# CVEs published 2021-11-11 23 CVEs were published on November 11, 2021: 0 critical, 4 high. Days are UTC. - [CVE-2021-34417](https://cve.now/CVE-2021-34417.md): Authenticated remote command execution with root privileges via web console in MMR (CVSS 7.9, Zoom Video Communications Zoom On-Premise Meeting Connec… +2) - [CVE-2021-34418](https://cve.now/CVE-2021-34418.md): Pre-auth Null pointer crash in on-premise web console (CVSS 4.0, Zoom Video Communications Zoom On-Premise Meeting Connec… +1) - [CVE-2021-34419](https://cve.now/CVE-2021-34419.md): HTML injection in Zoom Linux client (CVSS 3.7, Zoom Video Communications Zoom Client for Meetings for Ubun…) - [CVE-2021-34420](https://cve.now/CVE-2021-34420.md): Zoom Windows installation executable signature bypass (CVSS 4.7, Zoom Video Communications Zoom Client for Meetings for Wind…) - [CVE-2021-34421](https://cve.now/CVE-2021-34421.md): Retained exploded messages in Keybase Clients for Android and iOS (CVSS 3.7, Zoom Video Communications Keybase Client for Android · Zoom…) - [CVE-2021-34422](https://cve.now/CVE-2021-34422.md): Path traversal of file names in Keybase Client for Windows (CVSS 7.2, Zoom Video Communications Keybase Client for Windows) - [CVE-2021-3912](https://cve.now/CVE-2021-3912.md): OctoRPKI crashes when processing GZIP bomb returned via malicious repository (CVSS 4.2, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-3911](https://cve.now/CVE-2021-3911.md): Misconfigured IP address field in ROA leads to OctoRPKI crash (CVSS 4.2, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-3910](https://cve.now/CVE-2021-3910.md): NUL character in ROA causes OctoRPKI to crash (CVSS 4.4, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-3909](https://cve.now/CVE-2021-3909.md): Infinite open connection causes OctoRPKI to hang forever (CVSS 4.4, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-3908](https://cve.now/CVE-2021-3908.md): Infinite certificate chain depth results in OctoRPKI running forever (CVSS 5.9, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-3907](https://cve.now/CVE-2021-3907.md): Arbitrary filepath traversal via URI injection (CVSS 7.4, Cloudflare octorpki · github.com/cloudflare/cfrpki) - [CVE-2021-43350](https://cve.now/CVE-2021-43350.md): LDAP filter injection vulnerability in Traffic Ops (no CVSS, Apache Software Foundation Apache Traffic Control · github.…) - [CVE-2021-26558](https://cve.now/CVE-2021-26558.md): Deserialization of Untrusted Data (no CVSS, Apache Software Foundation Apache ShardingSphere-UI) - [CVE-2021-25980](https://cve.now/CVE-2021-25980.md): Talkyard - Host-Header Injection Leads to Account Takeover (CVSS 8.8, debiki talkyard) - [CVE-2021-43397](https://cve.now/CVE-2021-43397.md): LiquidFiles before 3.6.3 allows remote attackers to elevate their privileges from Admin (or User Admin) to Sysadmin. (no CVSS) - [CVE-2021-42002](https://cve.now/CVE-2021-42002.md): Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution. (no CVSS) - [CVE-2021-41833](https://cve.now/CVE-2021-41833.md): Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution. (no CVSS) - [CVE-2021-41081](https://cve.now/CVE-2021-41081.md): Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. (no CVSS) - [CVE-2021-41080](https://cve.now/CVE-2021-41080.md): Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search. (no CVSS) - [CVE-2021-43573](https://cve.now/CVE-2021-43573.md): A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. (no CVSS) - [CVE-2002-20001](https://cve.now/CVE-2002-20001.md): The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub (no CVSS) - [CVE-2021-42847](https://cve.now/CVE-2021-42847.md): Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-11-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.