# CVEs published 2021-11-12

73 CVEs were published on November 12, 2021: 4 critical, 19 high. Days are UTC.

- [CVE-2021-36325](https://cve.now/CVE-2021-36325.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-36324](https://cve.now/CVE-2021-36324.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-36323](https://cve.now/CVE-2021-36323.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2021-36315](https://cve.now/CVE-2021-36315.md): Dell EMC PowerScale Nodes contain a hardware design flaw. (CVSS 6.8, Dell PowerScale Nodes)
- [CVE-2021-36305](https://cve.now/CVE-2021-36305.md): Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2021-21528](https://cve.now/CVE-2021-21528.md): Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2021-3843](https://cve.now/CVE-2021-3843.md): A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated (CVSS 6.7, Lenovo ThinkPad BIOS)
- [CVE-2021-3840](https://cve.now/CVE-2021-3840.md): A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co (CVSS 8.8, Antilles · antilles-tools)
- [CVE-2021-3793](https://cve.now/CVE-2021-3793.md): An improper access control vulnerability was reported in some Motorola-branded Binatone Hubble Cameras which could allow an unauthenticated (CVSS 6.5, Motorola Binatone Hubble Cameras)
- [CVE-2021-3792](https://cve.now/CVE-2021-3792.md): Some device communications in some Motorola-branded Binatone Hubble Cameras with backend Hubble services are not encrypted which could lead (CVSS 5.3, Motorola Binatone Hubble Cameras)
- [CVE-2021-3791](https://cve.now/CVE-2021-3791.md): An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated at (CVSS 6.5, Motorola Binatone Hubble Cameras)
- [CVE-2021-3790](https://cve.now/CVE-2021-3790.md): A buffer overflow was reported in the local web server of some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated (CVSS 6.5, Motorola Binatone Hubble Cameras)
- [CVE-2021-3789](https://cve.now/CVE-2021-3789.md): An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with phys (CVSS 4.2, Motorola Binatone Hubble Cameras)
- [CVE-2021-3788](https://cve.now/CVE-2021-3788.md): An exposed debug interface was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with physical access u (CVSS 6.8, Motorola Binatone Hubble Cameras)
- [CVE-2021-3787](https://cve.now/CVE-2021-3787.md): A vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker with local access to obtain the M (CVSS 6.4, Motorola Binatone Hubble Cameras)
- [CVE-2021-3786](https://cve.now/CVE-2021-3786.md): A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used (CVSS 4.4, Lenovo Notebook and ThinkPad BIOS)
- [CVE-2021-3723](https://cve.now/CVE-2021-3723.md): A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 365 (CVSS 7.2, IBM System x 3550 M3 · IBM System x 3650 M3)
- [CVE-2021-3720](https://cve.now/CVE-2021-3720.md): An information disclosure vulnerability was reported in the Time Weather system widget on Legion Phone Pro (L79031) and Legion Phone2 Pro (L (CVSS 5.5, Lenovo Legion Phone Pro · Lenovo Legion Phone2 Pro)
- [CVE-2021-3719](https://cve.now/CVE-2021-3719.md): A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some (CVSS 6.7, Lenovo ThinkCentre and ThinkStation BIOS)
- [CVE-2021-3718](https://cve.now/CVE-2021-3718.md): A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setti (CVSS 4.3, Lenovo ThinkPad BIOS)
- [CVE-2021-3599](https://cve.now/CVE-2021-3599.md): A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local (CVSS 6.7, Lenovo ThinkPad BIOS)
- [CVE-2021-3577](https://cve.now/CVE-2021-3577.md): An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an att (CVSS 8.8, Motorola Binatone Hubble Cameras)
- [CVE-2021-3519](https://cve.now/CVE-2021-3519.md): A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At (CVSS 6.4, Lenovo Desktop BIOS)
- [CVE-2020-21141](https://cve.now/CVE-2020-21141.md): iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add. (no CVSS)
- [CVE-2021-43610](https://cve.now/CVE-2021-43610.md): Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in a (no CVSS)
- [CVE-2021-43611](https://cve.now/CVE-2021-43611.md): Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \\ " in the display name of a From header. (no CVSS)
- [CVE-2021-42563](https://cve.now/CVE-2021-42563.md): There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. (no CVSS)
- [CVE-2021-43332](https://cve.now/CVE-2021-43332.md): In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. (no CVSS)
- [CVE-2021-43331](https://cve.now/CVE-2021-43331.md): In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. (no CVSS)
- [CVE-2021-39303](https://cve.now/CVE-2021-39303.md): The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. (no CVSS)
- [CVE-2021-41972](https://cve.now/CVE-2021-41972.md): Credentials leak (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-41264](https://cve.now/CVE-2021-41264.md): UUPSUpgradeable vulnerability in OpenZeppelin Contracts (CVSS 9.8, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2021-43579](https://cve.now/CVE-2021-43579.md): A stack-based buffer overflow in image\_load\_bmp() in HTMLDOC \<= 1.9.13 results in remote code execution if the victim converts an HTML docum (no CVSS)
- [CVE-2021-41254](https://cve.now/CVE-2021-41254.md): Privilege escalation to cluster admin on multi-tenant environments (CVSS 8.8, fluxcd kustomize-controller · github.com/fluxcd/kustomize-c…)
- [CVE-2021-38985](https://cve.now/CVE-2021-38985.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2021-38973](https://cve.now/CVE-2021-38973.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the (CVSS 2.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38972](https://cve.now/CVE-2021-38972.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 receives input or data, but it does not validate or incorrectly validates that the (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2020-4146](https://cve.now/CVE-2020-4146.md): IBM Security SiteProtector System 3.1.1 could allow a remote attacker to obtain sensitive information, caused by missing 'HttpOnly' flag. (CVSS 4.0, IBM Security SiteProtector System)
- [CVE-2020-4140](https://cve.now/CVE-2020-4140.md): IBM Security SiteProtector System 3.1.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security SiteProtector System)
- [CVE-2021-43492](https://cve.now/CVE-2021-43492.md): AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-43493](https://cve.now/CVE-2021-43493.md): ServerManagement master branch as of commit 49491cc6f94980e6be7791d17be947c27071eb56 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-43494](https://cve.now/CVE-2021-43494.md): OpenCV-REST-API master branch as of commit 69be158c05d4dd5a4aff38fdc680a162dd6b9e49 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-43496](https://cve.now/CVE-2021-43496.md): Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. (no CVSS)
- [CVE-2021-3934](https://cve.now/CVE-2021-3934.md): OS Command Injection in ohmyzsh/ohmyzsh (CVSS 7.8, ohmyzsh/ohmyzsh)
- [CVE-2021-43578](https://cve.now/CVE-2021-43578.md): Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any (no CVSS, Jenkins project Jenkins Squash TM Publisher (Squash4Jenkins…)
- [CVE-2021-43577](https://cve.now/CVE-2021-43577.md): Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins OWASP Dependency-Check Plugin · org…)
- [CVE-2021-43576](https://cve.now/CVE-2021-43576.md): Jenkins pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers (no CVSS, Jenkins project Jenkins pom2config Plugin · org.jenkins-ci.…)
- [CVE-2021-21701](https://cve.now/CVE-2021-21701.md): Jenkins Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (no CVSS, Jenkins project Jenkins Performance Plugin · org.jenkins-ci…)
- [CVE-2021-21700](https://cve.now/CVE-2021-21700.md): Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a (no CVSS, Jenkins project Jenkins Scriptler Plugin · org.jenkins-ci.p…)
- [CVE-2021-21699](https://cve.now/CVE-2021-21699.md): Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, (no CVSS, Jenkins project Jenkins Active Choices Plugin · org.biouno:…)
- [CVE-2021-30321](https://cve.now/CVE-2021-30321.md): Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdragon Connectivity, S (CVSS 9.8, Qualcomm Snapdragon Compute, Snapdragon Connectivity, Snapd…)
- [CVE-2021-30284](https://cve.now/CVE-2021-30284.md): Possible information exposure and denial of service due to NAS not dropping messages when integrity check fails in Snapdragon Auto, Snapdrag (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30266](https://cve.now/CVE-2021-30266.md): Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto, Snap (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30265](https://cve.now/CVE-2021-30265.md): Possible memory corruption due to improper validation of memory address while processing user-space IOCTL for clearing Filter and Route stat (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30264](https://cve.now/CVE-2021-30264.md): Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto, Snapdragon Connectiv (CVSS 6.7, Qualcomm Snapdragon Auto, Snapdragon Connectivity, Snapdrag…)
- [CVE-2021-30263](https://cve.now/CVE-2021-30263.md): Possible race condition can occur due to lack of synchronization mechanism when On-Device Logging node open twice concurrently in Snapdragon (CVSS 6.7, Qualcomm Snapdragon Compute, Snapdragon Industrial IOT, Sna…)
- [CVE-2021-30259](https://cve.now/CVE-2021-30259.md): Possible out of bound access due to improper validation of function table entries in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30255](https://cve.now/CVE-2021-30255.md): Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-30254](https://cve.now/CVE-2021-30254.md): Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdragon Comput (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1982](https://cve.now/CVE-2021-1982.md): Possible denial of service scenario due to improper input validation of received NAS OTA message in Snapdragon Auto, Snapdragon Compute, Sna (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1981](https://cve.now/CVE-2021-1981.md): Possible buffer over read due to improper IE size check of Bearer capability IE in MT setup request from network in Snapdragon Auto, Snapdra (CVSS 7.5, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1979](https://cve.now/CVE-2021-1979.md): Possible buffer overflow due to improper validation of FTM command payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1975](https://cve.now/CVE-2021-1975.md): Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Compute, Snapdra (CVSS 9.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1973](https://cve.now/CVE-2021-1973.md): A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1924](https://cve.now/CVE-2021-1924.md): Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, (CVSS 9.0, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1921](https://cve.now/CVE-2021-1921.md): Possible memory corruption due to Improper handling of hypervisor unmap operations for concurrent memory operations in Snapdragon Auto, Snap (CVSS 7.8, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1912](https://cve.now/CVE-2021-1912.md): Possible integer overflow can occur due to improper length check while calculating count and grace period in Snapdragon Auto, Snapdragon Com (CVSS 8.4, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-1903](https://cve.now/CVE-2021-1903.md): Possible denial of service scenario can occur due to lack of length check on Channel Switch Announcement IE in beacon or probe response fram (CVSS 5.3, Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Co…)
- [CVE-2021-37910](https://cve.now/CVE-2021-37910.md): ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication (CVSS 3.7, ASUS GT-AXE11000 · ASUS RT-AX3000 +3)
- [CVE-2021-42775](https://cve.now/CVE-2021-42775.md): Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo (no CVSS)
- [CVE-2021-42773](https://cve.now/CVE-2021-42773.md): Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo (no CVSS)
- [CVE-2021-42774](https://cve.now/CVE-2021-42774.md): Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo (no CVSS)
- [CVE-2021-41229](https://cve.now/CVE-2021-41229.md): Memory leak in BlueZ (CVSS 4.3, bluez)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.