CVEs published November 5, 2021
88 CVEs were published on November 5, 2021: 1 critical, 25 high. 1 is now in CISA KEV.
- Published
- 88
- Critical
- 1
- High
- 25
- Medium
- 32
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 49
Most affected products
- tensorflow · tensorflow-cpu +1
- 22
- tensorflow · tensorflow-gpu +1
- 12
- AzeoTech DAQFactory
- 4
- Samsung Mobile Devices
- 4
- Samsung Mobile Samsung Flow
- 2
- vim/vim
- 2
- bookstackapp/bookstack
- 1
- getgrav/grav
- 1
- IBM Business Process Manager · IBM Business Automation Work…
- 1
- legalweb WP DSGVO Tools
- 1
Critical 1
High 25
- CVE-2021-41228Code injection in `saved_model_cli`tensorflow · tensorflow-gpu +1
- CVE-2021-41220Use after free in `CollectiveReduceV2`tensorflow · tensorflow-cpu +1
- CVE-2021-41221Access to invalid memory during shape inference in `Cudnn*` opstensorflow · tensorflow-cpu +1
- CVE-2021-41206Incomplete validation of shapes in multiple TF opstensorflow · tensorflow-gpu +1
- CVE-2021-41208Incomplete validation in boosted trees codetensorflow · tensorflow-gpu +1
- CVE-2021-41203Missing validation during checkpoint loadingtensorflow · tensorflow-gpu +1
- CVE-2021-41219Undefined behavior via `nullptr` reference binding in sparse matrix multiplicationtensorflow · tensorflow-cpu +1
- CVE-2021-41214Reference binding to `nullptr` in `tf.ragged.cross`tensorflow · tensorflow-cpu +1
- CVE-2021-41226Heap OOB read in `SparseBinCount`tensorflow · tensorflow-cpu +1
- CVE-2021-41223Heap OOB read in `FusedBatchNorm` kernelstensorflow · tensorflow-gpu +1
- CVE-2021-41224`SparseFillEmptyRows` heap OOB readtensorflow · tensorflow-cpu +1
- CVE-2021-41212Heap OOB read in `tf.ragged.cross`tensorflow · tensorflow-cpu +1
- CVE-2021-41211Heap OOB read in shape inference for `QuantizeV2`tensorflow · tensorflow-gpu +1
- CVE-2021-41205Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` opstensorflow · tensorflow-cpu +1
- CVE-2021-41210Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`tensorflow · tensorflow-cpu +1
- CVE-2021-41201Unitialized access in `EinsumHelper::ParseEquation`tensorflow · tensorflow-cpu +1
- CVE-2021-42359WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletionlegalweb WP DSGVO Tools
- CVE-2021-3774Meross MSS550X Missing Encryption of Sensitive DataMeross Smart Wi-Fi 2 Way Wall Switch
- CVE-2021-42698AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2021-42543AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2021-3924Path Traversal in getgrav/gravgetgrav/grav
- CVE-2021-25502A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESSamsung Mobile Devices
- CVE-2021-25500A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise.Samsung Mobile Devices
- CVE-2021-3927Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-3928Use of Uninitialized Variable in vim/vimvim/vim
Medium, low and unrated 62
- CVE-2021-41251Possibility to elevate privileges or get unauthorized access to dataSAP cloud-sdk-js · @sap-cloud-sdk/core
- CVE-2020-22226Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function.
- CVE-2020-22225Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function.
- CVE-2020-22224Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview
- CVE-2020-22223Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function.
- CVE-2020-22222Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss
- CVE-2021-41250Presence of non-blacklisted URL bypasses all other filterspython-discord bot
- CVE-2021-41230OIDC claims not updated from Identity Provider in Pomeriumpomerium · github.com/pomerium/pomerium
- CVE-2021-41227Arbitrary memory read in `ImmutableConst`tensorflow · tensorflow-cpu +1
- CVE-2021-41225A use of uninitialized value vulnerability in Tensorflowtensorflow · tensorflow-cpu +1
- CVE-2021-41222Segfault due to negative splits in `SplitV`tensorflow · tensorflow-gpu +1
- CVE-2021-41216Heap buffer overflow in `Transpose`tensorflow · tensorflow-cpu +1
- CVE-2021-41213Deadlock in mutually recursive `tf.function` objectstensorflow · tensorflow-cpu +1
- CVE-2021-41218Integer division by 0 in `tf.raw_ops.AllToAll`tensorflow · tensorflow-cpu +1
- CVE-2021-41207Division by zero in `ParallelConcat`tensorflow · tensorflow-cpu +1
- CVE-2021-41202Overflow/crash in `tf.range`tensorflow · tensorflow-cpu +1
- CVE-2021-41209FPE in convolutions with zero size filterstensorflow · tensorflow-gpu +1
- CVE-2021-41215Null pointer exception in `DeserializeSparse`tensorflow · tensorflow-gpu +1
- CVE-2021-41217Null pointer exception when `Exit` node is not preceded by `Enter` optensorflow · tensorflow-gpu +1
- CVE-2021-41204Segfault while copying constant resource tensortensorflow · tensorflow-cpu +1
- CVE-2021-41200Incomplete validation in `tf.summary.create_file_writer`tensorflow · tensorflow-cpu +1
- CVE-2021-41197Crashes due to overflow and `CHECK`-fail in ops with large tensor shapestensorflow · tensorflow-cpu +1
- CVE-2021-41198Overflow/crash in `tf.tile` when tiling tensor is largetensorflow · tensorflow-gpu +1
- CVE-2021-41199Overflow/crash in `tf.image.resize` when size is largetensorflow · tensorflow-gpu +1
- CVE-2021-41196Crash in `max_pool3d` when size argument is 0 or negativetensorflow · tensorflow-cpu +1
- CVE-2021-41195Crash in `tf.math.segment_*` operationstensorflow · tensorflow-cpu +1
- CVE-2021-43403An issue was discovered in FusionPBX before 4.5.30.
- CVE-2021-43405An issue was discovered in FusionPBX before 4.5.30.
- CVE-2021-43406An issue was discovered in FusionPBX before 4.5.30.
- CVE-2021-43404An issue was discovered in FusionPBX before 4.5.30.
- CVE-2021-42837An issue was discovered in Talend Data Catalog before 7.3-20210930.
- CVE-2021-29753IBM Business Automation Workflow 18.IBM Business Process Manager · IBM Business Automation Work…
- CVE-2020-23567Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file.
- CVE-2020-23566Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions_W+0x1ecd8.
- CVE-2020-23565Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file.
- CVE-2021-39416Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (
- CVE-2021-42701AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2021-42699AzeoTech DAQFactoryAzeoTech DAQFactory
- CVE-2021-39413Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analyt
- CVE-2021-3916Path Traversal in bookstackapp/bookstackbookstackapp/bookstack
- CVE-2021-39412Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scr
- CVE-2021-39411Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (
- CVE-2021-42671An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploa
- CVE-2021-42670A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements_student.php
- CVE-2021-42669A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the ava
- CVE-2021-42668A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my_classmates.php web page
- CVE-2021-42667A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.
- CVE-2021-42666A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz_question.php, which could
- CVE-2021-42665An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can all
- CVE-2021-42664A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) qu
- CVE-2021-42663An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /
- CVE-2021-42662A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the
- CVE-2021-26844A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script o
- CVE-2021-25509A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the WiSamsung Mobile Samsung Flow
- CVE-2021-25508Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key withouSamsung Mobile SmartThings
- CVE-2021-25507Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with Samsung Mobile Samsung Flow
- CVE-2021-25506Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial oSamsung Mobile Samsung Health
- CVE-2021-25505Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked.Samsung Mobile Samsung Pass
- CVE-2021-25504Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information.Samsung Mobile Group Sharing
- CVE-2021-25503Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution.Samsung Mobile Devices
- CVE-2021-25501An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted appliSamsung Mobile Devices
- CVE-2021-35368OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a tr