# CVEs published 2021-11-02

97 CVEs were published on November 2, 2021: 0 critical, 8 high. Days are UTC.

- [CVE-2021-20705](https://cve.now/CVE-2021-20705.md): Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and ear (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20707](https://cve.now/CVE-2021-20707.md): Improper input validation vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20703](https://cve.now/CVE-2021-20703.md): Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earli (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20701](https://cve.now/CVE-2021-20701.md): Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUS (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20706](https://cve.now/CVE-2021-20706.md): Improper input validation vulnerability in the WebManager CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and ear (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20704](https://cve.now/CVE-2021-20704.md): Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 fo (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20702](https://cve.now/CVE-2021-20702.md): Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earli (no CVSS, NEC CLUSTERPRO X)
- [CVE-2021-20700](https://cve.now/CVE-2021-20700.md): Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUS (no CVSS, NEC CLUSTERPRO X)
- [CVE-2020-27820](https://cve.now/CVE-2020-27820.md): A vulnerability was found in Linux kernel, where a use-after-frees in nouveau's postclose() handler could happen if removing device (that is (no CVSS, kernel)
- [CVE-2021-20135](https://cve.now/CVE-2021-20135.md): Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, loca (no CVSS, Nessus)
- [CVE-2021-41036](https://cve.now/CVE-2021-41036.md): In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem\_len size in readpacket. (no CVSS, The Eclipse Foundation Eclipse Paho MQTT C Client)
- [CVE-2021-43270](https://cve.now/CVE-2021-43270.md): Datalust Seq.App.EmailPlus (aka seq-app-htmlemail) 3.1.0-dev-00148, 3.1.0-dev-00170, and 3.1.0-dev-00176 can use cleartext SMTP on port 25 i (no CVSS)
- [CVE-2020-16048](https://cve.now/CVE-2020-16048.md): Out of bounds read in ANGLE allowed a remote attacker to obtain sensitive data via a crafted HTML page. (no CVSS)
- [CVE-2020-6492](https://cve.now/CVE-2020-6492.md): Use after free in ANGLE in Google Chrome prior to 83.0.4103.97 allowed a remote attacker to potentially perform a sandbox escape via a craft (no CVSS, Google Chrome)
- [CVE-2018-6125](https://cve.now/CVE-2018-6125.md): Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sen (no CVSS, Google Chrome)
- [CVE-2018-6122](https://cve.now/CVE-2018-6122.md): Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-43267](https://cve.now/CVE-2021-43267.md): An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. (no CVSS)
- [CVE-2017-5123](https://cve.now/CVE-2017-5123.md): Insufficient data validation in waitid allowed an user to escape sandboxes on Linux. (no CVSS)
- [CVE-2021-43264](https://cve.now/CVE-2021-43264.md): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the (no CVSS)
- [CVE-2021-43265](https://cve.now/CVE-2021-43265.md): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element. (no CVSS)
- [CVE-2021-43266](https://cve.now/CVE-2021-43266.md): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacha (no CVSS)
- [CVE-2021-42697](https://cve.now/CVE-2021-42697.md): Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at (no CVSS, com.typesafe.akka:akka-http-core\_2.13.0-RC3 · com.typesa… +5)
- [CVE-2021-37996](https://cve.now/CVE-2021-37996.md): Insufficient validation of untrusted input Downloads in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation r (no CVSS, Google Chrome)
- [CVE-2021-37995](https://cve.now/CVE-2021-37995.md): Inappropriate implementation in WebApp Installer in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially overlay and (no CVSS, Google Chrome)
- [CVE-2021-37994](https://cve.now/CVE-2021-37994.md): Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to bypass navigation restric (no CVSS, Google Chrome)
- [CVE-2021-37993](https://cve.now/CVE-2021-37993.md): Use after free in PDF Accessibility in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-37992](https://cve.now/CVE-2021-37992.md): Out of bounds read in WebAudio in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-37991](https://cve.now/CVE-2021-37991.md): Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (no CVSS, Google Chrome)
- [CVE-2021-37990](https://cve.now/CVE-2021-37990.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 95.0.4638.54 allowed a remote attacker to leak cross-origin dat (no CVSS, Google Chrome)
- [CVE-2021-37989](https://cve.now/CVE-2021-37989.md): Inappropriate implementation in Blink in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to abuse content security policy via (no CVSS, Google Chrome)
- [CVE-2021-37988](https://cve.now/CVE-2021-37988.md): Use after free in Profiles in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who convinced a user to engage in specific gestu (no CVSS, Google Chrome)
- [CVE-2021-37987](https://cve.now/CVE-2021-37987.md): Use after free in Network APIs in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-37986](https://cve.now/CVE-2021-37986.md): Heap buffer overflow in Settings in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to engage with Dev Tools to potentially ex (no CVSS, Google Chrome)
- [CVE-2021-37985](https://cve.now/CVE-2021-37985.md): Use after free in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had convinced a user to allow for connection to de (no CVSS, Google Chrome)
- [CVE-2021-37984](https://cve.now/CVE-2021-37984.md): Heap buffer overflow in PDFium in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-37983](https://cve.now/CVE-2021-37983.md): Use after free in Dev Tools in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-37982](https://cve.now/CVE-2021-37982.md): Use after free in Incognito in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2021-37981](https://cve.now/CVE-2021-37981.md): Heap buffer overflow in Skia in Google Chrome prior to 95.0.4638.54 allowed a remote attacker who had compromised the renderer process to po (no CVSS, Google Chrome)
- [CVE-2021-37980](https://cve.now/CVE-2021-37980.md): Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolatio (no CVSS, Google Chrome)
- [CVE-2021-37979](https://cve.now/CVE-2021-37979.md): heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a maliciou (no CVSS, Google Chrome)
- [CVE-2021-37978](https://cve.now/CVE-2021-37978.md): Heap buffer overflow in Blink in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-37977](https://cve.now/CVE-2021-37977.md): Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2020-15935](https://cve.now/CVE-2020-15935.md): A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated a (CVSS 4.3, Fortinet FortiADC)
- [CVE-2021-42754](https://cve.now/CVE-2021-42754.md): An improper control of generation of code vulnerability \[CWE-94\] in FortiClientMacOS versions 7.0.0 and below and 6.4.5 and below may allow (CVSS 3.2, Fortinet FortiClientMac)
- [CVE-2021-36184](https://cve.now/CVE-2021-36184.md): A improper neutralization of Special Elements used in an SQL Command ('SQL Injection') in Fortinet FortiWLM version 8.6.1 and below allows a (CVSS 8.8, Fortinet FortiWLM)
- [CVE-2021-36185](https://cve.now/CVE-2021-36185.md): A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below al (CVSS 8.8, Fortinet FortiWLM)
- [CVE-2021-36183](https://cve.now/CVE-2021-36183.md): An improper authorization vulnerability \[CWE-285\] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local (CVSS 7.4, Fortinet FortiClientWindows)
- [CVE-2021-36186](https://cve.now/CVE-2021-36186.md): A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unaut (CVSS 8.8, Fortinet FortiWeb)
- [CVE-2021-36187](https://cve.now/CVE-2021-36187.md): A uncontrolled resource consumption in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to cause a (CVSS 5.3, Fortinet FortiWeb)
- [CVE-2021-41023](https://cve.now/CVE-2021-41023.md): A unprotected storage of credentials in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows an authenticated user to disclosure (CVSS 5.5, Fortinet FortiSIEMWindowsAgent)
- [CVE-2021-41022](https://cve.now/CVE-2021-41022.md): A improper privilege management in Fortinet FortiSIEM Windows Agent version 4.1.4 and below allows attacker to execute privileged code or co (CVSS 7.8, Fortinet FortiSIEMWindowsAgent)
- [CVE-2021-36174](https://cve.now/CVE-2021-36174.md): A memory allocation with excessive size value vulnerability in the license verification function of FortiPortal before 6.0.6 may allow an at (CVSS 4.3, Fortinet FortiPortal)
- [CVE-2021-36176](https://cve.now/CVE-2021-36176.md): Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privilege (CVSS 6.1, Fortinet FortiPortal)
- [CVE-2021-41238](https://cve.now/CVE-2021-41238.md): Missing Authorization with Default Settings in Dashboard UI (CVSS 8.6, HangfireIO Hangfire · Hangfire.Core)
- [CVE-2021-32595](https://cve.now/CVE-2021-32595.md): Multiple uncontrolled resource consumption vulnerabilities in the web interface of FortiPortal before 6.0.6 may allow a single low-privilege (CVSS 6.5, Fortinet FortiPortal)
- [CVE-2020-12814](https://cve.now/CVE-2020-12814.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiAnalyzer version 6.0.6 and below, ve (CVSS 4.1, Fortinet FortiAnalyzer)
- [CVE-2021-41232](https://cve.now/CVE-2021-41232.md): Improper Neutralization of Special Elements used in an LDAP Query (CVSS 8.1, StevenWeathers thunderdome-planning-poker · github.com/stev…)
- [CVE-2021-26107](https://cve.now/CVE-2021-26107.md): An improper access control vulnerability \[CWE-284\] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restr (CVSS 6.3, Fortinet FortiManager)
- [CVE-2020-15940](https://cve.now/CVE-2020-15940.md): An improper neutralization of input vulnerability \[CWE-79\] in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote (CVSS 4.1, Fortinet FortiClientEMS)
- [CVE-2020-23754](https://cve.now/CVE-2020-23754.md): Cross Site Scripting (XSS) vulnerability in infusions/member\_poll\_panel/poll\_admin.php in PHP-Fusion 9.03.50, allows attackers to execute ar (no CVSS)
- [CVE-2020-23719](https://cve.now/CVE-2020-23719.md): Cross site scripting (XSS) vulnerability in application/controllers/AdminController.php in xujinliang zibbs 1.0, allows attackers to execute (no CVSS)
- [CVE-2020-23718](https://cve.now/CVE-2020-23718.md): Cross site scripting (XSS) vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to inde (no CVSS)
- [CVE-2020-23686](https://cve.now/CVE-2020-23686.md): Cross site request forgery (CSRF) vulnerability in AyaCMS 3.1.2 allows attackers to change an administrators password or other unspecified i (no CVSS)
- [CVE-2020-23685](https://cve.now/CVE-2020-23685.md): SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the usernam (no CVSS)
- [CVE-2020-21574](https://cve.now/CVE-2020-21574.md): Buffer overflow vulnerability in YotsuyaNight c-http v0.1.0, allows attackers to cause a denial of service via a long url request which is p (no CVSS)
- [CVE-2020-21573](https://cve.now/CVE-2020-21573.md): An issue was discoverered in in abhijitnathwani image-processing v0.1.0, allows local attackers to cause a denial of service via a crafted i (no CVSS)
- [CVE-2020-21572](https://cve.now/CVE-2020-21572.md): Buffer overflow vulnerability in function src\_parser\_trans\_stage\_1\_2\_3 trgil gilcc before commit 803969389ca9c06237075a7f8eeb1a19e6651759, a (no CVSS)
- [CVE-2020-20658](https://cve.now/CVE-2020-20658.md): Buffer overflow vulnerability in fcovatti libiec\_iccp\_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexp (no CVSS)
- [CVE-2020-20657](https://cve.now/CVE-2020-20657.md): Buffer overflow vulnerability in fcovatti libiec\_iccp\_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while (no CVSS)
- [CVE-2020-18440](https://cve.now/CVE-2020-18440.md): Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2020-18439](https://cve.now/CVE-2020-18439.md): An issue was discoverered in in function edit\_save\_f in framework/admin/tpl\_control.php in qinggan phpok 5.1, allows attackers to write arbi (no CVSS)
- [CVE-2020-18438](https://cve.now/CVE-2020-18438.md): Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin (no CVSS)
- [CVE-2021-41019](https://cve.now/CVE-2021-41019.md): An improper validation of certificate with host mismatch \[CWE-297\] vulnerability in FortiOS versions 6.4.6 and below may allow the connectio (CVSS 3.5, Fortinet FortiOS)
- [CVE-2021-36172](https://cve.now/CVE-2021-36172.md): An improper restriction of XML external entity reference vulnerability in the parser of XML responses of FortiPortal before 6.0.6 may allow (CVSS 4.3, Fortinet FortiPortal)
- [CVE-2021-36181](https://cve.now/CVE-2021-36181.md): A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interfa (CVSS 3.1, Fortinet FortiPortal)
- [CVE-2021-38948](https://cve.now/CVE-2021-38948.md): IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (CVSS 7.1, IBM InfoSphere Information Server)
- [CVE-2021-29888](https://cve.now/CVE-2021-29888.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and un (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2021-29875](https://cve.now/CVE-2021-29875.md): IBM InfoSphere Information Server 11.7 could allow an attacker to obtain sensitive information due to a insecure third party domain access v (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2021-29771](https://cve.now/CVE-2021-29771.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2021-29738](https://cve.now/CVE-2021-29738.md): IBM InfoSphere Data Flow Designer (IBM InfoSphere Information Server 11.7 ) is vulnerable to server-side request forgery (SSRF). (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2021-29737](https://cve.now/CVE-2021-29737.md): IBM InfoSphere Data Flow Designer Engine (IBM InfoSphere Information Server 11.7 ) component has improper validation of the REST API server (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2021-36794](https://cve.now/CVE-2021-36794.md): In Siren Investigate before 11.1.4, when enabling the cluster feature of the Siren Alert application, TLS verifications are disabled globall (no CVSS)
- [CVE-2021-42568](https://cve.now/CVE-2021-42568.md): Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged a (no CVSS)
- [CVE-2021-36925](https://cve.now/CVE-2021-36925.md): RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve an arbitr (no CVSS)
- [CVE-2021-36924](https://cve.now/CVE-2021-36924.md): RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve a pool ov (no CVSS)
- [CVE-2021-36923](https://cve.now/CVE-2021-36923.md): RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthori (no CVSS)
- [CVE-2021-36922](https://cve.now/CVE-2021-36922.md): RtsUpx.sys in Realtek RtsUpx USB Utility Driver for Camera/Hub/Audio through 1.14.0.0 allows local low-privileged users to achieve unauthori (no CVSS)
- [CVE-2021-42763](https://cve.now/CVE-2021-42763.md): Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. (no CVSS)
- [CVE-2021-37842](https://cve.now/CVE-2021-37842.md): metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. (no CVSS)
- [CVE-2021-27722](https://cve.now/CVE-2021-27722.md): An issue was discovered in Nsasoft US LLC SpotAuditor 5.3.5. (no CVSS)
- [CVE-2020-35249](https://cve.now/CVE-2020-35249.md): Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add (no CVSS)
- [CVE-2020-27406](https://cve.now/CVE-2020-27406.md): Cross Site Scripting (XSS) vulnerability in DynPG 4.9.1, allows authenticated attackers to execute arbitrary code via the groupname. (no CVSS)
- [CVE-2021-33611](https://cve.now/CVE-2021-33611.md): Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14 (CVSS 6.1, Vaadin · vaadin-menu-bar +2)
- [CVE-2021-36560](https://cve.now/CVE-2021-36560.md): Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of (no CVSS)
- [CVE-2021-3765](https://cve.now/CVE-2021-3765.md): Inefficient Regular Expression Complexity in validatorjs/validator.js (CVSS 5.3, validatorjs/validator.js · validator)
- [CVE-2021-25973](https://cve.now/CVE-2021-25973.md): Publify - Improper Authorization Leads to Guest Signup Restriction Bypass (CVSS 6.5, publify\_core)
- [CVE-2021-33593](https://cve.now/CVE-2021-33593.md): Whale browser for iOS before 1.14.0 has an inconsistent user interface issue that allows an attacker to obfuscate the address bar which may (no CVSS, NAVER Whale browser)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.