CVEs published in October 2021
2,217 vulnerabilities, 187 critical, 16 exploited.
- online student admission system project student admission systemOnline Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass...9.8 Critical
- inria caml-lightcaml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make...9.8 Critical
- websvnA flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is...9.8 Critical
- mangboard wordpress mangboard, mang board +1 moreWordPress Mangboard SQL-Injection vulnerability7.5 High
- tobesoft nexacro, nexacro17 +1 moreTOBESOFT NEXACRO17 arbitrary command execution vulnerability8.1 High
- skyworth penguin aurora box firmwarePenguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and...10.0 Critical
- nagios xiAn issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an...7.2 High
- nagios xiAn issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py...7.8 High
- anaconda daskWorkers for local Dask clusters mistakenly listened on public interfaces9.8 Critical
- six apart ltd. movable typeCross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and...5.4 Medium
- google chrome, debian linux +1 moreInsufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54...5.5 Medium
- google chrome, debian linux +1 moreInappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a...6.5 Medium
- google chrome, debian linux +1 moreInappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a...6.5 Medium
- google chrome, debian linux +1 moreUse after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote...8.8 High
- google chrome, debian linux +1 moreOut of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker...8.8 High
- google chrome, debian linux +1 moreRace in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially...7.5 High
- google chrome, debian linux +1 moreInappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed...5.5 Medium
- google chrome, debian linux +1 moreInappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote...6.5 Medium
- google chrome, debian linux +1 moreUse after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who...8.8 High
- google chrome, debian linux +1 moreUse after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker...8.8 High
- google chrome, debian linux +1 moreHeap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker...8.8 High
- google chrome, debian linux +1 moreUse after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had...8.8 High
- google chrome, debian linux +1 moreHeap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker...8.8 High
- google chrome, debian linux +1 moreUse after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to...8.8 High
- google chrome, debian linux +1 moreUse after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to...8.8 High
- google chrome, debian linux +1 moreHeap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who...9.6 Critical
- codesys, codesys v2, plcwinnt +28 more +30 moreCODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service6.5 Medium
- codesys, codesys v2, plcwinnt +28 more +30 moreCODESYS V2 runtime: out-of-bounds read or write access may result in denial-of-service8.1 High
- codesys v2, plcwinnt, runtime toolkit +13 more +15 moreCODESYS V2 runtime: unauthenticated invalid requests may result in denial-of-service7.5 High
- codesys, codesys v2, wago 750-8202 firmware +26 more +28 moreCODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)7.5 High
- codesys, codesys v2, wago 750-8202 firmware +26 more +28 moreCODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)7.5 High
- codesys, codesys v2, wago 750-8202 firmware +26 more +28 moreCODESYS V2 web server: crafted requests could trigger a buffer over-read (DoS)9.1 Critical
- codesys, codesys v2, wago 750-8202 firmware +26 more +28 moreCODESYS V2 web server: crafted requests could trigger a heap-based buffer overflow (DoS)7.5 High
- six apart ltd. movable typeMovable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier ...9.8 Critical
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow authenticated yet non...6.5 Medium
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers...7.5 High
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...7.5 High
- atlassian jira, jira server, jira data center +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...7.5 High
- atlassian data center, jira, jira server +1 more +3 moreAffected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to...6.1 Medium
libbpfOSS-FuzzUNKNOWN READ in __bpf_object__openNo score- jquery jquery-ui, jqueryui jquery ui, drupal +25 more +27 moreXSS in the `of` option of the `.position()` util6.5 Medium
- jquery jquery-ui, jqueryui jquery ui, debian linux +26 more +28 moreXSS in `*Text` options of the Datepicker widget6.5 Medium
- jquery jquery-ui, jqueryui jquery ui, debian linux +27 more +29 moreXSS in the `altField` option of the Datepicker widget6.5 Medium
- nagios xiAn issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an...7.2 High
- debian linux, linux kernel, fedoraproject fedora +8 more +10 moreA flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to...7.8 High
- freeswitchFreeSWITCH susceptible to Denial of Service via invalid SRTP packets7.5 High
- freeswitchFreeSWITCH susceptible to Denial of Service via SIP flooding8.6 High
- nextcloud server, kiteworks security-advisories +1 moreTwo-Factor Authentication not enforced for pages marked as public6.5 Medium
- nextcloud server, kiteworks security-advisories +1 moreFile Traversal affecting SVG files on Nextcloud Server8.8 High
- nextcloud server, kiteworks security-advisories +1 moreRate-limits not working on instances without configured memory cache backend8.1 High
- Show moreLoading…