CVEs published November 15, 2021
65 CVEs were published on November 15, 2021: 2 critical, 15 high.
- Published
- 65
- Critical
- 2
- High
- 15
- Medium
- 15
- Low
- 2
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- AMD Radeon Software
- 19
- busybox
- 14
- IBM Security Key Lifecycle Manager
- 10
- Advantech HMI Designer
- 2
- Grand Vice info webopac7
- 2
- ASUS P453UJ BIOS
- 1
- discourse
- 1
- discourse rails_multisite · rails_multisite
- 1
- fruity
- 1
- grafana · github.com/grafana/grafana
- 1
Critical 2
High 15
- CVE-2021-41266Authentication bypass issue in the Operator Consoleminio console · github.com/minio/console
- CVE-2021-41263Secure/signed cookies share secrets between sites in rails_multisitediscourse rails_multisite · rails_multisite
- CVE-2021-34992This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10.Orckestra C1 CMS
- CVE-2021-34991This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.8NETGEAR R6400v2
- CVE-2021-42706AzeoTech DAQFactoryAdvantech HMI Designer
- CVE-2021-42839Grand Vice info Co. webopac7 - Arbitrary File UploadGrand Vice info webopac7
- CVE-2021-42378A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42379A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42380A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42381A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42382A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42383A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42384A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42385A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
- CVE-2021-42386A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in thebusybox
Medium, low and unrated 48
- CVE-2021-41271Cache poisoning via maliciously-formed request in discoursediscourse
- CVE-2020-12894Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory or denial of service.AMD Radeon Software
- CVE-2020-12960AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may result in a denial of servAMD Radeon Software
- CVE-2020-12893Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or denial of service.AMD Radeon Software
- CVE-2020-12903Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of servAMD Radeon Software
- CVE-2020-12962Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation.AMD Radeon Software
- CVE-2020-12905Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosure.AMD Radeon Software
- CVE-2020-12901Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure.AMD Radeon Software
- CVE-2020-12898Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.AMD Radeon Software
- CVE-2020-12892An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution.AMD Radeon Software
- CVE-2021-39222XSS in Talknextcloud security-advisories
- CVE-2020-12963An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the systeAMD Radeon Software
- CVE-2021-42580Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and au
- CVE-2020-12895Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, information disclosure or dAMD Radeon Software
- CVE-2021-41950A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on t
- CVE-2021-41765A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated att
- CVE-2020-12929Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to byAMD Radeon Software
- CVE-2020-12920A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler.AMD Radeon Software
- CVE-2020-12902Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.AMD Radeon Software
- CVE-2020-12897Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass.AMD Radeon Software
- CVE-2021-38984IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker toIBM Security Key Lifecycle Manager
- CVE-2021-38983IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker toIBM Security Key Lifecycle Manager
- CVE-2021-38982IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting.IBM Security Key Lifecycle Manager
- CVE-2021-38981IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed techIBM Security Key Lifecycle Manager
- CVE-2021-38979IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, IBM Security Key Lifecycle Manager
- CVE-2021-38978IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failuIBM Security Key Lifecycle Manager
- CVE-2021-38977IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies.IBM Security Key Lifecycle Manager
- CVE-2021-38976IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user.IBM Security Key Lifecycle Manager
- CVE-2021-38975IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a speciaIBM Security Key Lifecycle Manager
- CVE-2021-38974IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially craIBM Security Key Lifecycle Manager
- CVE-2020-12899Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service.AMD Radeon Software
- CVE-2020-12900An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation oAMD Radeon Software
- CVE-2021-41951ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php vi
- CVE-2020-12904Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure.AMD Radeon Software
- CVE-2020-12964A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler.AMD Radeon Software
- CVE-2021-22959The parser in accepts requests with a space (SP) right after the header name before the colon.NodeJS Node
- CVE-2021-43574WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI.
- CVE-2021-42703AzeoTech DAQFactoryAdvantech HMI Designer
- CVE-2021-43495AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO
- CVE-2021-42838Grand Vice info Co. webopac7 - Reflected XSSGrand Vice info webopac7
- CVE-2021-41289ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory BufferASUS P453UJ BIOS
- CVE-2021-43620An issue was discovered in the fruity crate through 0.2.0 for Rust.fruity
- CVE-2021-42373A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is givenbusybox
- CVE-2021-42374An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is busybox
- CVE-2021-42375An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due tbusybox
- CVE-2021-42376A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validbusybox
- CVE-2021-42377An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a craftebusybox
- CVE-2021-43618GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafte