CVEs published November 10, 2021
130 CVEs were published on November 10, 2021: 3 critical, 36 high. 5 are now in CISA KEV.
- Published
- 130
- Critical
- 3
- High
- 36
- Medium
- 28
- Low
- 4
- Unrated
- 59
- Now in CISA KEV
- 5
- Fix available
- 75
Most affected products
- Microsoft Windows
- 20
- Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- 8
- Microsoft Azure Real Time Operating System
- 6
- Microsoft Azure Sphere
- 4
- Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1
- 4
- BlackBerry Protect for Windows
- 3
- dolibarr/dolibarr
- 2
- Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +3
- 2
- Microsoft 3D Viewer
- 2
- Microsoft Exchange Server 2013 Cumulative Update · Micro… +1
- 2
Critical 3
- CVE-2021-3064PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway InterfacesPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-43523In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, g
- CVE-2021-26443Microsoft Virtual Machine Bus (VMBus) Remote Code Execution VulnerabilityMicrosoft Windows
High 36
- CVE-2021-3063PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway InterfacesPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-3062PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect UsersPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-3060PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-3059PAN-OS: OS Command Injection Vulnerability When Performing Dynamic UpdatesPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-3058PAN-OS: OS Command Injection Vulnerability in Web Interface XML APIPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-3056PAN-OS: Memory Corruption Vulnerability in GlobalProtect Clientless VPN During SAML AuthenticationPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-34598Phoenix Contact: FL MGUARD lack of memory release in remote logging functionalityPHOENIX CONTACT FL MGUARD
- CVE-2021-31853MDE DLL Search Order Hijacking vulnerabilityMcAfee Drive Encryption
- CVE-2021-432093D Viewer Remote Code Execution VulnerabilityMicrosoft 3D Viewer
- CVE-2021-432083D Viewer Remote Code Execution VulnerabilityMicrosoft 3D Viewer
- CVE-2021-42322Visual Studio Code Elevation of Privilege VulnerabilityMicrosoft Visual Studio Code
- CVE-2021-42321Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2021-42316Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2021-42298Microsoft Defender Remote Code Execution VulnerabilityMicrosoft Malware Protection Engine
- CVE-2021-42296Microsoft Word Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2021-42292Microsoft Excel Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2013… +3
- CVE-2021-42291Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-42287Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-42286Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-42285Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-42283NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-42282Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-42278Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-42276Microsoft Windows Media Foundation Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-42275Microsoft COM for Windows Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-41378Windows NTFS Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-41377Windows Fast FAT File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41372Power BI Report Server Spoofing VulnerabilityMicrosoft Power BI Report Server
- CVE-2021-41370NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41367NTFS Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41366Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41356Windows Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-40442Microsoft Excel Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Excel 2013… +3
- CVE-2021-38666Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2021-38665Remote Desktop Protocol Client Information Disclosure VulnerabilityMicrosoft Remote Desktop client for Windows Desktop · Micro…
- CVE-2021-36957Windows Desktop Bridge Elevation of Privilege VulnerabilityMicrosoft Windows
Medium, low and unrated 91
- CVE-2021-40873An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40.
- CVE-2021-40872An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40.
- CVE-2021-40871An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66.
- CVE-2021-33618Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY eldolibarr/dolibarr
- CVE-2021-33816The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which systemdolibarr/dolibarr
- CVE-2020-23906FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of
- CVE-2020-23904A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file.
- CVE-2020-23903A Divide by Zero vulnerability in the function static int read_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via
- CVE-2020-23902A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- CVE-2020-23901A User Mode Write AV in Editor+0x5d15 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- CVE-2020-23900A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- CVE-2020-23899A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- CVE-2020-23898A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file.
- CVE-2020-23897A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service
- CVE-2020-23896A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- CVE-2020-23895A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- CVE-2020-23894A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a
- CVE-2020-23893A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service
- CVE-2020-23890A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file.
- CVE-2020-23891A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file.
- CVE-2020-23889A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of
- CVE-2020-23887XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted ico file
- CVE-2020-23888A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service
- CVE-2020-23886XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict fil
- CVE-2020-23884A buffer overflow in Nomacs v3.15.0 allows attackers to cause a denial of service (DoS) via a crafted MNG file.
- CVE-2020-23879pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject.
- CVE-2020-23878pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.
- CVE-2020-23876pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText.
- CVE-2020-23877pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.
- CVE-2020-23874pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.
- CVE-2020-23872A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS).
- CVE-2020-23873pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.
- CVE-2021-42111An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS.
- CVE-2021-3572A flaw was found in python-pip in the way it handled Unicode separators in git references.python-pip · pip
- CVE-2021-22048The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.VMware vCenter Server and VMware Cloud Foundation
- CVE-2021-32023An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could aBlackBerry Protect for Windows
- CVE-2021-32022A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows version(s) versions 1574 and earlier could alloBlackBerry Protect for Windows
- CVE-2021-32021A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow aBlackBerry Protect for Windows
- CVE-2021-3061PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI)Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access
- CVE-2021-41038In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().The Eclipse Foundation @theia/plugin-ext · @theia/plugin-ext
- CVE-2021-3380Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Inv
- CVE-2020-28137Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting
- CVE-2021-40520Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.
- CVE-2021-40517Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting.
- CVE-2021-40519Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.
- CVE-2021-40521Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.
- CVE-2021-40518Airangel HSMX Gateway devices through 5.2.04 allow CSRF.
- CVE-2020-12488Broken Access Control Vulnerability in Jovi Smart Scenevivo Jovi Smart Scene
- CVE-2021-41426Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.
- CVE-2021-41427Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.
- CVE-2021-42062SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain areaSAP SE SAP ERP HCM Portugal
- CVE-2021-40504A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 75SAP SE SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2021-40503An information disclosure vulnerability exists in SAP GUI for Windows - versions < 7.60 PL13, 7.70 PL4, which allows an attacker with sufficSAP SE SAP GUI for Windows
- CVE-2021-40502SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, resultSAP SE SAP Commerce
- CVE-2021-40501SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business usSAP SE SAP ABAP Platform Kernel
- CVE-2021-43564An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3.hov/jobfair
- CVE-2021-43563An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.
- CVE-2021-43562An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3.
- CVE-2021-43561An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3.pegasus/google-for-jobs
- CVE-2021-38887IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information from application response requests IBM InfoSphere Information Server
- CVE-2021-39474Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009.
- CVE-2021-34582Phoenix Contact: FL MGUARD XSS through web-based management and REST APIPHOENIX CONTACT FL MGUARD
- CVE-2021-25975Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Uploadpublify_core
- CVE-2021-25974Publify - Stored Cross-Site Scripting (XSS) in Editorpublify_core
- CVE-2021-43136An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t
- CVE-2021-22870Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read accessGitHub Enterprise Server
- CVE-2021-42323Azure RTOS Information Disclosure VulnerabilityMicrosoft Azure Real Time Operating System
- CVE-2021-42319Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2021-42305Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-42304Azure RTOS Elevation of Privilege VulnerabilityMicrosoft Azure Real Time Operating System
- CVE-2021-42303Azure RTOS Elevation of Privilege VulnerabilityMicrosoft Azure Real Time Operating System
- CVE-2021-42302Azure RTOS Elevation of Privilege VulnerabilityMicrosoft Azure Real Time Operating System
- CVE-2021-42301Azure RTOS Information Disclosure VulnerabilityMicrosoft Azure Real Time Operating System
- CVE-2021-42300Azure Sphere Tampering VulnerabilityMicrosoft Azure Sphere
- CVE-2021-42288Windows Hello Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2021-42284Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-42280Windows Feedback Hub Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-42279Chakra Scripting Engine Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Windows +1
- CVE-2021-42277Diagnostics Hub Standard Collector Elevation of Privilege VulnerabilityMicrosoft Visual Studio 2015 Update · Microsoft Visual S… +1
- CVE-2021-42274Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-41379Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41376Azure Sphere Information Disclosure VulnerabilityMicrosoft Azure Sphere
- CVE-2021-41375Azure Sphere Information Disclosure VulnerabilityMicrosoft Azure Sphere
- CVE-2021-41374Azure Sphere Information Disclosure VulnerabilityMicrosoft Azure Sphere
- CVE-2021-41373FSLogix Information Disclosure VulnerabilityMicrosoft FSLogix
- CVE-2021-41371Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-41368Microsoft Access Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 201… +1
- CVE-2021-41351Microsoft Edge (Chrome based) Spoofing on IE ModeMicrosoft Edge (Chromium-based) in IE Mode
- CVE-2021-41349Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-38631Windows Remote Desktop Protocol (RDP) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2021-26444Azure RTOS Information Disclosure VulnerabilityMicrosoft Azure Real Time Operating System