# CVEs published 2021-11-05

88 CVEs were published on November 5, 2021: 1 critical, 25 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41251](https://cve.now/CVE-2021-41251.md): Possibility to elevate privileges or get unauthorized access to data (CVSS 5.9, SAP cloud-sdk-js · @sap-cloud-sdk/core)
- [CVE-2020-22226](https://cve.now/CVE-2020-22226.md): Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionSetAmount function. (no CVSS)
- [CVE-2020-22225](https://cve.now/CVE-2020-22225.md): Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoadForm function. (no CVSS)
- [CVE-2020-22224](https://cve.now/CVE-2020-22224.md): Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionPreview (no CVSS)
- [CVE-2020-22223](https://cve.now/CVE-2020-22223.md): Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a SQL injection vulnerability via the pjActionLoad function. (no CVSS)
- [CVE-2020-22222](https://cve.now/CVE-2020-22222.md): Stivasoft (Phpjabbers) Fundraising Script v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the pjActionLoadCss (no CVSS)
- [CVE-2021-41250](https://cve.now/CVE-2021-41250.md): Presence of non-blacklisted URL bypasses all other filters (CVSS 4.3, python-discord bot)
- [CVE-2021-41230](https://cve.now/CVE-2021-41230.md): OIDC claims not updated from Identity Provider in Pomerium (CVSS 5.3, pomerium · github.com/pomerium/pomerium)
- [CVE-2021-41227](https://cve.now/CVE-2021-41227.md): Arbitrary memory read in \`ImmutableConst\` (CVSS 6.6, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41225](https://cve.now/CVE-2021-41225.md): A use of uninitialized value vulnerability in Tensorflow (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41222](https://cve.now/CVE-2021-41222.md): Segfault due to negative splits in \`SplitV\` (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41228](https://cve.now/CVE-2021-41228.md): Code injection in \`saved\_model\_cli\` (CVSS 7.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41220](https://cve.now/CVE-2021-41220.md): Use after free in \`CollectiveReduceV2\` (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41221](https://cve.now/CVE-2021-41221.md): Access to invalid memory during shape inference in \`Cudnn\*\` ops (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41216](https://cve.now/CVE-2021-41216.md): Heap buffer overflow in \`Transpose\` (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41213](https://cve.now/CVE-2021-41213.md): Deadlock in mutually recursive \`tf.function\` objects (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41218](https://cve.now/CVE-2021-41218.md): Integer division by 0 in \`tf.raw\_ops.AllToAll\` (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41206](https://cve.now/CVE-2021-41206.md): Incomplete validation of shapes in multiple TF ops (CVSS 7.0, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41208](https://cve.now/CVE-2021-41208.md): Incomplete validation in boosted trees code (CVSS 8.8, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41207](https://cve.now/CVE-2021-41207.md): Division by zero in \`ParallelConcat\` (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41202](https://cve.now/CVE-2021-41202.md): Overflow/crash in \`tf.range\` (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41209](https://cve.now/CVE-2021-41209.md): FPE in convolutions with zero size filters (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41203](https://cve.now/CVE-2021-41203.md): Missing validation during checkpoint loading (CVSS 7.8, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41215](https://cve.now/CVE-2021-41215.md): Null pointer exception in \`DeserializeSparse\` (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41217](https://cve.now/CVE-2021-41217.md): Null pointer exception when \`Exit\` node is not preceded by \`Enter\` op (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41219](https://cve.now/CVE-2021-41219.md): Undefined behavior via \`nullptr\` reference binding in sparse matrix multiplication (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41214](https://cve.now/CVE-2021-41214.md): Reference binding to \`nullptr\` in \`tf.ragged.cross\` (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41204](https://cve.now/CVE-2021-41204.md): Segfault while copying constant resource tensor (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41226](https://cve.now/CVE-2021-41226.md): Heap OOB read in \`SparseBinCount\` (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41223](https://cve.now/CVE-2021-41223.md): Heap OOB read in \`FusedBatchNorm\` kernels (CVSS 7.1, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41224](https://cve.now/CVE-2021-41224.md): \`SparseFillEmptyRows\` heap OOB read (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41212](https://cve.now/CVE-2021-41212.md): Heap OOB read in \`tf.ragged.cross\` (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41211](https://cve.now/CVE-2021-41211.md): Heap OOB read in shape inference for \`QuantizeV2\` (CVSS 7.1, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41205](https://cve.now/CVE-2021-41205.md): Heap OOB read in all \`tf.raw\_ops.QuantizeAndDequantizeV\*\` ops (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41210](https://cve.now/CVE-2021-41210.md): Heap OOB read in \`tf.raw\_ops.SparseCountSparseOutput\` (CVSS 7.1, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41201](https://cve.now/CVE-2021-41201.md): Unitialized access in \`EinsumHelper::ParseEquation\` (CVSS 7.8, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41200](https://cve.now/CVE-2021-41200.md): Incomplete validation in \`tf.summary.create\_file\_writer\` (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41197](https://cve.now/CVE-2021-41197.md): Crashes due to overflow and \`CHECK\`-fail in ops with large tensor shapes (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41198](https://cve.now/CVE-2021-41198.md): Overflow/crash in \`tf.tile\` when tiling tensor is large (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41199](https://cve.now/CVE-2021-41199.md): Overflow/crash in \`tf.image.resize\` when size is large (CVSS 5.5, tensorflow · tensorflow-gpu +1)
- [CVE-2021-41196](https://cve.now/CVE-2021-41196.md): Crash in \`max\_pool3d\` when size argument is 0 or negative (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-41195](https://cve.now/CVE-2021-41195.md): Crash in \`tf.math.segment\_\*\` operations (CVSS 5.5, tensorflow · tensorflow-cpu +1)
- [CVE-2021-42359](https://cve.now/CVE-2021-42359.md): WP DSGVO Tools (GDPR) \<= 3.1.23 Unauthenticated Arbitrary Post Deletion (CVSS 7.5, legalweb WP DSGVO Tools)
- [CVE-2021-3774](https://cve.now/CVE-2021-3774.md): Meross MSS550X Missing Encryption of Sensitive Data (CVSS 7.4, Meross Smart Wi-Fi 2 Way Wall Switch)
- [CVE-2021-43403](https://cve.now/CVE-2021-43403.md): An issue was discovered in FusionPBX before 4.5.30. (no CVSS)
- [CVE-2021-43405](https://cve.now/CVE-2021-43405.md): An issue was discovered in FusionPBX before 4.5.30. (no CVSS)
- [CVE-2021-43406](https://cve.now/CVE-2021-43406.md): An issue was discovered in FusionPBX before 4.5.30. (no CVSS)
- [CVE-2021-43404](https://cve.now/CVE-2021-43404.md): An issue was discovered in FusionPBX before 4.5.30. (no CVSS)
- [CVE-2021-42837](https://cve.now/CVE-2021-42837.md): An issue was discovered in Talend Data Catalog before 7.3-20210930. (no CVSS)
- [CVE-2021-29753](https://cve.now/CVE-2021-29753.md): IBM Business Automation Workflow 18. (CVSS 5.9, IBM Business Process Manager · IBM Business Automation Work…)
- [CVE-2020-23567](https://cve.now/CVE-2020-23567.md): Irfanview v4.53 allows attackers to to cause a denial of service (DoS) via a crafted JPEG 2000 file. (no CVSS)
- [CVE-2020-23566](https://cve.now/CVE-2020-23566.md): Irfanview v4.53 was discovered to contain an infinity loop via JPEG2000!ShowPlugInSaveOptions\_W+0x1ecd8. (no CVSS)
- [CVE-2020-23565](https://cve.now/CVE-2020-23565.md): Irfanview v4.53 allows attackers to execute arbitrary code via a crafted JPEG 2000 file. (no CVSS)
- [CVE-2021-39416](https://cve.now/CVE-2021-39416.md): Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, ( (no CVSS)
- [CVE-2021-42698](https://cve.now/CVE-2021-42698.md): AzeoTech DAQFactory (CVSS 7.8, AzeoTech DAQFactory)
- [CVE-2021-42701](https://cve.now/CVE-2021-42701.md): AzeoTech DAQFactory (CVSS 5.0, AzeoTech DAQFactory)
- [CVE-2021-42543](https://cve.now/CVE-2021-42543.md): AzeoTech DAQFactory (CVSS 7.8, AzeoTech DAQFactory)
- [CVE-2021-42699](https://cve.now/CVE-2021-42699.md): AzeoTech DAQFactory (CVSS 5.7, AzeoTech DAQFactory)
- [CVE-2021-39413](https://cve.now/CVE-2021-39413.md): Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to\_time parameter in (a) backlinks.php, (b) analyt (no CVSS)
- [CVE-2021-3924](https://cve.now/CVE-2021-3924.md): Path Traversal in getgrav/grav (CVSS 8.8, getgrav/grav)
- [CVE-2021-3916](https://cve.now/CVE-2021-3916.md): Path Traversal in bookstackapp/bookstack (CVSS 6.5, bookstackapp/bookstack)
- [CVE-2021-39412](https://cve.now/CVE-2021-39412.md): Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server\_side/scr (no CVSS)
- [CVE-2021-39411](https://cve.now/CVE-2021-39411.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in ( (no CVSS)
- [CVE-2021-42671](https://cve.now/CVE-2021-42671.md): An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia\_munoz\_monitoring\_system/admin/uploa (no CVSS)
- [CVE-2021-42670](https://cve.now/CVE-2021-42670.md): A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcements\_student.php (no CVSS)
- [CVE-2021-42669](https://cve.now/CVE-2021-42669.md): A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard\_teacher.php, which allows changing the ava (no CVSS)
- [CVE-2021-42668](https://cve.now/CVE-2021-42668.md): A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter in the my\_classmates.php web page (no CVSS)
- [CVE-2021-42667](https://cve.now/CVE-2021-42667.md): A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views. (no CVSS)
- [CVE-2021-42666](https://cve.now/CVE-2021-42666.md): A SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to quiz\_question.php, which could (no CVSS)
- [CVE-2021-42665](https://cve.now/CVE-2021-42665.md): An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can all (no CVSS)
- [CVE-2021-42664](https://cve.now/CVE-2021-42664.md): A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) qu (no CVSS)
- [CVE-2021-42663](https://cve.now/CVE-2021-42663.md): An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to / (no CVSS)
- [CVE-2021-42662](https://cve.now/CVE-2021-42662.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the (no CVSS)
- [CVE-2021-26844](https://cve.now/CVE-2021-26844.md): A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2021-42237](https://cve.now/CVE-2021-42237.md): Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi (CVSS 9.8, KEV)
- [CVE-2021-25509](https://cve.now/CVE-2021-25509.md): A missing input validation in Samsung Flow Windows application prior to Version 4.8.5.0 allows attackers to overwrite abtraty file in the Wi (CVSS 5.9, Samsung Mobile Samsung Flow)
- [CVE-2021-25508](https://cve.now/CVE-2021-25508.md): Improper privilege management vulnerability in API Key used in SmartThings prior to 1.7.73.22 allows an attacker to abuse the API key withou (CVSS 5.3, Samsung Mobile SmartThings)
- [CVE-2021-25507](https://cve.now/CVE-2021-25507.md): Improper authorization vulnerability in Samsung Flow mobile application prior to 4.8.03.5 allows Samsung Flow PC application connected with (CVSS 5.7, Samsung Mobile Samsung Flow)
- [CVE-2021-25506](https://cve.now/CVE-2021-25506.md): Non-existent provider in Samsung Health prior to 6.19.1.0001 allows attacker to access it via malicious content provider or lead to denial o (CVSS 4.0, Samsung Mobile Samsung Health)
- [CVE-2021-25505](https://cve.now/CVE-2021-25505.md): Improper authentication in Samsung Pass prior to 3.0.02.4 allows to use app without authentication when lockscreen is unlocked. (CVSS 3.3, Samsung Mobile Samsung Pass)
- [CVE-2021-25504](https://cve.now/CVE-2021-25504.md): Intent redirection vulnerability in Group Sharing prior to 10.8.03.2 allows attacker to access contact information. (CVSS 4.0, Samsung Mobile Group Sharing)
- [CVE-2021-25503](https://cve.now/CVE-2021-25503.md): Improper input validation vulnerability in HDCP prior to SMR Nov-2021 Release 1 allows attackers to arbitrary code execution. (CVSS 5.0, Samsung Mobile Devices)
- [CVE-2021-25502](https://cve.now/CVE-2021-25502.md): A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ES (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2021-25501](https://cve.now/CVE-2021-25501.md): An improper access control vulnerability in SCloudBnRReceiver in SecTelephonyProvider prior to SMR Nov-2021 Release 1 allows untrusted appli (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2021-25500](https://cve.now/CVE-2021-25500.md): A missing input validation in HDCP LDFW prior to SMR Nov-2021 Release 1 allows attackers to overwrite TZASC allowing TEE compromise. (CVSS 7.2, Samsung Mobile Devices)
- [CVE-2021-35368](https://cve.now/CVE-2021-35368.md): OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a tr (no CVSS)
- [CVE-2021-3927](https://cve.now/CVE-2021-3927.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2021-3928](https://cve.now/CVE-2021-3928.md): Use of Uninitialized Variable in vim/vim (CVSS 7.3, vim/vim)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.