# CVEs published 2021-11-08

89 CVEs were published on November 8, 2021: 3 critical, 3 high. Days are UTC.

- [CVE-2021-41253](https://cve.now/CVE-2021-41253.md): Possible heap buffer overflow when using zycore string functions in formatter hooks (CVSS 5.9, zyantific zydis)
- [CVE-2020-23572](https://cve.now/CVE-2020-23572.md): BEESCMS v4.0 was discovered to contain an arbitrary file upload vulnerability via the component /admin/upload.php. (no CVSS)
- [CVE-2021-40261](https://cve.now/CVE-2021-40261.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user\_username (no CVSS)
- [CVE-2021-40260](https://cve.now/CVE-2021-40260.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit. (no CVSS)
- [CVE-2021-41170](https://cve.now/CVE-2021-41170.md): Evaluation of closures can lead to execution of methods & functions in current program scope (CVSS 9.8, sroehrl neoan3-template · neoan3-apps/template)
- [CVE-2021-39420](https://cve.now/CVE-2021-39420.md): Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search\_all.php and the (2) msg paramet (no CVSS)
- [CVE-2021-40577](https://cve.now/CVE-2021-40577.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source (no CVSS)
- [CVE-2021-24840](https://cve.now/CVE-2021-24840.md): Squaretype Modern Blog \< 3.0.4 - Unauthenticated Private/Schedule Posts Disclosure (no CVSS, Squaretype)
- [CVE-2021-24844](https://cve.now/CVE-2021-24844.md): Affiliate Manager \< 2.8.7 - Admin+ SQL injection (no CVSS, Affiliates Manager)
- [CVE-2021-24835](https://cve.now/CVE-2021-24835.md): WCFM - Frontend Manager for WooCommerce \< 6.5.12 - Customer/Subscriber+ SQL Injection (no CVSS, WCFM – Frontend Manager for WooCommerce along with Bookings…)
- [CVE-2021-24832](https://cve.now/CVE-2021-24832.md): WP SEO Redirect 301 \< 2.3.2 - Redirect Deletion via CSRF (no CVSS, WP SEO Redirect)
- [CVE-2021-24829](https://cve.now/CVE-2021-24829.md): Visitor Traffic Real Time Statistics \< 3.9 - Subscriber+ SQL Injection (no CVSS, Visitor Traffic Real Time Statistics)
- [CVE-2021-24827](https://cve.now/CVE-2021-24827.md): Asgaros Forum \< 1.15.13 - Unauthenticated SQL Injection (no CVSS, Asgaros Forum)
- [CVE-2021-24816](https://cve.now/CVE-2021-24816.md): Phoenix Media Rename \< 3.4.4 - Author Arbitrary Media File Renaming (no CVSS, Phoenix Media Rename)
- [CVE-2021-24807](https://cve.now/CVE-2021-24807.md): Support Board \< 3.3.5 - Agent+ Stored Cross-Site Scripting (no CVSS, Support Board)
- [CVE-2021-24806](https://cve.now/CVE-2021-24806.md): wpDiscuz \< 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF (no CVSS, Comments – wpDiscuz)
- [CVE-2021-24801](https://cve.now/CVE-2021-24801.md): WP Survey Plus \<= 1.0 - Subscriber+ AJAX Calls (no CVSS, WP Survey Plus)
- [CVE-2021-24798](https://cve.now/CVE-2021-24798.md): WP Header Images \< 2.0.1 - Reflected Cross-Site Scripting (no CVSS, WP Header Images)
- [CVE-2021-24791](https://cve.now/CVE-2021-24791.md): Header Footer Code Manager \< 1.1.14 - Admin+ SQL Injections (no CVSS, Header Footer Code Manager)
- [CVE-2021-24788](https://cve.now/CVE-2021-24788.md): Batch Cat \<= 0.3 - Subscriber+ Arbitrary Categories Add/Set/Delete to Posts (no CVSS, Batch Cat)
- [CVE-2021-24783](https://cve.now/CVE-2021-24783.md): Post Expirator \< 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion (no CVSS, Post Expirator: Automatically Unpublish WordPress Posts)
- [CVE-2021-24767](https://cve.now/CVE-2021-24767.md): Redirect 404 Error Page to Homepage or Custom Page with Logs \< 1.7.9 - Log Deletion via CSRF (no CVSS, Redirect 404 Error Page to Homepage or Custom Page with Logs)
- [CVE-2021-24766](https://cve.now/CVE-2021-24766.md): 404 to 301 \< 3.0.9 - Logs Deletion via CSRF (no CVSS, 404 to 301 – Redirect, Log and Notify 404 Errors)
- [CVE-2021-24731](https://cve.now/CVE-2021-24731.md): Pie Register \< 3.7.1.6 - Unauthenticated SQL Injection (no CVSS, Registration Forms – User profile, Content Restriction, Spa…)
- [CVE-2021-24721](https://cve.now/CVE-2021-24721.md): Loco Translate \< 2.5.4 - Authenticated PHP Code Injection (no CVSS, Loco Translate)
- [CVE-2021-24710](https://cve.now/CVE-2021-24710.md): Print-O-Matic \< 2.0.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Print-O-Matic)
- [CVE-2021-24708](https://cve.now/CVE-2021-24708.md): WP All Export \< 1.3.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Export any WordPress data to XML/CSV)
- [CVE-2021-24706](https://cve.now/CVE-2021-24706.md): Qwizcards \< 3.62 - Admin+ Stored Cross Site Scripting (no CVSS, Qwizcards – online quizzes and flashcards)
- [CVE-2021-24701](https://cve.now/CVE-2021-24701.md): Quiz Tool Lite \<= 2.3.15 - Multiple Admin+ Stored Cross-Site Scripting (no CVSS, Quiz Tool Lite)
- [CVE-2021-24698](https://cve.now/CVE-2021-24698.md): Simple Download Monitor \< 3.9.6 - Arbitrary Thumbnails Removal (no CVSS, Simple Download Monitor)
- [CVE-2021-24697](https://cve.now/CVE-2021-24697.md): Simple Download Monitor \< 3.9.5 - Reflected Cross-Site Scripting (no CVSS, Simple Download Monitor)
- [CVE-2021-24695](https://cve.now/CVE-2021-24695.md): Simple Download Monitor \< 3.9.6 - Unauthenticated Log Access (no CVSS, Simple Download Monitor)
- [CVE-2021-24693](https://cve.now/CVE-2021-24693.md): Simple Download Monitor \< 3.9.5 - Contributor+ Stored Cross-Site Scripting via File Thumbnail (no CVSS, Simple Download Monitor)
- [CVE-2021-24674](https://cve.now/CVE-2021-24674.md): Genie WP Favicon \<= 0.5.2 - Arbitrary Favicon Change via CSRF (no CVSS, Genie WP Favicon)
- [CVE-2021-24669](https://cve.now/CVE-2021-24669.md): MAZ Loader \< 1.3.3 - Contributor+ SQL Injection (no CVSS, MAZ Loader – Preloader Builder for WordPress)
- [CVE-2021-24664](https://cve.now/CVE-2021-24664.md): WPSchoolPress \< 2.1.17 - Multiple Admin+ Stored Cross-Site Scripting (no CVSS, School Management System – WPSchoolPress)
- [CVE-2021-24647](https://cve.now/CVE-2021-24647.md): Pie Register \< 3.7.1.6 - Unauthenticated Arbitrary Login (no CVSS, Registration Forms – User profile, Content Restriction, Spa…)
- [CVE-2021-24646](https://cve.now/CVE-2021-24646.md): Booking.com Banner Creator \< 1.4.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Booking.com Banner Creator)
- [CVE-2021-24645](https://cve.now/CVE-2021-24645.md): Booking.com Product Helper \< 1.0.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Booking.com Product Helper)
- [CVE-2021-24631](https://cve.now/CVE-2021-24631.md): Unlimited PopUps \<= 4.5.3 - Author+ SQL Injection (no CVSS, Unlimited PopUps)
- [CVE-2021-24630](https://cve.now/CVE-2021-24630.md): Schreikasten \<= 0.14.18 - Author+ SQL Injections (no CVSS, Schreikasten)
- [CVE-2021-24629](https://cve.now/CVE-2021-24629.md): Post Content XMLRPC \<= 1.0 - Admin+ SQL Injections (no CVSS, Post Content XMLRPC)
- [CVE-2021-24628](https://cve.now/CVE-2021-24628.md): Wow Forms \<= 3.1.3 - Admin+ SQL Injection (no CVSS, Wow Forms – create any form with custom style)
- [CVE-2021-24627](https://cve.now/CVE-2021-24627.md): G Auto-Hyperlink \<= 1.0.1 - Admin+ SQL Injection (no CVSS, G Auto-Hyperlink)
- [CVE-2021-24626](https://cve.now/CVE-2021-24626.md): Chameleon CSS \<= 1.2 - Subscriber+ SQL Injection (no CVSS, Chameleon CSS)
- [CVE-2021-24625](https://cve.now/CVE-2021-24625.md): SpiderCatalog \<= 1.7.3 - Admin+ SQL Injection (no CVSS, SpiderCatalog)
- [CVE-2021-24616](https://cve.now/CVE-2021-24616.md): AddToAny Share Buttons \< 1.7.48 - Admin+ Stored Cross-Site Scripting (no CVSS, AddToAny Share Buttons)
- [CVE-2021-24607](https://cve.now/CVE-2021-24607.md): Storefront Footer Text \<= 1.0.1 - Admin+ Stored Cross-Site Scripting (no CVSS, Storefront Footer Text)
- [CVE-2021-24594](https://cve.now/CVE-2021-24594.md): Translate WordPress - Google Language Translator \< 6.0.12 - Admin+ Stored Cross-Site Scripting (no CVSS, Translate WordPress – Google Language Translator)
- [CVE-2021-24575](https://cve.now/CVE-2021-24575.md): WPSchoolPress \< 2.1.10 - Multiple Authenticated SQL Injections (no CVSS, School Management System – WPSchoolPress)
- [CVE-2021-24537](https://cve.now/CVE-2021-24537.md): Similar Posts \<= 3.1.5 - Admin+ Arbitrary PHP Code Execution (no CVSS, Similar Posts – Best Related Posts Plugin for WordPress)
- [CVE-2021-29843](https://cve.now/CVE-2021-29843.md): IBM MQ 9.1 LTS, 9.1 CD, 9.2 LTS, and 9.2CD is vulnerable to a denial of service attack caused by an issue processing message properties. (CVSS 5.3, IBM MQ Appliance)
- [CVE-2021-29735](https://cve.now/CVE-2021-29735.md): IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, and 11.3 is vulnerable to cross-site scripting. (CVSS 4.8, IBM Security Guardium)
- [CVE-2020-4160](https://cve.now/CVE-2020-4160.md): IBM QRadar Network Security 5.4.0 and 5.5.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly (CVSS 5.9, IBM QRadar Network Security)
- [CVE-2020-4153](https://cve.now/CVE-2020-4153.md): IBM QRadar Network Security 5.4.0 and 5.5.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar Network Security)
- [CVE-2020-4152](https://cve.now/CVE-2020-4152.md): IBM QRadar Network Security 5.4.0 and 5.5.0 transmits sensitive or security-critical data in cleartext in a communication channel that can b (CVSS 6.8, IBM QRadar Network Security)
- [CVE-2021-42770](https://cve.now/CVE-2021-42770.md): A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication test (no CVSS)
- [CVE-2021-28024](https://cve.now/CVE-2021-28024.md): Unauthorized system access in the login form in ServiceTonic Helpdesk software version \< 9.0.35937 allows attacker to login without using a (no CVSS)
- [CVE-2021-28023](https://cve.now/CVE-2021-28023.md): Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version \< 9.0.35937 allows a malicious user to execute JSP (no CVSS)
- [CVE-2021-28022](https://cve.now/CVE-2021-28022.md): Blind SQL injection in the login form in ServiceTonic Helpdesk software \< 9.0.35937 allows attacker to exfiltrate information via specially (no CVSS)
- [CVE-2021-25979](https://cve.now/CVE-2021-25979.md): Apostrophe - Insufficient Session Expiration (CVSS 9.8, Apostrophe)
- [CVE-2021-39182](https://cve.now/CVE-2021-39182.md): Use of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.py (CVSS 7.5, Morgan-Phoenix EnroCrypt · enrocrypt)
- [CVE-2021-41733](https://cve.now/CVE-2021-41733.md): Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them. (no CVSS)
- [CVE-2021-22051](https://cve.now/CVE-2021-22051.md): Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream servi (no CVSS, Spring Cloud Gateway · org.springframework.cloud:spring-clo…)
- [CVE-2021-37850](https://cve.now/CVE-2021-37850.md): Denial of service in ESET for Mac products (CVSS 5.5, ESET, spol. s r.o. ESET Cyber Security · ESET, spol. s r… +1)
- [CVE-2021-32483](https://cve.now/CVE-2021-32483.md): Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges to view the restricted Dashboard. (no CVSS)
- [CVE-2021-30132](https://cve.now/CVE-2021-30132.md): Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. (no CVSS)
- [CVE-2021-29243](https://cve.now/CVE-2021-29243.md): Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS. (no CVSS)
- [CVE-2021-32482](https://cve.now/CVE-2021-32482.md): Cloudera Manager 5.x, 6.x, 7.1.x, 7.2.x, and 7.3.x allows XSS via the path parameter. (no CVSS)
- [CVE-2021-29994](https://cve.now/CVE-2021-29994.md): Cloudera Hue 4.6.0 allows XSS. (no CVSS)
- [CVE-2021-32481](https://cve.now/CVE-2021-32481.md): Cloudera Hue 4.6.0 allows XSS via the type parameter. (no CVSS)
- [CVE-2021-42370](https://cve.now/CVE-2021-42370.md): A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML passwo (no CVSS)
- [CVE-2021-42371](https://cve.now/CVE-2021-42371.md): lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30. (no CVSS)
- [CVE-2021-42372](https://cve.now/CVE-2021-42372.md): A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers t (no CVSS)
- [CVE-2021-42078](https://cve.now/CVE-2021-42078.md): PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events\_manager.php t (no CVSS)
- [CVE-2021-42077](https://cve.now/CVE-2021-42077.md): PHP Event Calendar before 2021-09-03 allows SQL injection, as demonstrated by the /server/ajax/user\_manager.php username parameter. (no CVSS)
- [CVE-2021-42076](https://cve.now/CVE-2021-42076.md): An issue was discovered in Barrier before 2.3.4. (no CVSS)
- [CVE-2021-42075](https://cve.now/CVE-2021-42075.md): An issue was discovered in Barrier before 2.3.4. (no CVSS)
- [CVE-2021-42074](https://cve.now/CVE-2021-42074.md): An issue was discovered in Barrier before 2.3.4. (no CVSS)
- [CVE-2021-42072](https://cve.now/CVE-2021-42072.md): An issue was discovered in Barrier before 2.4.0. (no CVSS)
- [CVE-2021-34685](https://cve.now/CVE-2021-34685.md): UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files, which allows an authen (CVSS 2.7)
- [CVE-2021-34684](https://cve.now/CVE-2021-34684.md): Hitachi Vantara Pentaho Business Analytics through 9.1 allows an unauthenticated user to execute arbitrary SQL queries on any Pentaho data s (CVSS 9.8)
- [CVE-2021-31602](https://cve.now/CVE-2021-31602.md): An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. (CVSS 5.3)
- [CVE-2021-31601](https://cve.now/CVE-2021-31601.md): An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. (CVSS 7.1)
- [CVE-2021-31600](https://cve.now/CVE-2021-31600.md): An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. (CVSS 4.3)
- [CVE-2021-31599](https://cve.now/CVE-2021-31599.md): An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x. (CVSS 8.8)
- [CVE-2021-41771](https://cve.now/CVE-2021-41771.md): ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End (no CVSS, stdlib)
- [CVE-2021-41772](https://cve.now/CVE-2021-41772.md): Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or a (no CVSS, stdlib)
- [CVE-2021-42073](https://cve.now/CVE-2021-42073.md): An issue was discovered in Barrier before 2.4.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.