CVEs published October 29, 2021
31 CVEs were published on October 29, 2021: 0 critical, 6 high.
- Published
- 31
- Critical
- 0
- High
- 6
- Medium
- 6
- Low
- 0
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- NVIDIA Virtual GPU Software
- 6
- VMware InstallBuilder
- 2
- dhis2-core
- 1
- DSpace · org.dspace:dspace-api
- 1
- fluentd
- 1
- hoene/libmysofa
- 1
- HP Enterprise LaserJet MFP; HP Enterprise PageWide MFPs; HP…
- 1
- HP OfficeJet 7110 Wide Format ePrinter
- 1
- Kubernetes ingress-nginx
- 1
- SolarWinds Kiwi Syslog Server
- 1
High 6
- CVE-2021-1120NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be pNVIDIA Virtual GPU Software
- CVE-2021-1119NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can double-free a pointer, which may lead tNVIDIA Virtual GPU Software
- CVE-2021-1118NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged oNVIDIA Virtual GPU Software
- CVE-2021-41189Communities and collections administrators can escalate their privilege up to system administratorDSpace · org.dspace:dspace-api
- CVE-2021-39179SQL Injection in DHIS2 Tracker APIdhis2-core
- CVE-2021-25742Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespacesKubernetes ingress-nginx
Medium, low and unrated 25
- CVE-2020-25881A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename=../../../../111.txt&
- CVE-2021-1123NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can deadlock, which may lead to denial of sNVIDIA Virtual GPU Software
- CVE-2021-1122NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may lNVIDIA Virtual GPU Software
- CVE-2021-1121NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource starvation among othNVIDIA Virtual GPU Software
- CVE-2020-25873A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attac
- CVE-2020-25872A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traver
- CVE-2021-41746SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php.
- CVE-2021-41646Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file th
- CVE-2021-41645Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user
- CVE-2021-41644Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that by
- CVE-2021-41643Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field.
- CVE-2021-3756Heap-based Buffer Overflow in hoene/libmysofahoene/libmysofa
- CVE-2021-41676An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.
- CVE-2021-41675A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert f
- CVE-2021-41674An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php.
- CVE-2021-41186ReDoS vulnerability in parser_apache2fluentd
- CVE-2021-35237Clickjacking VulnerabilitySolarWinds Kiwi Syslog Server
- CVE-2021-3441A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSSHP OfficeJet 7110 Wide Format ePrinter
- CVE-2021-3662Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).HP Enterprise LaserJet MFP; HP Enterprise PageWide MFPs; HP…
- CVE-2021-22037Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command.VMware InstallBuilder
- CVE-2021-22038On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller exVMware InstallBuilder
- CVE-2021-31862SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication.
- CVE-2021-31627Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arb
- CVE-2021-31624Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42_multi, allows attackers to execute arb
- CVE-2020-22079Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitr