CVEs published November 8, 2021
89 CVEs were published on November 8, 2021: 3 critical, 3 high.
- Published
- 89
- Critical
- 3
- High
- 3
- Medium
- 9
- Low
- 1
- Unrated
- 73
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Simple Download Monitor
- 4
- IBM QRadar Network Security
- 3
- Registration Forms – User profile, Content Restriction, Spa…
- 2
- School Management System – WPSchoolPress
- 2
- stdlib
- 2
- 404 to 301 – Redirect, Log and Notify 404 Errors
- 1
- AddToAny Share Buttons
- 1
- Affiliates Manager
- 1
- Apostrophe
- 1
- Asgaros Forum
- 1
Critical 3
- CVE-2021-41170Evaluation of closures can lead to execution of methods & functions in current program scopesroehrl neoan3-template · neoan3-apps/template
- CVE-2021-25979Apostrophe - Insufficient Session ExpirationApostrophe
- CVE-2021-34684Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data s
High 3
- CVE-2021-39182Use of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyMorgan-Phoenix EnroCrypt · enrocrypt
- CVE-2021-31601An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
- CVE-2021-31599An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
Medium, low and unrated 83
- CVE-2021-41253Possible heap buffer overflow when using zycore string functions in formatter hookszyantific zydis
- CVE-2020-23572BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php.
- CVE-2021-40261Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user_username
- CVE-2021-40260Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.
- CVE-2021-39420Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg paramet
- CVE-2021-40577A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source
- CVE-2021-24840Squaretype Modern Blog < 3.0.4 - Unauthenticated Private/Schedule Posts DisclosureSquaretype
- CVE-2021-24844Affiliate Manager < 2.8.7 - Admin+ SQL injectionAffiliates Manager
- CVE-2021-24835WCFM - Frontend Manager for WooCommerce < 6.5.12 - Customer/Subscriber+ SQL InjectionWCFM – Frontend Manager for WooCommerce along with Bookings…
- CVE-2021-24832WP SEO Redirect 301 < 2.3.2 - Redirect Deletion via CSRFWP SEO Redirect
- CVE-2021-24829Visitor Traffic Real Time Statistics < 3.9 - Subscriber+ SQL InjectionVisitor Traffic Real Time Statistics
- CVE-2021-24827Asgaros Forum < 1.15.13 - Unauthenticated SQL InjectionAsgaros Forum
- CVE-2021-24816Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File RenamingPhoenix Media Rename
- CVE-2021-24807Support Board < 3.3.5 - Agent+ Stored Cross-Site ScriptingSupport Board
- CVE-2021-24806wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRFComments – wpDiscuz
- CVE-2021-24801WP Survey Plus <= 1.0 - Subscriber+ AJAX CallsWP Survey Plus
- CVE-2021-24798WP Header Images < 2.0.1 - Reflected Cross-Site ScriptingWP Header Images
- CVE-2021-24791Header Footer Code Manager < 1.1.14 - Admin+ SQL InjectionsHeader Footer Code Manager
- CVE-2021-24788Batch Cat <= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to PostsBatch Cat
- CVE-2021-24783Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule DeletionPost Expirator: Automatically Unpublish WordPress Posts
- CVE-2021-24767Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRFRedirect 404 Error Page to Homepage or Custom Page with Logs
- CVE-2021-24766404 to 301 < 3.0.9 - Logs Deletion via CSRF404 to 301 – Redirect, Log and Notify 404 Errors
- CVE-2021-24731Pie Register < 3.7.1.6 - Unauthenticated SQL InjectionRegistration Forms – User profile, Content Restriction, Spa…
- CVE-2021-24721Loco Translate < 2.5.4 - Authenticated PHP Code InjectionLoco Translate
- CVE-2021-24710Print-O-Matic < 2.0.3 - Admin+ Stored Cross-Site ScriptingPrint-O-Matic
- CVE-2021-24708WP All Export < 1.3.1 - Admin+ Stored Cross-Site ScriptingExport any WordPress data to XML/CSV
- CVE-2021-24706Qwizcards < 3.62 - Admin+ Stored Cross Site ScriptingQwizcards – online quizzes and flashcards
- CVE-2021-24701Quiz Tool Lite <= 2.3.15 - Multiple Admin+ Stored Cross-Site ScriptingQuiz Tool Lite
- CVE-2021-24698Simple Download Monitor < 3.9.6 - Arbitrary Thumbnails RemovalSimple Download Monitor
- CVE-2021-24697Simple Download Monitor < 3.9.5 - Reflected Cross-Site ScriptingSimple Download Monitor
- CVE-2021-24695Simple Download Monitor < 3.9.6 - Unauthenticated Log AccessSimple Download Monitor
- CVE-2021-24693Simple Download Monitor < 3.9.5 - Contributor+ Stored Cross-Site Scripting via File ThumbnailSimple Download Monitor
- CVE-2021-24674Genie WP Favicon <= 0.5.2 - Arbitrary Favicon Change via CSRFGenie WP Favicon
- CVE-2021-24669MAZ Loader < 1.3.3 - Contributor+ SQL InjectionMAZ Loader – Preloader Builder for WordPress
- CVE-2021-24664WPSchoolPress < 2.1.17 - Multiple Admin+ Stored Cross-Site ScriptingSchool Management System – WPSchoolPress
- CVE-2021-24647Pie Register < 3.7.1.6 - Unauthenticated Arbitrary LoginRegistration Forms – User profile, Content Restriction, Spa…
- CVE-2021-24646Booking.com Banner Creator < 1.4.3 - Admin+ Stored Cross-Site ScriptingBooking.com Banner Creator
- CVE-2021-24645Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site ScriptingBooking.com Product Helper
- CVE-2021-24631Unlimited PopUps <= 4.5.3 - Author+ SQL InjectionUnlimited PopUps
- CVE-2021-24630Schreikasten <= 0.14.18 - Author+ SQL InjectionsSchreikasten
- CVE-2021-24629Post Content XMLRPC <= 1.0 - Admin+ SQL InjectionsPost Content XMLRPC
- CVE-2021-24628Wow Forms <= 3.1.3 - Admin+ SQL InjectionWow Forms – create any form with custom style
- CVE-2021-24627G Auto-Hyperlink <= 1.0.1 - Admin+ SQL InjectionG Auto-Hyperlink
- CVE-2021-24626Chameleon CSS <= 1.2 - Subscriber+ SQL InjectionChameleon CSS
- CVE-2021-24625SpiderCatalog <= 1.7.3 - Admin+ SQL InjectionSpiderCatalog
- CVE-2021-24616AddToAny Share Buttons < 1.7.48 - Admin+ Stored Cross-Site ScriptingAddToAny Share Buttons
- CVE-2021-24607Storefront Footer Text <= 1.0.1 - Admin+ Stored Cross-Site ScriptingStorefront Footer Text
- CVE-2021-24594Translate WordPress - Google Language Translator < 6.0.12 - Admin+ Stored Cross-Site ScriptingTranslate WordPress – Google Language Translator
- CVE-2021-24575WPSchoolPress < 2.1.10 - Multiple Authenticated SQL InjectionsSchool Management System – WPSchoolPress
- CVE-2021-24537Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code ExecutionSimilar Posts – Best Related Posts Plugin for WordPress
- CVE-2021-29843IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties.IBM MQ Appliance
- CVE-2021-29735IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting.IBM Security Guardium
- CVE-2020-4160IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properlyIBM QRadar Network Security
- CVE-2020-4153IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting.IBM QRadar Network Security
- CVE-2020-4152IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can bIBM QRadar Network Security
- CVE-2021-42770A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication test
- CVE-2021-28024Unauthorized system access in the login form in ServiceTonic Helpdesk software version < 9.0.35937 allows attacker to login without using a
- CVE-2021-28023Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP
- CVE-2021-28022Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially
- CVE-2021-41733Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.
- CVE-2021-22051Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream serviSpring Cloud Gateway · org.springframework.cloud:spring-clo…
- CVE-2021-37850Denial of service in ESET for Mac productsESET, spol. s r.o. ESET Cyber Security · ESET, spol. s r… +1
- CVE-2021-32483Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard.
- CVE-2021-30132Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges.
- CVE-2021-29243Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS.
- CVE-2021-32482Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter.
- CVE-2021-29994Cloudera Hue 4.6.0 allows XSS.
- CVE-2021-32481Cloudera Hue 4.6.0 allows XSS via the type parameter.
- CVE-2021-42370A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML passwo
- CVE-2021-42371lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.
- CVE-2021-42372A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers t
- CVE-2021-42078PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php t
- CVE-2021-42077PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user_manager.php username parameter.
- CVE-2021-42076An issue was discovered in Barrier before 2.3.4.
- CVE-2021-42075An issue was discovered in Barrier before 2.3.4.
- CVE-2021-42074An issue was discovered in Barrier before 2.3.4.
- CVE-2021-42072An issue was discovered in Barrier before 2.4.0.
- CVE-2021-34685UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authen
- CVE-2021-31602An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
- CVE-2021-31600An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.
- CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End stdlib
- CVE-2021-41772Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or astdlib
- CVE-2021-42073An issue was discovered in Barrier before 2.4.0.