Skip to content
OpenAdvisories

Archive

October 2021

Vulnerabilities first published in this month (UTC), newest first.

← September 2021 2021 / October November 2021 →
  1. 170
  2. 2 
  3. 3 
  4. 496
  5. 557
  6. 6129
  7. 770
  8. 859
  9. 9 
  10. 103
  11. 1166
  12. 1274
  13. 13120
  14. 1434
  15. 1559
  16. 16 
  17. 17 
  18. 1864
  19. 19120
  20. 20191
  21. 2159
  22. 22101
  23. 23 
  24. 24 
  25. 2584
  26. 2643
  27. 2770
  28. 28106
  29. 2931
  30. 301
  31. 3111
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-40865 Public exploit EPSS 64%

    Unsafe Pre-Authentication Deserialization In Workers

    An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgra…

    Apache Software Foundation Apache Storm org.apache.storm:storm Maven
  • Critical 9.8
    CVE-2021-38294 Public exploit EPSS 84%

    Shell Command Injection Vulnerability in Nimbus Thrift Server

    A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authenti…

    Apache Software Foundation Apache Storm org.apache.storm:storm Maven
  • Critical 9.8
    CVE-2021-42258 Exploited · Ransomware Public exploit EPSS 75%

    BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code executio…

    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2021-42325 Public exploit EPSS 12%

    Froxlor SQL injection vulnerability

    Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.

    froxlor/froxlor Packagist
  • Critical 9.8
    CVE-2021-42013 Exploited · Ransomware Public exploit EPSS 100%

    Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories a…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine
    KEV Nov 3, 2021
  • Critical 9.6
    CVE-2021-3625 Public exploit

    Buffer overflow in Zephyr USB DFU DNLOAD

    Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363

    zephyrproject-rtos Zephyr