CVEs published November 12, 2021
73 CVEs were published on November 12, 2021: 4 critical, 19 high.
- Published
- 73
- Critical
- 4
- High
- 19
- Medium
- 26
- Low
- 2
- Unrated
- 22
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- 15
- Motorola Binatone Hubble Cameras
- 8
- Dell CPG BIOS
- 3
- IBM Security Key Lifecycle Manager
- 3
- Lenovo ThinkPad BIOS
- 3
- Dell PowerScale OneFS
- 2
- IBM Security SiteProtector System
- 2
- Antilles · antilles-tools
- 1
- Apache Software Foundation Apache Superset · apache-superset
- 1
- ASUS GT-AXE11000 · ASUS RT-AX3000 +3
- 1
Critical 4
- CVE-2021-41264UUPSUpgradeable vulnerability in OpenZeppelin Contractsopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2021-30321Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, SQualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…
- CVE-2021-1975Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1924Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
High 19
- CVE-2021-36325Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2021-36324Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2021-36323Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2021-21528Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability.Dell PowerScale OneFS
- CVE-2021-3840A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote coAntilles · antilles-tools
- CVE-2021-3723A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 365IBM System x 3550 M3 · IBM System x 3650 M3
- CVE-2021-3577An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attMotorola Binatone Hubble Cameras
- CVE-2021-41254Privilege escalation to cluster admin on multi-tenant environmentsfluxcd kustomize-controller · github.com/fluxcd/kustomize-c…
- CVE-2021-3934OS Command Injection in ohmyzsh/ohmyzshohmyzsh/ohmyzsh
- CVE-2021-30284Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, SnapdragQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30259Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30255Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30254Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon ComputQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1982Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, SnaQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1981Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1979Possible buffer overflow due to improper validation of FTM command payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1973A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdraQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1921Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-1912Possible integer overflow can occur due to improper length check while calculating count and grace period in Snapdragon Auto, Snapdragon ComQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
Medium, low and unrated 50
- CVE-2021-36315Dell EMC PowerScale Nodes contain a hardware design flaw.Dell PowerScale Nodes
- CVE-2021-36305Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling.Dell PowerScale OneFS
- CVE-2021-3843A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated Lenovo ThinkPad BIOS
- CVE-2021-3793An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated Motorola Binatone Hubble Cameras
- CVE-2021-3792Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead Motorola Binatone Hubble Cameras
- CVE-2021-3791An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atMotorola Binatone Hubble Cameras
- CVE-2021-3790A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated Motorola Binatone Hubble Cameras
- CVE-2021-3789An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physMotorola Binatone Hubble Cameras
- CVE-2021-3788An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access uMotorola Binatone Hubble Cameras
- CVE-2021-3787A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the MMotorola Binatone Hubble Cameras
- CVE-2021-3786A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be usedLenovo Notebook and ThinkPad BIOS
- CVE-2021-3720An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (LLenovo Legion Phone Pro · Lenovo Legion Phone2 Pro
- CVE-2021-3719A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some Lenovo ThinkCentre and ThinkStation BIOS
- CVE-2021-3718A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics settiLenovo ThinkPad BIOS
- CVE-2021-3599A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local Lenovo ThinkPad BIOS
- CVE-2021-3519A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password AtLenovo Desktop BIOS
- CVE-2020-21141iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
- CVE-2021-43610Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in a
- CVE-2021-43611Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header.
- CVE-2021-42563There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows.
- CVE-2021-43332In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password.
- CVE-2021-43331In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
- CVE-2021-39303The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352.
- CVE-2021-41972Credentials leakApache Software Foundation Apache Superset · apache-superset
- CVE-2021-43579A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML docum
- CVE-2021-38985IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that theIBM Security Key Lifecycle Manager
- CVE-2021-38973IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that theIBM Security Key Lifecycle Manager
- CVE-2021-38972IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that theIBM Security Key Lifecycle Manager
- CVE-2020-4146IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag.IBM Security SiteProtector System
- CVE-2020-4140IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting.IBM Security SiteProtector System
- CVE-2021-43492AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability.
- CVE-2021-43493ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability.
- CVE-2021-43494OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability.
- CVE-2021-43496Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability.
- CVE-2021-43578Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any Jenkins project Jenkins Squash TM Publisher (Squash4Jenkins…
- CVE-2021-43577Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins OWASP Dependency-Check Plugin · org…
- CVE-2021-43576Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackersJenkins project Jenkins pom2config Plugin · org.jenkins-ci.…
- CVE-2021-21701Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins project Jenkins Performance Plugin · org.jenkins-ci…
- CVE-2021-21700Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in aJenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…
- CVE-2021-21699Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, Jenkins project Jenkins Active Choices Plugin · org.biouno:…
- CVE-2021-30266Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, SnapQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30265Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route statQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-30264Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon ConnectivQualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…
- CVE-2021-30263Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in SnapdragonQualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…
- CVE-2021-1903Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response framQualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…
- CVE-2021-37910ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper AuthenticationASUS GT-AXE11000 · ASUS RT-AX3000 +3
- CVE-2021-42775Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo
- CVE-2021-42773Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo
- CVE-2021-42774Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo
- CVE-2021-41229Memory leak in BlueZbluez