CVEs published November 2, 2021
97 CVEs were published on November 2, 2021: 0 critical, 8 high.
- Published
- 97
- Critical
- 0
- High
- 8
- Medium
- 18
- Low
- 3
- Unrated
- 68
- Now in CISA KEV
- 0
- Fix available
- 31
Most affected products
- Google Chrome
- 23
- NEC CLUSTERPRO X
- 8
- IBM InfoSphere Information Server
- 6
- Fortinet FortiPortal
- 5
- Fortinet FortiSIEMWindowsAgent
- 2
- Fortinet FortiWeb
- 2
- Fortinet FortiWLM
- 2
- com.typesafe.akka:akka-http-core_2.13.0-RC3 · com.typesa… +5
- 1
- Fortinet FortiADC
- 1
- Fortinet FortiAnalyzer
- 1
High 8
- CVE-2021-36184A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows aFortinet FortiWLM
- CVE-2021-36185A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below alFortinet FortiWLM
- CVE-2021-36183An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local Fortinet FortiClientWindows
- CVE-2021-36186A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unautFortinet FortiWeb
- CVE-2021-41022A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or coFortinet FortiSIEMWindowsAgent
- CVE-2021-41238Missing Authorization with Default Settings in Dashboard UIHangfireIO Hangfire · Hangfire.Core
- CVE-2021-41232Improper Neutralization of Special Elements used in an LDAP QueryStevenWeathers thunderdome-planning-poker · github.com/stev…
- CVE-2021-38948IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data.IBM InfoSphere Information Server
Medium, low and unrated 89
- CVE-2021-20705Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earNEC CLUSTERPRO X
- CVE-2021-20707Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for WindowsNEC CLUSTERPRO X
- CVE-2021-20703Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earliNEC CLUSTERPRO X
- CVE-2021-20701Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSNEC CLUSTERPRO X
- CVE-2021-20706Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earNEC CLUSTERPRO X
- CVE-2021-20704Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 foNEC CLUSTERPRO X
- CVE-2021-20702Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earliNEC CLUSTERPRO X
- CVE-2021-20700Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSNEC CLUSTERPRO X
- CVE-2020-27820A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that iskernel
- CVE-2021-20135Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, locaNessus
- CVE-2021-41036In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket.The Eclipse Foundation Eclipse Paho MQTT C Client
- CVE-2021-43270Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 i
- CVE-2020-16048Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page.
- CVE-2020-6492Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a craftGoogle Chrome
- CVE-2018-6125Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially senGoogle Chrome
- CVE-2018-6122Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-43267An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.
- CVE-2017-5123Insufficient data validation in waitid allowed an user to escape sandboxes on Linux.
- CVE-2021-43264In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the
- CVE-2021-43265In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
- CVE-2021-43266In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacha
- CVE-2021-42697Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote atcom.typesafe.akka:akka-http-core_2.13.0-RC3 · com.typesa… +5
- CVE-2021-37996Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation rGoogle Chrome
- CVE-2021-37995Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay andGoogle Chrome
- CVE-2021-37994Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restricGoogle Chrome
- CVE-2021-37993Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2021-37992Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-37991Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google Chrome
- CVE-2021-37990Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2021-37989Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via Google Chrome
- CVE-2021-37988Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestuGoogle Chrome
- CVE-2021-37987Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-37986Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially exGoogle Chrome
- CVE-2021-37985Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to deGoogle Chrome
- CVE-2021-37984Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2021-37983Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-37982Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2021-37981Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2021-37980Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolatioGoogle Chrome
- CVE-2021-37979heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a maliciouGoogle Chrome
- CVE-2021-37978Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-37977Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2020-15935A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated aFortinet FortiADC
- CVE-2021-42754An improper control of generation of code vulnerability [CWE-94] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow Fortinet FortiClientMac
- CVE-2021-36187A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause aFortinet FortiWeb
- CVE-2021-41023A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure Fortinet FortiSIEMWindowsAgent
- CVE-2021-36174A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an atFortinet FortiPortal
- CVE-2021-36176Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privilegeFortinet FortiPortal
- CVE-2021-32595Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privilegeFortinet FortiPortal
- CVE-2020-12814A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, veFortinet FortiAnalyzer
- CVE-2021-26107An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restrFortinet FortiManager
- CVE-2020-15940An improper neutralization of input vulnerability [CWE-79] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remoteFortinet FortiClientEMS
- CVE-2020-23754Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute ar
- CVE-2020-23719Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute
- CVE-2020-23718Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to inde
- CVE-2020-23686Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified i
- CVE-2020-23685SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the usernam
- CVE-2020-21574Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is p
- CVE-2020-21573An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted i
- CVE-2020-21572Buffer overflow vulnerability in function src_parser_trans_stage_1_2_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, a
- CVE-2020-20658Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexp
- CVE-2020-20657Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while
- CVE-2020-18440Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
- CVE-2020-18439An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbi
- CVE-2020-18438Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin
- CVE-2021-41019An improper validation of certificate with host mismatch [CWE-297] vulnerability in FortiOS versions 6.4.6 and below may allow the connectioFortinet FortiOS
- CVE-2021-36172An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow Fortinet FortiPortal
- CVE-2021-36181A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interfaFortinet FortiPortal
- CVE-2021-29888IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unIBM InfoSphere Information Server
- CVE-2021-29875IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access vIBM InfoSphere Information Server
- CVE-2021-29771IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.IBM InfoSphere Information Server
- CVE-2021-29738IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF).IBM InfoSphere Information Server
- CVE-2021-29737IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server IBM InfoSphere Information Server
- CVE-2021-36794In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled globall
- CVE-2021-42568Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged a
- CVE-2021-36925RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitr
- CVE-2021-36924RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool ov
- CVE-2021-36923RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthori
- CVE-2021-36922RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthori
- CVE-2021-42763Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext.
- CVE-2021-37842metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information.
- CVE-2021-27722An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5.
- CVE-2020-35249Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add
- CVE-2020-27406Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname.
- CVE-2021-33611Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14Vaadin · vaadin-menu-bar +2
- CVE-2021-36560Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of
- CVE-2021-3765Inefficient Regular Expression Complexity in validatorjs/validator.jsvalidatorjs/validator.js · validator
- CVE-2021-25973Publify - Improper Authorization Leads to Guest Signup Restriction Bypasspublify_core
- CVE-2021-33593Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may NAVER Whale browser