# CVEs published 2021-10-29

31 CVEs were published on October 29, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2020-25881](https://cve.now/CVE-2020-25881.md): A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename=../../../../111.txt& (no CVSS)
- [CVE-2021-1123](https://cve.now/CVE-2021-1123.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can deadlock, which may lead to denial of s (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1122](https://cve.now/CVE-2021-1122.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL pointer, which may l (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1121](https://cve.now/CVE-2021-1121.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource starvation among oth (CVSS 5.5, NVIDIA Virtual GPU Software)
- [CVE-2021-1120](https://cve.now/CVE-2021-1120.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be p (CVSS 7.0, NVIDIA Virtual GPU Software)
- [CVE-2021-1119](https://cve.now/CVE-2021-1119.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can double-free a pointer, which may lead t (CVSS 7.1, NVIDIA Virtual GPU Software)
- [CVE-2021-1118](https://cve.now/CVE-2021-1118.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where there is the potential to execute privileged o (CVSS 7.8, NVIDIA Virtual GPU Software)
- [CVE-2020-25873](https://cve.now/CVE-2020-25873.md): A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attac (no CVSS)
- [CVE-2020-25872](https://cve.now/CVE-2020-25872.md): A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traver (no CVSS)
- [CVE-2021-41189](https://cve.now/CVE-2021-41189.md): Communities and collections administrators can escalate their privilege up to system administrator (CVSS 7.2, DSpace · org.dspace:dspace-api)
- [CVE-2021-41746](https://cve.now/CVE-2021-41746.md): SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. (no CVSS)
- [CVE-2021-41646](https://cve.now/CVE-2021-41646.md): Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file th (no CVSS)
- [CVE-2021-41645](https://cve.now/CVE-2021-41645.md): Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user (no CVSS)
- [CVE-2021-41644](https://cve.now/CVE-2021-41644.md): Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that by (no CVSS)
- [CVE-2021-41643](https://cve.now/CVE-2021-41643.md): Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field. (no CVSS)
- [CVE-2021-3756](https://cve.now/CVE-2021-3756.md): Heap-based Buffer Overflow in hoene/libmysofa (CVSS 6.2, hoene/libmysofa)
- [CVE-2021-41676](https://cve.now/CVE-2021-41676.md): An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php. (no CVSS)
- [CVE-2021-41675](https://cve.now/CVE-2021-41675.md): A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert f (no CVSS)
- [CVE-2021-41674](https://cve.now/CVE-2021-41674.md): An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user\_email parameter in /admin/login.php. (no CVSS)
- [CVE-2021-41186](https://cve.now/CVE-2021-41186.md): ReDoS vulnerability in parser\_apache2 (CVSS 5.9, fluentd)
- [CVE-2021-35237](https://cve.now/CVE-2021-35237.md): Clickjacking Vulnerability (CVSS 5.0, SolarWinds Kiwi Syslog Server)
- [CVE-2021-39179](https://cve.now/CVE-2021-39179.md): SQL Injection in DHIS2 Tracker API (CVSS 8.8, dhis2-core)
- [CVE-2021-3441](https://cve.now/CVE-2021-3441.md): A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS (no CVSS, HP OfficeJet 7110 Wide Format ePrinter)
- [CVE-2021-3662](https://cve.now/CVE-2021-3662.md): Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS). (no CVSS, HP Enterprise LaserJet MFP; HP Enterprise PageWide MFPs; HP…)
- [CVE-2021-22037](https://cve.now/CVE-2021-22037.md): Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. (no CVSS, VMware InstallBuilder)
- [CVE-2021-22038](https://cve.now/CVE-2021-22038.md): On Windows, the uninstaller binary copies itself to a fixed temporary location, which is then executed (the originally called uninstaller ex (no CVSS, VMware InstallBuilder)
- [CVE-2021-31862](https://cve.now/CVE-2021-31862.md): SysAid 20.4.74 allows XSS via the KeepAlive.jsp stamp parameter without any authentication. (no CVSS)
- [CVE-2021-31627](https://cve.now/CVE-2021-31627.md): Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42\_multi, allows attackers to execute arb (no CVSS)
- [CVE-2021-31624](https://cve.now/CVE-2021-31624.md): Buffer Overflow vulnerability in Tenda AC9 V1.0 through V15.03.05.19(6318), and AC9 V3.0 V15.03.06.42\_multi, allows attackers to execute arb (no CVSS)
- [CVE-2020-22079](https://cve.now/CVE-2020-22079.md): Stack-based buffer overflow in Tenda AC-10U AC1200 Router US\_AC10UV1.0RTL\_V15.03.06.48\_multi\_TDE01 allows remote attackers to execute arbitr (no CVSS)
- [CVE-2021-25742](https://cve.now/CVE-2021-25742.md): Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces (CVSS 7.6, Kubernetes ingress-nginx)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.