CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2021

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1101 CVE-2021-29673 79 XSS 2021-10-27 2021-10-29
3.5
None Remote Medium ??? None Partial None
IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 199482.
1102 CVE-2021-29645 269 Exec Code 2021-10-12 2021-10-20
4.6
None Local Low Not required Partial Partial Partial
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.
1103 CVE-2021-29644 190 Exec Code Overflow 2021-10-12 2021-10-20
10.0
None Remote Low Not required Complete Complete Complete
Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS.
1104 CVE-2021-29110 79 XSS 2021-10-01 2021-10-07
3.5
None Remote Medium ??? None Partial None
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
1105 CVE-2021-29109 79 Exec Code XSS 2021-10-01 2021-10-07
4.3
None Remote Medium Not required None Partial None
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
1106 CVE-2021-29108 269 2021-10-01 2021-10-08
6.5
None Remote Low ??? Partial Partial Partial
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker to impersonate another account.
1107 CVE-2021-29006 200 +Info 2021-10-11 2021-10-16
4.0
None Remote Low ??? Partial None None
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
1108 CVE-2021-29005 276 Exec Code +Priv 2021-10-11 2021-10-18
9.0
None Remote Low ??? Complete Complete Complete
Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server.
1109 CVE-2021-29004 89 Sql 2021-10-11 2021-10-16
6.5
None Remote Low ??? Partial Partial Partial
rConfig 3.9.6 is affected by SQL Injection. A user must be authenticated to exploit the vulnerability. If --secure-file-priv in MySQL server is not set and the Mysql server is the same as rConfig, an attacker may successfully upload a webshell to the server and access it remotely.
1110 CVE-2021-28975 79 XSS 2021-10-21 2021-10-26
4.3
None Remote Medium Not required None Partial None
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.
1111 CVE-2021-28702 269 Mem. Corr. 2021-10-06 2021-12-16
4.6
None Local Low Not required Partial Partial Partial
PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption.
1112 CVE-2021-28661 863 2021-10-07 2021-10-15
4.0
None Remote Low ??? Partial None None
Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
1113 CVE-2021-28496 311 2021-10-21 2021-10-28
4.0
None Remote Low ??? Partial None None
On systems running Arista EOS and CloudEOS with the affected release version, when using shared secret profiles the password configured for use by BiDirectional Forwarding Detection (BFD) will be leaked when displaying output over eAPI or other JSON outputs to other authenticated users on the device. The affected EOS Versions are: all releases in 4.22.x train, 4.23.9 and below releases in the 4.23.x train, 4.24.7 and below releases in the 4.24.x train, 4.25.4 and below releases in the 4.25.x train, 4.26.1 and below releases in the 4.26.x train
1114 CVE-2021-28129 269 2021-10-07 2021-10-15
4.6
None Local Low Not required Partial Partial Partial
While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but instead used a userid and groupid of 500. This both caused issues with desktop integration and could allow a crafted attack on files owned by that user or group if they exist. Users who installed the Apache OpenOffice 4.1.8 DEB packaging should upgrade to the latest version of Apache OpenOffice.
1115 CVE-2021-28021 787 Overflow 2021-10-15 2021-11-28
6.8
None Remote Medium Not required Partial Partial Partial
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.
1116 CVE-2021-27746 79 XSS 2021-10-21 2021-10-26
3.5
None Remote Medium ??? None Partial None
"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"
1117 CVE-2021-27665 190 Overflow 2021-10-11 2021-10-16
5.0
None Remote Low Not required None None Partial
An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition.
1118 CVE-2021-27664 269 2021-10-11 2021-10-18
6.8
None Remote Medium Not required Partial Partial Partial
Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server.
1119 CVE-2021-27561 77 2021-10-15 2021-10-21
10.0
None Remote Low Not required Complete Complete Complete
Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication.
1120 CVE-2021-27395 306 2021-10-12 2021-10-19
5.5
None Remote Low ??? None Partial Partial
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Historian 2019 (All versions), SIMATIC Process Historian 2020 (All versions). An interface in the software that is used for critical functionalities lacks authentication, which could allow a malicious user to maliciously insert, modify or delete data.
1121 CVE-2021-27003 1021 2021-10-12 2021-10-18
4.3
None Remote Medium Not required None Partial None
Clustered Data ONTAP versions prior to 9.5P18, 9.6P15, 9.7P14, 9.8P5 and 9.9.1 are missing an X-Frame-Options header which could allow a clickjacking attack.
1122 CVE-2021-27002 2021-10-11 2021-10-18
5.0
None Remote Low Not required Partial None None
NetApp Cloud Manager versions prior to 3.9.10 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to retrieve sensitive data via the web proxy.
1123 CVE-2021-27001 668 2021-10-19 2021-10-22
2.1
None Local Low Not required None Partial None
Clustered Data ONTAP versions 9.x prior to 9.5P18, 9.6P16, 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow an authenticated privileged local attacker to arbitrarily modify Compliance-mode WORM data prior to the end of the retention period.
1124 CVE-2021-26610 345 Exec Code 2021-10-27 2021-11-01
6.5
None Remote Low ??? Partial Partial Partial
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.
1125 CVE-2021-26609 89 Sql 2021-10-26 2021-10-28
5.0
None Remote Low Not required Partial None None
A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type parameter makes a SQL query using unfiltered data. This vulnerability allows a remote attacker to steal user information.
1126 CVE-2021-26607 20 Exec Code 2021-10-26 2021-11-01
10.0
None Remote Low Not required Complete Complete Complete
An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems.
1127 CVE-2021-26589 79 XSS 2021-10-19 2021-10-22
4.3
None Remote Medium Not required None Partial None
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.
1128 CVE-2021-26588 Exec Code 2021-10-11 2021-10-18
10.0
None Remote Low Not required Complete Complete Complete
A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.
1129 CVE-2021-26557 426 +Priv 2021-10-07 2021-10-15
4.4
None Local Medium Not required Partial Partial Partial
When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
1130 CVE-2021-26556 426 +Priv 2021-10-07 2021-10-15
4.4
None Local Medium Not required Partial Partial Partial
When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loading to gain privileged access.
1131 CVE-2021-26442 269 2021-10-13 2021-10-19
4.6
None Local Low Not required Partial Partial Partial
Windows HTTP.sys Elevation of Privilege Vulnerability
1132 CVE-2021-26441 269 2021-10-13 2021-10-19
4.6
None Local Low Not required Partial Partial Partial
Storage Spaces Controller Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-40478, CVE-2021-40488, CVE-2021-40489, CVE-2021-41345.
1133 CVE-2021-26427 Exec Code 2021-10-13 2021-10-19
5.8
None Local Network Low Not required Partial Partial Partial
Microsoft Exchange Server Remote Code Execution Vulnerability
1134 CVE-2021-26318 203 +Info 2021-10-13 2021-10-20
1.9
None Local Medium Not required Partial None None
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
1135 CVE-2021-25977 79 XSS 2021-10-25 2021-10-26
3.5
None Remote Medium ??? None Partial None
In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
1136 CVE-2021-25972 918 2021-10-20 2021-10-25
4.0
None Remote Low ??? Partial None None
In Camaleon CMS, versions 2.1.2.0 to 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
1137 CVE-2021-25971 2021-10-20 2021-11-30
4.0
None Remote Low ??? None None Partial
In Camaleon CMS, versions 2.0.1 to 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file
1138 CVE-2021-25970 613 2021-10-20 2021-10-29
6.8
None Remote Medium Not required Partial Partial Partial
Camaleon CMS 0.1.7 to 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed.
1139 CVE-2021-25969 79 XSS 2021-10-20 2021-11-29
4.3
None Remote Medium Not required None Partial None
In Camaleon CMS application, versions 0.0.1 to 2.6.0 are vulnerable to stored XSS, that allows an unauthenticated attacker to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
1140 CVE-2021-25968 79 XSS 2021-10-19 2021-10-21
3.5
None Remote Medium ??? None Partial None
In “OpenCMS”, versions 10.5.0 to 11.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the Sitemap functionality. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field.
1141 CVE-2021-25966 613 2021-10-10 2021-10-19
6.8
None Remote Medium Not required Partial Partial Partial
In “Orchard core CMS” application, versions 1.0.0-beta1-3383 to 1.0.0 are vulnerable to an improper session termination after password change. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
1142 CVE-2021-25964 79 XSS 2021-10-04 2021-10-08
3.5
None Remote Medium ??? None Partial None
In “Calibre-web” application, v0.6.0 to v0.6.12, are vulnerable to Stored XSS in “Metadata”. An attacker that has access to edit the metadata information, can inject JavaScript payload in the description field. When a victim tries to open the file, XSS will be triggered.
1143 CVE-2021-25742 2021-10-29 2021-12-15
5.5
None Remote Low ??? Partial Partial None
A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
1144 CVE-2021-25738 20 Exec Code 2021-10-11 2021-10-18
4.6
None Local Low Not required Partial Partial Partial
Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
1145 CVE-2021-25634 295 2021-10-12 2021-10-18
5.0
None Remote Low Not required None Partial None
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
1146 CVE-2021-25633 295 2021-10-11 2021-10-18
5.0
None Remote Low Not required None Partial None
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
1147 CVE-2021-25499 2021-10-06 2021-10-14
2.1
None Local Low Not required Partial None None
Intent redirection vulnerability in SamsungAccountSDKSigninActivity of Galaxy Store prior to version 4.5.32.4 allows attacker to access content provider of Galaxy Store.
1148 CVE-2021-25498 120 Exec Code Overflow 2021-10-06 2021-10-14
4.6
None Local Low Not required Partial Partial Partial
A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
1149 CVE-2021-25497 120 Exec Code Overflow 2021-10-06 2021-10-14
4.6
None Local Low Not required Partial Partial Partial
A possible buffer overflow vulnerability in maetd_cpy_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
1150 CVE-2021-25496 120 Exec Code Overflow 2021-10-06 2021-10-14
4.6
None Local Low Not required Partial Partial Partial
A possible buffer overflow vulnerability in maetd_dec_slice of libSPenBase library of Samsung Notes prior to Samsung Notes version 4.3.02.61 allows arbitrary code execution.
Total number of vulnerabilities : 1708   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 (This Page)24 25 26 27 28 29 30 31 32 33 34 35
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.