Skip to content
OpenAdvisories

Archive

25 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /25 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2021-37624 Public exploit

    FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE reques…

    signalwire freeswitch freeswitch Alpine
  • Unscored —
    CVE-2021-24884 Public exploit

    Formidable Form Builder < 4.09.05 - Unauthenticated Stored Cross-Site Scripting

    The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-in…

    Web / CMS
  • Critical 9.8
    CVE-2021-40865 Public exploit EPSS 64%

    Unsafe Pre-Authentication Deserialization In Workers

    An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgra…

    Apache Software Foundation Apache Storm org.apache.storm:storm Maven
  • Critical 9.8
    CVE-2021-38294 Public exploit EPSS 84%

    Shell Command Injection Vulnerability in Nimbus Thrift Server

    A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authenti…

    Apache Software Foundation Apache Storm org.apache.storm:storm Maven