CVEs published November 11, 2021
23 CVEs were published on November 11, 2021: 0 critical, 4 high.
- Published
- 23
- Critical
- 0
- High
- 4
- Medium
- 7
- Low
- 2
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Cloudflare octorpki · github.com/cloudflare/cfrpki
- 6
- Apache Software Foundation Apache ShardingSphere-UI
- 1
- Apache Software Foundation Apache Traffic Control · github.…
- 1
- debiki talkyard
- 1
- Zoom Video Communications Keybase Client for Android · Zoom…
- 1
- Zoom Video Communications Keybase Client for Windows
- 1
- Zoom Video Communications Zoom Client for Meetings for Ubun…
- 1
- Zoom Video Communications Zoom Client for Meetings for Wind…
- 1
- Zoom Video Communications Zoom On-Premise Meeting Connec… +1
- 1
- Zoom Video Communications Zoom On-Premise Meeting Connec… +2
- 1
High 4
- CVE-2021-34417Authenticated remote command execution with root privileges via web console in MMRZoom Video Communications Zoom On-Premise Meeting Connec… +2
- CVE-2021-34422Path traversal of file names in Keybase Client for WindowsZoom Video Communications Keybase Client for Windows
- CVE-2021-3907Arbitrary filepath traversal via URI injectionCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-25980Talkyard - Host-Header Injection Leads to Account Takeoverdebiki talkyard
Medium, low and unrated 19
- CVE-2021-34418Pre-auth Null pointer crash in on-premise web consoleZoom Video Communications Zoom On-Premise Meeting Connec… +1
- CVE-2021-34419HTML injection in Zoom Linux clientZoom Video Communications Zoom Client for Meetings for Ubun…
- CVE-2021-34420Zoom Windows installation executable signature bypassZoom Video Communications Zoom Client for Meetings for Wind…
- CVE-2021-34421Retained exploded messages in Keybase Clients for Android and iOSZoom Video Communications Keybase Client for Android · Zoom…
- CVE-2021-3912OctoRPKI crashes when processing GZIP bomb returned via malicious repositoryCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-3911Misconfigured IP address field in ROA leads to OctoRPKI crashCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-3910NUL character in ROA causes OctoRPKI to crashCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-3909Infinite open connection causes OctoRPKI to hang foreverCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-3908Infinite certificate chain depth results in OctoRPKI running foreverCloudflare octorpki · github.com/cloudflare/cfrpki
- CVE-2021-43350LDAP filter injection vulnerability in Traffic OpsApache Software Foundation Apache Traffic Control · github.…
- CVE-2021-26558Deserialization of Untrusted DataApache Software Foundation Apache ShardingSphere-UI
- CVE-2021-43397LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin.
- CVE-2021-42002Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
- CVE-2021-41833Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
- CVE-2021-41081Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.
- CVE-2021-41080Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.
- CVE-2021-43573A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10.
- CVE-2002-20001The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub
- CVE-2021-42847Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.