CVEs published in October 2021
2,217 vulnerabilities, 187 critical, 16 exploited.
qtOSS-FuzzUNKNOWN WRITE in void QtPrivate::QPodArrayOps<QPainterPath::Element>::emplace<QPainterPath::ElemeNo scoremrubyOSS-FuzzHeap-buffer-overflow in mrb_vm_execNo score- stb project stb, debian linux, fedoraproject fedora +2 moreBuffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a...7.8 High
- apache tomcat, debian linux, netapp hci +15 more +17 moreDoS via memory leak with WebSocket connections7.5 High
- apache couchdb, apache software foundation ibm cloudant +1 morePrivilege escalation vulnerability when using HTML attachments7.3 High
- yellowfinbi yellowfinIn Yellowfin before 9.6.1 it is possible to enumerate and download uploaded images through an...7.5 High
- yellowfinbi yellowfinIn Yellowfin before 9.6.1 it is possible to enumerate and download users profile pictures through...7.5 High
- yellowfinbi yellowfinIn Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed...5.4 Medium
- ericsson operations support system-radio and core firmware** UNSUPPORTED WHEN ASSIGNED ** In OSS-RC systems of the release 18B and older during data...4.9 Medium
- ericsson operations support system-radio and core firmware** UNSUPPORTED WHEN ASSIGNED ** In OSS-RC systems of the release 18B and older customer...6.1 Medium
- kindsoft kindeditorCross Site Request Forgery in kindeditor8.8 High
- kindsoft kindeditorCross site scripting in kindeditor6.1 Medium
- enalean tuleapXSS via the name of a deleted attachment5.4 Medium
- brizy brizy-page builder, brizy.io brizy - page builder +1 moreBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal8.8 High
- brizy brizy-page builder, brizy.io brizy - page builder +1 moreBrizy <= 1.0.125 and 1.0.127 – 2.3.11 Incorrect authorization checks allowing Post modification7.1 High
- brizy brizy-page builder, brizy.io brizy - page builder +1 moreBrizy <= 2.3.11 Authenticated Stored Cross-Site Scripting6.4 Medium
- ome omero-web, openmicroscopy omero-figure +1 moreInconsistent input sanitisation leads to XSS vectors9.8 Critical
- huntflow enterpriseAn LDAP injection vulnerability in /account/login in Huntflow Enterprise before 3.10.6 could...7.5 High
- nagios xiThe general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated...6.1 Medium
- nagvisThe Manage Backgrounds functionality within Nagvis versions prior to 2.0.9 is vulnerable to an...6.5 Medium
- nagios xiThe Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL...8.8 High
- s-cmsAn XML External Entity (XXE) vulnerability was discovered in /api/notify.php in S-CMS 3.0 which...7.5 High
- zzcmsA SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers...7.5 High
- zzcmsA SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers...7.5 High
- zzcmsA SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers...7.5 High
- zzcmsA SQL injection vulnerability has been discovered in zz cms version 2019 which allows attackers...7.5 High
- chaoji cms project cmsA stored cross-site scripting (XSS) vulnerability in the getClientIp function in /lib/tinwin...5.4 Medium
- phpmywindA Cross Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6 which allows...6.5 Medium
mz-avrocrates.iomz-avro's incorrect use of `set_len` allows for un-initialized memoryNo score- mercury mer1200 firmware, mer1200g firmware +1 moreA remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury...9.8 Critical
- ledgersmb, ledgersmb ledgersmb/ledgersmb +1 moreSensitive Cookie in HTTPS Session Without 'Secure' Attribute in ledgersmb/ledgersmb5.9 Medium
- embedthis goaheadAn issue was discovered in GoAhead 4.x and 5.x before 5.1.5. In the file upload filter, user form...9.8 Critical
- openrc project openrccheckpath in OpenRC before 0.44.7 uses the direct output of strlen() to allocate strings, which...7.5 High
- anydeskAnyDesk before 6.2.6 and 6.3.x before 6.3.3 allows a local user to obtain administrator...7.8 High
frrOSS-FuzzUNKNOWN READNo score- zucchetti imagicle uc suiteImagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low...9.9 Critical
- mitsubishi electric corporation melsec iq-r series safety cpu r08sfcpu, melsec iq-r series safety cpu r120sfcpu, melsec iq-r series safety cpu r16sfcpu +21 more +23 moreAuthorization bypass through user-controlled key vulnerability in MELSEC iQ-R series Safety CPU...9.1 Critical
- zohocorp manageengine opmanagerThe NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection...9.8 Critical
- zohocorp manageengine opmanagerZoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support...9.8 Critical
- golang go, fedoraproject fedora +1 moreGo before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function...9.8 Critical
com.vaadin:flow-serverMavenPossible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-195.3 Mediumcom.vaadin:vaadin-bomMavenRegular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 87.5 Highcom.vaadin:vaadin-serverMavenDenial of service in DataCommunicator class in Vaadin 84.3 Medium- amd all supported processors, athlon firmware, athlon pro firmware +3 more +5 moreSide-channels Related to the x86 PREFETCH Instruction4.7 Medium
- phpgurukul ifsc code finderSQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST...9.8 Critical
- phpgurukul online dj booking management systemCross Site Scripting (XSS).vulnerability exists in Online DJ Booking Management System 1.0 in...6.1 Medium
- zohocorp manageengine admanager plusManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution...8.8 High
- zohocorp manageengine admanager plusManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution...8.8 High
- proofpoint insider threat management serverProofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web...9.8 Critical
- proofpoint insider threat management serverProofpoint Insider Threat Management Server contains an unsafe deserialization vulnerability in...7.3 High
- Show moreLoading…