Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2021

89 records · 18 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-41648
    33Monitor

    An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter.

    HighCVSS 7.5Proof of conceptEPSS 10%

    online-shopping-system-advanced project · online-shopping-system-advancedOct 1, 2021

  • CVE-2021-41649
    55Plan

    An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    online-shopping-system-advanced project · online-shopping-system-advancedOct 1, 2021

  • CVE-2021-40323
    65This week

    Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template i

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    cobbler project · cobblerOct 4, 2021

  • CVE-2021-40324
    51Plan

    Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

    HighCVSS 7.5No exploitEPSS 68%

    cobbler project · cobblerOct 4, 2021

  • CVE-2021-32626
    40Plan

    Lua scripts can overflow the heap-based Lua stack in Redis

    HighCVSS 8.8No exploitEPSS 16%

    redis · redisOct 4, 2021

  • CVE-2021-32628
    34Monitor

    Vulnerability in handling large ziplists

    HighCVSS 7.5No exploitEPSS 13%

    redis · redisOct 4, 2021

  • CVE-2021-32675
    35Monitor

    DoS vulnerability in Redis

    HighCVSS 7.5Proof of conceptEPSS 16%

    redis · redisOct 4, 2021

  • CVE-2021-32687
    31Monitor

    Integer overflow issue with intsets in Redis

    HighCVSS 7.5No exploitEPSS 4%

    redis · redisOct 4, 2021

  • CVE-2021-41578
    34Monitor

    mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files.

    HighCVSS 7.8No exploitEPSS 10%

    myscada · mydesignerOct 4, 2021

  • CVE-2021-41524
    38Monitor

    null pointer dereference in h2 fuzzing

    HighCVSS 7.5No exploitEPSS 25%

    apache · http serverOct 5, 2021

  • CVE-2021-41773
    99Now

    Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 5, 2021

  • CVE-2021-39226
    89Now

    Snapshot authentication bypass in grafana

    HighCVSS 7.3KEVWeaponizedEPSS 99%

    grafana · grafanaOct 5, 2021

  • CVE-2021-25487
    61This week

    Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it res

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    samsung · androidOct 6, 2021

  • CVE-2021-25489
    52Plan

    Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format st

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    samsung · androidOct 6, 2021

  • CVE-2021-32172
    59Plan

    Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.

    CriticalCVSS 9.8Proof of conceptEPSS 66%

    maianscriptworld · maian cartOct 7, 2021

  • CVE-2021-22930
    50Plan

    Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to a use after free attack where an attacker might be able to exploit the memory c

    CriticalCVSS 9.8No exploitEPSS 36%

    nodejs · node.jsOct 7, 2021

  • CVE-2021-40978
    35Monitor

    The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive infor

    HighCVSS 7.5Proof of conceptEPSS 15%

    mkdocs · mkdocsOct 7, 2021

  • CVE-2021-37918
    61This week

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 73%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37919
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37920
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37921
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37923
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37924
    42Plan

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-37926
    61This week

    Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.

    CriticalCVSS 9.8No exploitEPSS 73%

    zohocorp · manageengine admanager plusOct 7, 2021

  • CVE-2021-42013
    99Now

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    apache · http serverOct 7, 2021

  • CVE-2021-42071
    60This week

    In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    visual-tools · dvr vx16 firmwareOct 7, 2021

  • CVE-2021-30625
    38Monitor

    Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a maliciou

    HighCVSS 8.8No exploitEPSS 10%

    google · chromeOct 8, 2021

  • CVE-2021-30632
    84Now

    Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a craf

    HighCVSS 8.8KEVWeaponizedEPSS 63%

    google · chromeOct 8, 2021

  • CVE-2021-30633
    78This week

    Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process t

    CriticalCVSS 9.6KEVWeaponizedEPSS 33%

    google · chromeOct 8, 2021

  • CVE-2021-37973
    72This week

    Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to poten

    CriticalCVSS 9.6KEVWeaponizedEPSS 11%

    google · chromeOct 8, 2021

  • CVE-2021-37975
    75This week

    Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted H

    HighCVSS 8.8KEVWeaponizedEPSS 34%

    google · chromeOct 8, 2021

  • CVE-2021-37976
    62This week

    Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive info

    MediumCVSS 6.5KEVWeaponizedEPSS 19%

    google · chromeOct 8, 2021

  • CVE-2021-24563
    32Monitor

    Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 26%

    frontend uploader project · frontend uploaderOct 11, 2021

  • CVE-2021-33730
    36Monitor

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    HighCVSS 7.2No exploitEPSS 27%

    siemens · sinec nmsOct 12, 2021

  • CVE-2021-33731
    42Plan

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    HighCVSS 7.2No exploitEPSS 46%

    siemens · sinec nmsOct 12, 2021

  • CVE-2021-33732
    36Monitor

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    HighCVSS 7.2No exploitEPSS 27%

    siemens · sinec nmsOct 12, 2021

  • CVE-2021-33733
    33Monitor

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    HighCVSS 7.2No exploitEPSS 15%

    siemens · sinec nmsOct 12, 2021

  • CVE-2021-33734
    36Monitor

    A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1).

    HighCVSS 7.2No exploitEPSS 27%

    siemens · sinec nmsOct 12, 2021

  • CVE-2021-38454
    45Plan

    Moxa MXview Network Management Software

    CriticalCVSS 10.0No exploitEPSS 15%

    moxa · mxviewOct 12, 2021

  • CVE-2021-42325
    43Plan

    Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

    CriticalCVSS 9.8Proof of conceptEPSS 11%

    froxlor · froxlorOct 12, 2021

  • CVE-2021-20031
    28Monitor

    A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary w

    MediumCVSS 6.1Proof of conceptEPSS 13%

    sonicwall · sonicosOct 12, 2021

  • CVE-2021-40449
    86Now

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 81%

    microsoft · windows 10 1507Oct 12, 2021

  • CVE-2021-40450
    61This week

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 1809Oct 12, 2021

  • CVE-2021-40487
    46Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 48%

    microsoft · sharepoint enterprise serverOct 12, 2021

  • CVE-2021-41355
    28Monitor

    .NET Core and Visual Studio Information Disclosure Vulnerability

    MediumCVSS 5.7No exploitEPSS 20%

    microsoft · .netOct 12, 2021

  • CVE-2021-41357
    61This week

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    microsoft · windows 10 2004Oct 12, 2021

  • CVE-2021-20123
    87Now

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet e

    HighCVSS 7.5KEVWeaponizedEPSS 90%

    draytek · vigorconnectOct 13, 2021

  • CVE-2021-20124
    89Now

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint.

    HighCVSS 7.5KEVWeaponizedEPSS 96%

    draytek · vigorconnectOct 13, 2021

  • CVE-2021-20130
    45Plan

    ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file u

    HighCVSS 8.8No exploitEPSS 32%

    zohocorp · manageengine admanager plusOct 13, 2021

  • CVE-2021-20131
    40Plan

    ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file u

    HighCVSS 8.8No exploitEPSS 16%

    zohocorp · manageengine admanager plusOct 13, 2021

  • CVE-2021-40493
    54Plan

    Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module.

    CriticalCVSS 9.8No exploitEPSS 50%

    zohocorp · manageengine opmanagerOct 13, 2021

  • CVE-2021-42342
    57Plan

    An issue was discovered in GoAhead 4.x and 5.x before 5.1.5.

    CriticalCVSS 9.8Proof of conceptEPSS 59%

    embedthis · goaheadOct 14, 2021

  • CVE-2021-33177
    38Monitor

    The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection.

    HighCVSS 8.8No exploitEPSS 10%

    nagios · nagios xiOct 14, 2021

  • CVE-2021-33179
    28Monitor

    The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting.

    MediumCVSS 6.1No exploitEPSS 11%

    nagios · nagios xiOct 14, 2021

  • CVE-2021-42340
    34Monitor

    DoS via memory leak with WebSocket connections

    HighCVSS 7.5No exploitEPSS 11%

    apache · tomcatOct 14, 2021

  • CVE-2021-40728
    47Plan

    Adobe Acrobat Reader DC Use After Free Arbitrary Code Execution

    HighCVSS 7.8No exploitEPSS 54%

    adobe · acrobat dcOct 15, 2021

  • CVE-2021-27561
    94Now

    Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authenticati

    CriticalCVSS 9.8KEVWeaponizedEPSS 82%

    yealink · device managementOct 15, 2021

  • CVE-2018-16060
    36Monitor

    Mitsubishi Electric Europe B.V.

    HighCVSS 7.5Proof of conceptEPSS 19%

    mitsubishielectric · smartrtu firmwareOct 15, 2021

  • CVE-2021-38297
    42Plan

    Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    golang · goOct 18, 2021

  • CVE-2021-21796
    36Monitor

    An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

    HighCVSS 7.8No exploitEPSS 15%

    gonitro · nitro proOct 18, 2021

  • CVE-2021-21797
    36Monitor

    An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

    HighCVSS 7.8No exploitEPSS 15%

    gonitro · nitro proOct 18, 2021

  • CVE-2021-38389
    42Plan

    Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute

    CriticalCVSS 9.8No exploitEPSS 10%

    advantech · webaccessOct 18, 2021

  • CVE-2021-30358
    36Monitor

    Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from oth

    HighCVSS 7.2No exploitEPSS 27%

    checkpoint · mobile access portal agentOct 19, 2021

  • CVE-2021-30807
    70This week

    A memory corruption issue was addressed with improved memory handling.

    HighCVSS 7.8KEVWeaponizedEPSS 28%

    apple · ipadosOct 19, 2021

  • CVE-2021-35559
    26Monitor

    Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing).

    MediumCVSS 5.3No exploitEPSS 15%

    oracle · graalvmOct 20, 2021

  • CVE-2021-35590
    52Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 88%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-35592
    41Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 52%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-35593
    40Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 51%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-35594
    40Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 51%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-35598
    40Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 51%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-35616
    29Monitor

    Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure).

    MediumCVSS 5.4Proof of conceptEPSS 27%

    oracle · transportation managementOct 20, 2021

  • CVE-2021-35621
    40Plan

    Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

    MediumCVSS 6.3No exploitEPSS 50%

    oracle · mysql clusterOct 20, 2021

  • CVE-2021-21745
    34Monitor

    ZTE MF971R product has a Referer authentication bypass vulnerability.

    MediumCVSS 4.3Proof of conceptEPSS 55%

    zte · mf971r firmwareOct 20, 2021

  • CVE-2021-41163
    45Plan

    RCE via malicious SNS subscription payload

    CriticalCVSS 9.8No exploitEPSS 19%

    discourse · discourseOct 20, 2021

  • CVE-2021-39352
    45Plan

    Catch Themes Demo Import <= 1.7 Admin+ Arbitrary File Upload

    HighCVSS 7.2WeaponizedEPSS 56%

    catchplugins · catch themes demo importOct 21, 2021

  • CVE-2021-31682
    27Monitor

    The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks

    MediumCVSS 6.1Proof of conceptEPSS 10%

    automatedlogic · webctrlOct 22, 2021

  • CVE-2021-42840
    53Plan

    SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.

    HighCVSS 8.8WeaponizedEPSS 58%

    salesagility · suitecrmOct 22, 2021

  • CVE-2021-42258
    91Now

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution, as exploited in th

    CriticalCVSS 9.8KEVWeaponizedEPSS 74%

    bqe · billquick web suiteOct 22, 2021

  • CVE-2021-38294
    64This week

    Shell Command Injection Vulnerability in Nimbus Thrift Server

    CriticalCVSS 9.8WeaponizedEPSS 83%

    apache · stormOct 25, 2021

  • CVE-2021-40865
    58Plan

    Unsafe Pre-Authentication Deserialization In Workers

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    apache · stormOct 25, 2021

  • CVE-2021-20837
    65This week

    Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r

    CriticalCVSS 9.8Proof of conceptEPSS 88%

    sixapart · movable typeOct 26, 2021

  • CVE-2021-34586
    34Monitor

    CODESYS V2 web server: crafted requests could trigger a null pointer dereference (DoS)

    HighCVSS 7.5No exploitEPSS 13%

    codesys · codesysOct 26, 2021

  • CVE-2021-40344
    47Plan

    An issue was discovered in Nagios XI 5.8.5.

    HighCVSS 7.2No exploitEPSS 64%

    nagios · nagios xiOct 26, 2021

  • CVE-2021-40345
    35Monitor

    An issue was discovered in Nagios XI 5.8.5.

    HighCVSS 7.2Proof of conceptEPSS 22%

    nagios · nagios xiOct 26, 2021

  • CVE-2021-41182
    36Monitor

    XSS in the `altField` option of the Datepicker widget

    MediumCVSS 6.1Proof of conceptEPSS 39%

    jqueryui · jquery uiOct 26, 2021

  • CVE-2021-41184
    36Monitor

    XSS in the `of` option of the `.position()` util

    MediumCVSS 6.1Proof of conceptEPSS 40%

    jqueryui · jquery uiOct 26, 2021

  • CVE-2021-25219
    24Monitor

    Lame cache can be abused to severely degrade resolver performance

    MediumCVSS 5.3No exploitEPSS 10%

    isc · bindOct 27, 2021

  • CVE-2021-30833
    35Monitor

    This issue was addressed with improved checks.

    MediumCVSS 5.5No exploitEPSS 42%

    apple · mac os xOct 28, 2021

  • CVE-2021-1120
    28Monitor

    NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a string provided by the guest OS may not be p

    HighCVSS 7.0No exploitEPSS 0%

    nvidia · virtual gpuOct 29, 2021