# CVEs published 2021-11-10

130 CVEs were published on November 10, 2021: 3 critical, 36 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2021-40873](https://cve.now/CVE-2021-40873.md): An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66, and uaToolkit Embedded before 1.40. (no CVSS)
- [CVE-2021-40872](https://cve.now/CVE-2021-40872.md): An issue was discovered in Softing Industrial Automation uaToolkit Embedded before 1.40. (no CVSS)
- [CVE-2021-40871](https://cve.now/CVE-2021-40871.md): An issue was discovered in Softing Industrial Automation OPC UA C++ SDK before 5.66. (no CVSS)
- [CVE-2021-33618](https://cve.now/CVE-2021-33618.md): Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by \> and \< characters in the onpointermove attribute of a BODY el (no CVSS, dolibarr/dolibarr)
- [CVE-2021-33816](https://cve.now/CVE-2021-33816.md): The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system (no CVSS, dolibarr/dolibarr)
- [CVE-2020-23906](https://cve.now/CVE-2020-23906.md): FFmpeg N-98388-g76a3ee996b allows attackers to cause a denial of service (DoS) via a crafted audio file due to insufficient verification of (no CVSS)
- [CVE-2020-23904](https://cve.now/CVE-2020-23904.md): A stack buffer overflow in speexenc.c of Speex v1.2 allows attackers to cause a denial of service (DoS) via a crafted WAV file. (no CVSS)
- [CVE-2020-23903](https://cve.now/CVE-2020-23903.md): A Divide by Zero vulnerability in the function static int read\_samples of Speex v1.2 allows attackers to cause a denial of service (DoS) via (no CVSS)
- [CVE-2020-23902](https://cve.now/CVE-2020-23902.md): A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. (no CVSS)
- [CVE-2020-23901](https://cve.now/CVE-2020-23901.md): A User Mode Write AV in Editor+0x5d15 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. (no CVSS)
- [CVE-2020-23900](https://cve.now/CVE-2020-23900.md): A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. (no CVSS)
- [CVE-2020-23899](https://cve.now/CVE-2020-23899.md): A User Mode Write AV in Editor+0x5f91 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. (no CVSS)
- [CVE-2020-23898](https://cve.now/CVE-2020-23898.md): A User Mode Write AV in Editor+0x5ea2 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tga file. (no CVSS)
- [CVE-2020-23897](https://cve.now/CVE-2020-23897.md): A User Mode Write AV in Editor!TMethodImplementationIntercept+0x54dcec of WildBit Viewer v6.6 allows attackers to cause a denial of service (no CVSS)
- [CVE-2020-23896](https://cve.now/CVE-2020-23896.md): A User Mode Write AV in Editor+0x576b of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. (no CVSS)
- [CVE-2020-23895](https://cve.now/CVE-2020-23895.md): A User Mode Write AV in Editor+0x76af of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. (no CVSS)
- [CVE-2020-23894](https://cve.now/CVE-2020-23894.md): A User Mode Write AV in ntdll!RtlpCoalesceFreeBlocks+0x268 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a (no CVSS)
- [CVE-2020-23893](https://cve.now/CVE-2020-23893.md): A User Mode Write AV in Editor!TMethodImplementationIntercept+0x3c3682 of WildBit Viewer v6.6 allows attackers to cause a denial of service (no CVSS)
- [CVE-2020-23890](https://cve.now/CVE-2020-23890.md): A buffer overflow in WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted JPG file. (no CVSS)
- [CVE-2020-23891](https://cve.now/CVE-2020-23891.md): A User Mode Write AV in Editor+0x5cd7 of WildBit Viewer v6.6 allows attackers to cause a denial of service (DoS) via a crafted tiff file. (no CVSS)
- [CVE-2020-23889](https://cve.now/CVE-2020-23889.md): A User Mode Write AV starting at Editor!TMethodImplementationIntercept+0x4189c6 of WildBit Viewer v6.6 allows attackers to cause a denial of (no CVSS)
- [CVE-2020-23887](https://cve.now/CVE-2020-23887.md): XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted ico file (no CVSS)
- [CVE-2020-23888](https://cve.now/CVE-2020-23888.md): A User Mode Write AV in Editor!TMethodImplementationIntercept+0x53f6c3 of WildBit Viewer v6.6 allows attackers to cause a denial of service (no CVSS)
- [CVE-2020-23886](https://cve.now/CVE-2020-23886.md): XnView MP v0.96.4 was discovered to contain a heap overflow which allows attackers to cause a denial of service (DoS) via a crafted pict fil (no CVSS)
- [CVE-2020-23884](https://cve.now/CVE-2020-23884.md): A buffer overflow in Nomacs v3.15.0 allows attackers to cause a denial of service (DoS) via a crafted MNG file. (no CVSS)
- [CVE-2020-23879](https://cve.now/CVE-2020-23879.md): pdf2json v0.71 was discovered to contain a NULL pointer dereference in the component ObjectStream::getObject. (no CVSS)
- [CVE-2020-23878](https://cve.now/CVE-2020-23878.md): pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch. (no CVSS)
- [CVE-2020-23876](https://cve.now/CVE-2020-23876.md): pdf2xml v2.0 was discovered to contain a memory leak in the function TextPage::testLinkedText. (no CVSS)
- [CVE-2020-23877](https://cve.now/CVE-2020-23877.md): pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream. (no CVSS)
- [CVE-2020-23874](https://cve.now/CVE-2020-23874.md): pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode. (no CVSS)
- [CVE-2020-23872](https://cve.now/CVE-2020-23872.md): A NULL pointer dereference in the function TextPage::restoreState of pdf2xml v2.0 allows attackers to cause a denial of service (DoS). (no CVSS)
- [CVE-2020-23873](https://cve.now/CVE-2020-23873.md): pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump. (no CVSS)
- [CVE-2021-42111](https://cve.now/CVE-2021-42111.md): An issue was discovered in the RCDevs OpenOTP app 1.4.13 and 1.4.14 for iOS. (CVSS 5.5)
- [CVE-2021-3572](https://cve.now/CVE-2021-3572.md): A flaw was found in python-pip in the way it handled Unicode separators in git references. (no CVSS, python-pip · pip)
- [CVE-2021-22048](https://cve.now/CVE-2021-22048.md): The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. (no CVSS, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-32023](https://cve.now/CVE-2021-32023.md): An elevation of privilege vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could a (no CVSS, BlackBerry Protect for Windows)
- [CVE-2021-32022](https://cve.now/CVE-2021-32022.md): A low privileged delete vulnerability using CEF RPC server of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allo (no CVSS, BlackBerry Protect for Windows)
- [CVE-2021-32021](https://cve.now/CVE-2021-32021.md): A denial of service vulnerability in the message broker of BlackBerry Protect for Windows version(s) versions 1574 and earlier could allow a (no CVSS, BlackBerry Protect for Windows)
- [CVE-2021-3064](https://cve.now/CVE-2021-3064.md): PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces (CVSS 9.8, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3063](https://cve.now/CVE-2021-3063.md): PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces (CVSS 7.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3062](https://cve.now/CVE-2021-3062.md): PAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect Users (CVSS 8.1, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3061](https://cve.now/CVE-2021-3061.md): PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI) (CVSS 6.4, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3060](https://cve.now/CVE-2021-3060.md): PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP) (CVSS 8.1, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3059](https://cve.now/CVE-2021-3059.md): PAN-OS: OS Command Injection Vulnerability When Performing Dynamic Updates (CVSS 8.1, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3058](https://cve.now/CVE-2021-3058.md): PAN-OS: OS Command Injection Vulnerability in Web Interface XML API (CVSS 8.8, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-3056](https://cve.now/CVE-2021-3056.md): PAN-OS: Memory Corruption Vulnerability in GlobalProtect Clientless VPN During SAML Authentication (CVSS 8.8, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Access)
- [CVE-2021-41038](https://cve.now/CVE-2021-41038.md): In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage(). (no CVSS, The Eclipse Foundation @theia/plugin-ext · @theia/plugin-ext)
- [CVE-2021-3380](https://cve.now/CVE-2021-3380.md): Insecure direct object reference (IDOR) vulnerability in ICREM H8 SSRMS allows attackers to disclose sensitive information via the Print Inv (no CVSS)
- [CVE-2020-28137](https://cve.now/CVE-2020-28137.md): Cross site request forgery (CSRF) in Genexis Platinum 4410 V2-1.28, allows attackers to cause a denial of service by continuously restarting (no CVSS)
- [CVE-2021-40520](https://cve.now/CVE-2021-40520.md): Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials. (no CVSS)
- [CVE-2021-40517](https://cve.now/CVE-2021-40517.md): Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. (no CVSS)
- [CVE-2021-40519](https://cve.now/CVE-2021-40519.md): Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials. (no CVSS)
- [CVE-2021-40521](https://cve.now/CVE-2021-40521.md): Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution. (no CVSS)
- [CVE-2021-40518](https://cve.now/CVE-2021-40518.md): Airangel HSMX Gateway devices through 5.2.04 allow CSRF. (no CVSS)
- [CVE-2020-12488](https://cve.now/CVE-2020-12488.md): Broken Access Control Vulnerability in Jovi Smart Scene (CVSS 5.5, vivo Jovi Smart Scene)
- [CVE-2021-41426](https://cve.now/CVE-2021-41426.md): Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt\_end\_user.htm. (no CVSS)
- [CVE-2021-41427](https://cve.now/CVE-2021-41427.md): Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose\_mac parameter to setup.cgi. (no CVSS)
- [CVE-2021-42062](https://cve.now/CVE-2021-42062.md): SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area (no CVSS, SAP SE SAP ERP HCM Portugal)
- [CVE-2021-40504](https://cve.now/CVE-2021-40504.md): A certain template role in SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 710, 711, 730, 731, 740, 75 (no CVSS, SAP SE SAP NetWeaver AS for ABAP and ABAP Platform)
- [CVE-2021-40503](https://cve.now/CVE-2021-40503.md): An information disclosure vulnerability exists in SAP GUI for Windows - versions \< 7.60 PL13, 7.70 PL4, which allows an attacker with suffic (no CVSS, SAP SE SAP GUI for Windows)
- [CVE-2021-40502](https://cve.now/CVE-2021-40502.md): SAP Commerce - versions 2105.3, 2011.13, 2005.18, 1905.34, does not perform necessary authorization checks for an authenticated user, result (no CVSS, SAP SE SAP Commerce)
- [CVE-2021-40501](https://cve.now/CVE-2021-40501.md): SAP ABAP Platform Kernel - versions 7.77, 7.81, 7.85, 7.86, does not perform necessary authorization checks for an authenticated business us (no CVSS, SAP SE SAP ABAP Platform Kernel)
- [CVE-2021-43564](https://cve.now/CVE-2021-43564.md): An issue was discovered in the jobfair (aka Job Fair) extension before 1.0.13 and 2.x before 2.0.2 for TYPO3. (no CVSS, hov/jobfair)
- [CVE-2021-43563](https://cve.now/CVE-2021-43563.md): An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. (no CVSS)
- [CVE-2021-43562](https://cve.now/CVE-2021-43562.md): An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. (no CVSS)
- [CVE-2021-43561](https://cve.now/CVE-2021-43561.md): An XSS issue was discovered in the google\_for\_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. (no CVSS, pegasus/google-for-jobs)
- [CVE-2021-38887](https://cve.now/CVE-2021-38887.md): IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information from application response requests (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2021-43523](https://cve.now/CVE-2021-43523.md): In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, g (CVSS 9.6)
- [CVE-2021-39474](https://cve.now/CVE-2021-39474.md): Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. (no CVSS)
- [CVE-2021-34598](https://cve.now/CVE-2021-34598.md): Phoenix Contact: FL MGUARD lack of memory release in remote logging functionality (CVSS 7.5, PHOENIX CONTACT FL MGUARD)
- [CVE-2021-34582](https://cve.now/CVE-2021-34582.md): Phoenix Contact: FL MGUARD XSS through web-based management and REST API (CVSS 4.8, PHOENIX CONTACT FL MGUARD)
- [CVE-2021-25975](https://cve.now/CVE-2021-25975.md): Publify - Stored Cross-Site Scripting (XSS) due to Unrestricted File Upload (CVSS 5.4, publify\_core)
- [CVE-2021-25974](https://cve.now/CVE-2021-25974.md): Publify - Stored Cross-Site Scripting (XSS) in Editor (CVSS 5.4, publify\_core)
- [CVE-2021-43136](https://cve.now/CVE-2021-43136.md): An authentication bypass issue in FormaLMS \<= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t (no CVSS)
- [CVE-2021-31853](https://cve.now/CVE-2021-31853.md): MDE DLL Search Order Hijacking vulnerability (CVSS 7.8, McAfee Drive Encryption)
- [CVE-2021-22870](https://cve.now/CVE-2021-22870.md): Path traversal in GitHub Enterprise Server hosted Pages leads to unauthorized file read access (no CVSS, GitHub Enterprise Server)
- [CVE-2021-43209](https://cve.now/CVE-2021-43209.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2021-43208](https://cve.now/CVE-2021-43208.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2021-42323](https://cve.now/CVE-2021-42323.md): Azure RTOS Information Disclosure Vulnerability (CVSS 3.3, Microsoft Azure Real Time Operating System)
- [CVE-2021-42322](https://cve.now/CVE-2021-42322.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-42321](https://cve.now/CVE-2021-42321.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, KEV, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2021-42319](https://cve.now/CVE-2021-42319.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 4.7, Microsoft Visual Studio)
- [CVE-2021-42316](https://cve.now/CVE-2021-42316.md): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Dynamics 365 (on-premises))
- [CVE-2021-42305](https://cve.now/CVE-2021-42305.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-42304](https://cve.now/CVE-2021-42304.md): Azure RTOS Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Azure Real Time Operating System)
- [CVE-2021-42303](https://cve.now/CVE-2021-42303.md): Azure RTOS Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Azure Real Time Operating System)
- [CVE-2021-42302](https://cve.now/CVE-2021-42302.md): Azure RTOS Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Azure Real Time Operating System)
- [CVE-2021-42301](https://cve.now/CVE-2021-42301.md): Azure RTOS Information Disclosure Vulnerability (CVSS 3.3, Microsoft Azure Real Time Operating System)
- [CVE-2021-42300](https://cve.now/CVE-2021-42300.md): Azure Sphere Tampering Vulnerability (CVSS 6.0, Microsoft Azure Sphere)
- [CVE-2021-42298](https://cve.now/CVE-2021-42298.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2021-42296](https://cve.now/CVE-2021-42296.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2021-42292](https://cve.now/CVE-2021-42292.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 7.8, KEV, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +3)
- [CVE-2021-42291](https://cve.now/CVE-2021-42291.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-42288](https://cve.now/CVE-2021-42288.md): Windows Hello Security Feature Bypass Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2021-42287](https://cve.now/CVE-2021-42287.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.5, KEV, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-42286](https://cve.now/CVE-2021-42286.md): Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-42285](https://cve.now/CVE-2021-42285.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-42284](https://cve.now/CVE-2021-42284.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-42283](https://cve.now/CVE-2021-42283.md): NTFS Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-42282](https://cve.now/CVE-2021-42282.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-42280](https://cve.now/CVE-2021-42280.md): Windows Feedback Hub Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-42279](https://cve.now/CVE-2021-42279.md): Chakra Scripting Engine Memory Corruption Vulnerability (CVSS 4.2, Microsoft ChakraCore · Microsoft Windows +1)
- [CVE-2021-42278](https://cve.now/CVE-2021-42278.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.5, KEV, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2021-42277](https://cve.now/CVE-2021-42277.md): Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Visual Studio 2015 Update · Microsoft Visual S… +1)
- [CVE-2021-42276](https://cve.now/CVE-2021-42276.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-42275](https://cve.now/CVE-2021-42275.md): Microsoft COM for Windows Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2021-42274](https://cve.now/CVE-2021-42274.md): Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2021-41379](https://cve.now/CVE-2021-41379.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 5.5, KEV, Microsoft Windows)
- [CVE-2021-41378](https://cve.now/CVE-2021-41378.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-41377](https://cve.now/CVE-2021-41377.md): Windows Fast FAT File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-41376](https://cve.now/CVE-2021-41376.md): Azure Sphere Information Disclosure Vulnerability (CVSS 2.3, Microsoft Azure Sphere)
- [CVE-2021-41375](https://cve.now/CVE-2021-41375.md): Azure Sphere Information Disclosure Vulnerability (CVSS 4.4, Microsoft Azure Sphere)
- [CVE-2021-41374](https://cve.now/CVE-2021-41374.md): Azure Sphere Information Disclosure Vulnerability (CVSS 6.7, Microsoft Azure Sphere)
- [CVE-2021-41373](https://cve.now/CVE-2021-41373.md): FSLogix Information Disclosure Vulnerability (CVSS 5.5, Microsoft FSLogix)
- [CVE-2021-41372](https://cve.now/CVE-2021-41372.md): Power BI Report Server Spoofing Vulnerability (CVSS 7.6, Microsoft Power BI Report Server)
- [CVE-2021-41371](https://cve.now/CVE-2021-41371.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-41370](https://cve.now/CVE-2021-41370.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-41368](https://cve.now/CVE-2021-41368.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 6.1, Microsoft 365 Apps for Enterprise · Microsoft Office 201… +1)
- [CVE-2021-41367](https://cve.now/CVE-2021-41367.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-41366](https://cve.now/CVE-2021-41366.md): Credential Security Support Provider Protocol (CredSSP) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-41356](https://cve.now/CVE-2021-41356.md): Windows Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-41351](https://cve.now/CVE-2021-41351.md): Microsoft Edge (Chrome based) Spoofing on IE Mode (CVSS 4.3, Microsoft Edge (Chromium-based) in IE Mode)
- [CVE-2021-41349](https://cve.now/CVE-2021-41349.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 6.5, Microsoft Exchange Server 2013 Cumulative Update · Micro… +1)
- [CVE-2021-40442](https://cve.now/CVE-2021-40442.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel 2013… +3)
- [CVE-2021-38666](https://cve.now/CVE-2021-38666.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2021-38665](https://cve.now/CVE-2021-38665.md): Remote Desktop Protocol Client Information Disclosure Vulnerability (CVSS 7.4, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2021-38631](https://cve.now/CVE-2021-38631.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2021-36957](https://cve.now/CVE-2021-36957.md): Windows Desktop Bridge Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-26444](https://cve.now/CVE-2021-26444.md): Azure RTOS Information Disclosure Vulnerability (CVSS 3.3, Microsoft Azure Real Time Operating System)
- [CVE-2021-26443](https://cve.now/CVE-2021-26443.md): Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Windows)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.