# CVEs published 2021-11-15

65 CVEs were published on November 15, 2021: 2 critical, 15 high. Days are UTC.

- [CVE-2021-41271](https://cve.now/CVE-2021-41271.md): Cache poisoning via maliciously-formed request in discourse (CVSS 4.8, discourse)
- [CVE-2021-41269](https://cve.now/CVE-2021-41269.md): Unauthenticated remote code injection in cron-utils (CVSS 10.0, jmrozanec cron-utils · com.cronutils:cron-utils)
- [CVE-2021-41266](https://cve.now/CVE-2021-41266.md): Authentication bypass issue in the Operator Console (CVSS 8.6, minio console · github.com/minio/console)
- [CVE-2021-41263](https://cve.now/CVE-2021-41263.md): Secure/signed cookies share secrets between sites in rails\_multisite (CVSS 8.3, discourse rails\_multisite · rails\_multisite)
- [CVE-2021-41244](https://cve.now/CVE-2021-41244.md): Cross organization admin control in Grafana (CVSS 9.1, grafana · github.com/grafana/grafana)
- [CVE-2020-12894](https://cve.now/CVE-2020-12894.md): Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12960](https://cve.now/CVE-2020-12960.md): AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may result in a denial of… (no CVSS, AMD Radeon Software)
- [CVE-2020-12893](https://cve.now/CVE-2020-12893.md): Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12903](https://cve.now/CVE-2020-12903.md): Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of… (no CVSS, AMD Radeon Software)
- [CVE-2020-12962](https://cve.now/CVE-2020-12962.md): Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation. (no CVSS, AMD Radeon Software)
- [CVE-2020-12905](https://cve.now/CVE-2020-12905.md): Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12901](https://cve.now/CVE-2020-12901.md): Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12898](https://cve.now/CVE-2020-12898.md): Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12892](https://cve.now/CVE-2020-12892.md): An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution. (no CVSS, AMD Radeon Software)
- [CVE-2021-39222](https://cve.now/CVE-2021-39222.md): XSS in Talk (CVSS 6.4, nextcloud security-advisories)
- [CVE-2020-12963](https://cve.now/CVE-2020-12963.md): An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the… (no CVSS, AMD Radeon Software)
- [CVE-2021-42580](https://cve.now/CVE-2021-42580.md): Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and… (no CVSS)
- [CVE-2020-12895](https://cve.now/CVE-2020-12895.md): Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, information disclosure or… (no CVSS, AMD Radeon Software)
- [CVE-2021-41950](https://cve.now/CVE-2021-41950.md): A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on… (no CVSS)
- [CVE-2021-41765](https://cve.now/CVE-2021-41765.md): A SQL injection issue in pages/edit\_fields/9\_ajax/add\_keyword.php of ResourceSpace 9.5 and 9.6 \< rev 18274 allows remote unauthenticated… (no CVSS)
- [CVE-2020-12929](https://cve.now/CVE-2020-12929.md): Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to… (no CVSS, AMD Radeon Software)
- [CVE-2020-12920](https://cve.now/CVE-2020-12920.md): A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler. (no CVSS, AMD Radeon Software)
- [CVE-2020-12902](https://cve.now/CVE-2020-12902.md): Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12897](https://cve.now/CVE-2020-12897.md): Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass. (no CVSS, AMD Radeon Software)
- [CVE-2021-34992](https://cve.now/CVE-2021-34992.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. (CVSS 8.8, Orckestra C1 CMS)
- [CVE-2021-34991](https://cve.now/CVE-2021-34991.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2… (CVSS 8.8, NETGEAR R6400v2)
- [CVE-2021-38984](https://cve.now/CVE-2021-38984.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker… (CVSS 3.7, IBM Security Key Lifecycle Manager)
- [CVE-2021-38983](https://cve.now/CVE-2021-38983.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker… (CVSS 4.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38982](https://cve.now/CVE-2021-38982.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38981](https://cve.now/CVE-2021-38981.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed… (CVSS 5.3, IBM Security Key Lifecycle Manager)
- [CVE-2021-38979](https://cve.now/CVE-2021-38979.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be… (CVSS 4.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38978](https://cve.now/CVE-2021-38978.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the… (CVSS 5.9, IBM Security Key Lifecycle Manager)
- [CVE-2021-38977](https://cve.now/CVE-2021-38977.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.1, IBM Security Key Lifecycle Manager)
- [CVE-2021-38976](https://cve.now/CVE-2021-38976.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. (CVSS 6.2, IBM Security Key Lifecycle Manager)
- [CVE-2021-38975](https://cve.now/CVE-2021-38975.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a… (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2021-38974](https://cve.now/CVE-2021-38974.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially… (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2020-12899](https://cve.now/CVE-2020-12899.md): Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12900](https://cve.now/CVE-2020-12900.md): An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation… (no CVSS, AMD Radeon Software)
- [CVE-2021-41951](https://cve.now/CVE-2021-41951.md): ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress\_sso/pages/index.php… (no CVSS)
- [CVE-2020-12904](https://cve.now/CVE-2020-12904.md): Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12964](https://cve.now/CVE-2020-12964.md): A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler. (no CVSS, AMD Radeon Software)
- [CVE-2021-22959](https://cve.now/CVE-2021-22959.md): The parser in accepts requests with a space (SP) right after the header name before the colon. (no CVSS, NodeJS Node)
- [CVE-2021-43574](https://cve.now/CVE-2021-43574.md): WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. (no CVSS)
- [CVE-2021-42703](https://cve.now/CVE-2021-42703.md): AzeoTech DAQFactory (CVSS 5.4, Advantech HMI Designer)
- [CVE-2021-42706](https://cve.now/CVE-2021-42706.md): AzeoTech DAQFactory (CVSS 7.8, Advantech HMI Designer)
- [CVE-2021-43495](https://cve.now/CVE-2021-43495.md): AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in… (no CVSS)
- [CVE-2021-42839](https://cve.now/CVE-2021-42839.md): Grand Vice info Co. webopac7 - Arbitrary File Upload (CVSS 8.8, Grand Vice info webopac7)
- [CVE-2021-42838](https://cve.now/CVE-2021-42838.md): Grand Vice info Co. webopac7 - Reflected XSS (CVSS 6.1, Grand Vice info webopac7)
- [CVE-2021-41289](https://cve.now/CVE-2021-41289.md): ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer (CVSS 6.3, ASUS P453UJ BIOS)
- [CVE-2021-43620](https://cve.now/CVE-2021-43620.md): An issue was discovered in the fruity crate through 0.2.0 for Rust. (no CVSS, fruity)
- [CVE-2021-42373](https://cve.now/CVE-2021-42373.md): A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given (no CVSS, busybox)
- [CVE-2021-42374](https://cve.now/CVE-2021-42374.md): An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input… (CVSS 5.3, busybox)
- [CVE-2021-42375](https://cve.now/CVE-2021-42375.md): An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due… (CVSS 5.5, busybox)
- [CVE-2021-42376](https://cve.now/CVE-2021-42376.md): A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing… (no CVSS, busybox)
- [CVE-2021-42377](https://cve.now/CVE-2021-42377.md): An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a… (no CVSS, busybox)
- [CVE-2021-42378](https://cve.now/CVE-2021-42378.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42379](https://cve.now/CVE-2021-42379.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42380](https://cve.now/CVE-2021-42380.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42381](https://cve.now/CVE-2021-42381.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42382](https://cve.now/CVE-2021-42382.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42383](https://cve.now/CVE-2021-42383.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42384](https://cve.now/CVE-2021-42384.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42385](https://cve.now/CVE-2021-42385.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-42386](https://cve.now/CVE-2021-42386.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in… (CVSS 7.2, busybox)
- [CVE-2021-43618](https://cve.now/CVE-2021-43618.md): GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp\_raw.c integer overflow and resultant buffer overflow via crafte (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2021-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.