Skip to content
OpenAdvisories

Archive

25 October 2021

Vulnerabilities first published on this day (UTC), newest first.

← September 2021 2021 / October /25 November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.5
    CVE-2021-41105

    FreeSWITCH susceptible to Denial of Service via invalid SRTP packets

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. When handling SRTP calls, FreeSWITCH prior to version 1.10.7 is susceptible …

    signalwire freeswitch freeswitch Alpine
  • High 8.6
    CVE-2021-41145

    FreeSWITCH susceptible to Denial of Service via SIP flooding

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via S…

    signalwire freeswitch freeswitch Alpine
  • High 8.8
    CVE-2021-41178

    File Traversal affecting SVG files on Nextcloud Server

    Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system, including user provided files. This cou…

    Nextcloud security-advisories
  • High 8.1
    CVE-2021-41177

    Rate-limits not working on instances without configured memory cache backend

    Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud Server did not implement a database backend for rate-limiting purposes. Any component of Nextcloud using rate-limits (as as `AnonRateThrot…

    Nextcloud security-advisories
  • High 8.1
    CVE-2021-39225

    Missing permission check on Deck API

    Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App i…

    Nextcloud security-advisories
  • High 8.8
    CVE-2021-34864

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 …

    Parallels Desktop
  • High 8.8
    CVE-2021-34863

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…

    D-Link DAP-2020 Network devices
  • High 8.8
    CVE-2021-34862

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…

    D-Link DAP-2020 Network devices
  • High 8.8
    CVE-2021-34861

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-…

    D-Link DAP-2020 Network devices
  • High 7.8
    CVE-2021-34859

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.…

    TeamViewer TeamViewer
  • High 8.2
    CVE-2021-34857

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 …

    Parallels Desktop
  • High 8.2
    CVE-2021-34856

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 …

    Parallels Desktop
  • High 7.8
    CVE-2021-34854

    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 …

    Parallels Desktop
  • High 7.5
    CVE-2021-37624 Public exploit

    FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE reques…

    signalwire freeswitch freeswitch Alpine
  • High 8.6
    CVE-2021-40527

    Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and i…

  • High 7.8
    CVE-2021-21703

    PHP-FPM memory access in root process leading to privilege escalation

    In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child proc…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine