-2019-19810](https://cve.now/CVE-2019-19810.md): Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. (no CVSS)
- [CVE-2021-43057](https://cve.now/CVE-2021-43057.md): An issue was discovered in the Linux kernel before 5.14.8. (no CVSS)
- [CVE-2021-43056](https://cve.now/CVE-2021-43056.md): An issue was discovered in the Linux kernel for powerpc before 5.14.15. (no CVSS)
- [CVE-2020-10005](https://cve.now/CVE-2020-10005.md): A resource exhaustion issue was addressed with improved input validation. (no CVSS, Apple macOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.