CVEs published November 2, 2021
97 CVEs were published on November 2, 2021: 0 critical, 8 high. Browse them by severity, product and exploitation status.
- Published
- 97
- Critical
- 0
- High
- 8
- Medium
- 18
- Low
- 3
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Google Chrome
- 23
- NEC CLUSTERPRO X
- 8
- IBM InfoSphere Information Server
- 6
- Fortinet FortiPortal
- 5
- Fortinet FortiSIEMWindowsAgent
- 2
- Fortinet FortiWeb
- 2
- Fortinet FortiWLM
- 2
- com.typesafe.akka:akka-http-core_2.13.0-RC3 · com.typesa… +5
- 1
- Fortinet FortiADC
- 1
- Fortinet FortiAnalyzer
- 1
High 8
- CVE-2021-36184A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows…Fortinet FortiWLM
- CVE-2021-36185A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below…Fortinet FortiWLM
- CVE-2021-36183An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a…Fortinet FortiClientWindows
- CVE-2021-36186A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute…Fortinet FortiWeb
- CVE-2021-41022A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or…Fortinet FortiSIEMWindowsAgent
- CVE-2021-41238Missing Authorization with Default Settings in Dashboard UIHangfireIO Hangfire · Hangfire.Core
- CVE-2021-41232Improper Neutralization of Special Elements used in an LDAP QueryStevenWeathers thunderdome-planning-poker · github.com/Stev…
- CVE-2021-38948IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM InfoSphere Information Server
Medium, low and unrated 89
- CVE-2021-20705Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and…NEC CLUSTERPRO X
- CVE-2021-20707Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for…NEC CLUSTERPRO X
- CVE-2021-20703Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and…NEC CLUSTERPRO X
- CVE-2021-20701Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier…NEC CLUSTERPRO X
- CVE-2021-20706Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and…NEC CLUSTERPRO X
- CVE-2021-20704Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3…NEC CLUSTERPRO X
- CVE-2021-20702Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and…NEC CLUSTERPRO X
- CVE-2021-20700Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier…NEC CLUSTERPRO X
- CVE-2020-27820A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that…kernel
- CVE-2021-20135Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated…Nessus
- CVE-2021-41036In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.The Eclipse Foundation Eclipse Paho MQTT C Client
- CVE-2021-43270Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25…
- CVE-2020-16048Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.
- CVE-2020-6492Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a…Google Chrome
- CVE-2018-6125Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially…Google Chrome
- CVE-2018-6122Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2021-43267An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.
- CVE-2017-5123Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
- CVE-2021-43264In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass…
- CVE-2021-43265In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
- CVE-2021-43266In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell…
- CVE-2021-42697Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote…com.typesafe.akka:akka-http-core_2.13.0-RC3 · com.typesa… +5
- CVE-2021-37996Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation…Google Chrome
- CVE-2021-37995Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay…Google Chrome
- CVE-2021-37994Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation…Google Chrome
Show all 89 entriesShow fewer entries
- CVE-2021-37993Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2021-37992Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2021-37991Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2021-37990Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin…Google Chrome
- CVE-2021-37989Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy…Google Chrome
- CVE-2021-37988Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific…Google Chrome
- CVE-2021-37987Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2021-37986Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially…Google Chrome
- CVE-2021-37985Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to…Google Chrome
- CVE-2021-37984Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2021-37983Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2021-37982Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2021-37981Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to…Google Chrome
- CVE-2021-37980Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site…Google Chrome
- CVE-2021-37979heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a…Google Chrome
- CVE-2021-37978Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2021-37977Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap…Google Chrome
- CVE-2020-15935A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated…Fortinet FortiADC
- CVE-2021-42754An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may…Fortinet FortiClientMac
- CVE-2021-36187A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause…Fortinet FortiWeb
- CVE-2021-41023A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to…Fortinet FortiSIEMWindowsAgent
- CVE-2021-36174A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an…Fortinet FortiPortal
- CVE-2021-36176Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single…Fortinet FortiPortal
- CVE-2021-32595Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single…Fortinet FortiPortal
- CVE-2020-12814A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below…Fortinet FortiAnalyzer
- CVE-2021-26107An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a…Fortinet FortiManager
- CVE-2020-15940An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a…Fortinet FortiClientEMS
- CVE-2020-23754Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute…
- CVE-2020-23719Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to…
- CVE-2020-23718Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to…
- CVE-2020-23686Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified…
- CVE-2020-23685SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the…
- CVE-2020-21574Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is…
- CVE-2020-21573An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted…
- CVE-2020-21572Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759…
- CVE-2020-20658Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an…
- CVE-2020-20657Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet…
- CVE-2020-18440Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
- CVE-2020-18439An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write…
- CVE-2020-18438Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to…
- CVE-2021-41019An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the…Fortinet FortiOS
- CVE-2021-36172An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may…Fortinet FortiPortal
- CVE-2021-36181A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database…Fortinet FortiPortal
- CVE-2021-29888IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…IBM InfoSphere Information Server
- CVE-2021-29875IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access…IBM InfoSphere Information Server
- CVE-2021-29771IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2021-29738IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF).IBM InfoSphere Information Server
- CVE-2021-29737IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API…IBM InfoSphere Information Server
- CVE-2021-36794In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled…
- CVE-2021-42568Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged…
- CVE-2021-36925RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an…
- CVE-2021-36924RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool…
- CVE-2021-36923RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve…
- CVE-2021-36922RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve…
- CVE-2021-42763Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext.
- CVE-2021-37842metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information.
- CVE-2021-27722An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5.
- CVE-2020-35249Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the…
- CVE-2020-27406Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
- CVE-2021-33611Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14Vaadin · vaadin-menu-bar +2
- CVE-2021-36560Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover…
- CVE-2021-3765Inefficient Regular Expression Complexity in validatorjs/validator.jsvalidatorjs/validator.js · validator
- CVE-2021-25973Publify - Improper Authorization Leads to Guest Signup Restriction Bypasspublify_core
- CVE-2021-33593Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which…NAVER Whale browser