# CVEs published 2021-11-15

65 CVEs were published on November 15, 2021: 2 critical, 15 high. Days are UTC.

- [CVE-2021-41271](https://cve.now/CVE-2021-41271.md): Cache poisoning via maliciously-formed request in discourse (CVSS 4.8, discourse)
- [CVE-2021-41269](https://cve.now/CVE-2021-41269.md): Unauthenticated remote code injection in cron-utils (CVSS 10.0, jmrozanec cron-utils · com.cronutils:cron-utils)
- [CVE-2021-41266](https://cve.now/CVE-2021-41266.md): Authentication bypass issue in the Operator Console (CVSS 8.6, minio console · github.com/minio/console)
- [CVE-2021-41263](https://cve.now/CVE-2021-41263.md): Secure/signed cookies share secrets between sites in rails\_multisite (CVSS 8.3, discourse rails\_multisite · rails\_multisite)
- [CVE-2021-41244](https://cve.now/CVE-2021-41244.md): Cross organization admin control in Grafana (CVSS 9.1, grafana · github.com/grafana/grafana)
- [CVE-2020-12894](https://cve.now/CVE-2020-12894.md): Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12960](https://cve.now/CVE-2020-12960.md): AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may result in a denial of serv (no CVSS, AMD Radeon Software)
- [CVE-2020-12893](https://cve.now/CVE-2020-12893.md): Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12903](https://cve.now/CVE-2020-12903.md): Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of serv (no CVSS, AMD Radeon Software)
- [CVE-2020-12962](https://cve.now/CVE-2020-12962.md): Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation. (no CVSS, AMD Radeon Software)
- [CVE-2020-12905](https://cve.now/CVE-2020-12905.md): Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12901](https://cve.now/CVE-2020-12901.md): Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12898](https://cve.now/CVE-2020-12898.md): Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12892](https://cve.now/CVE-2020-12892.md): An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution. (no CVSS, AMD Radeon Software)
- [CVE-2021-39222](https://cve.now/CVE-2021-39222.md): XSS in Talk (CVSS 6.4, nextcloud security-advisories)
- [CVE-2020-12963](https://cve.now/CVE-2020-12963.md): An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the syste (no CVSS, AMD Radeon Software)
- [CVE-2021-42580](https://cve.now/CVE-2021-42580.md): Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and au (no CVSS)
- [CVE-2020-12895](https://cve.now/CVE-2020-12895.md): Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, information disclosure or d (no CVSS, AMD Radeon Software)
- [CVE-2021-41950](https://cve.now/CVE-2021-41950.md): A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on t (no CVSS)
- [CVE-2021-41765](https://cve.now/CVE-2021-41765.md): A SQL injection issue in pages/edit\_fields/9\_ajax/add\_keyword.php of ResourceSpace 9.5 and 9.6 \< rev 18274 allows remote unauthenticated att (no CVSS)
- [CVE-2020-12929](https://cve.now/CVE-2020-12929.md): Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to by (no CVSS, AMD Radeon Software)
- [CVE-2020-12920](https://cve.now/CVE-2020-12920.md): A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler. (no CVSS, AMD Radeon Software)
- [CVE-2020-12902](https://cve.now/CVE-2020-12902.md): Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12897](https://cve.now/CVE-2020-12897.md): Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass. (no CVSS, AMD Radeon Software)
- [CVE-2021-34992](https://cve.now/CVE-2021-34992.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS 6.10. (CVSS 8.8, Orckestra C1 CMS)
- [CVE-2021-34991](https://cve.now/CVE-2021-34991.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106\_10.0.8 (CVSS 8.8, NETGEAR R6400v2)
- [CVE-2021-38984](https://cve.now/CVE-2021-38984.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to (CVSS 3.7, IBM Security Key Lifecycle Manager)
- [CVE-2021-38983](https://cve.now/CVE-2021-38983.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses weaker than expected cryptographic algorithms that could allow an attacker to (CVSS 4.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38982](https://cve.now/CVE-2021-38982.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38981](https://cve.now/CVE-2021-38981.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed tech (CVSS 5.3, IBM Security Key Lifecycle Manager)
- [CVE-2021-38979](https://cve.now/CVE-2021-38979.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 uses a one-way cryptographic hash against an input that should not be reversible, (CVSS 4.4, IBM Security Key Lifecycle Manager)
- [CVE-2021-38978](https://cve.now/CVE-2021-38978.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information, caused by the failu (CVSS 5.9, IBM Security Key Lifecycle Manager)
- [CVE-2021-38977](https://cve.now/CVE-2021-38977.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. (CVSS 3.1, IBM Security Key Lifecycle Manager)
- [CVE-2021-38976](https://cve.now/CVE-2021-38976.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. (CVSS 6.2, IBM Security Key Lifecycle Manager)
- [CVE-2021-38975](https://cve.now/CVE-2021-38975.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to to obtain sensitive information from a specia (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2021-38974](https://cve.now/CVE-2021-38974.md): IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 could allow an authenticated user to cause a denial of service using specially cra (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2020-12899](https://cve.now/CVE-2020-12899.md): Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service. (no CVSS, AMD Radeon Software)
- [CVE-2020-12900](https://cve.now/CVE-2020-12900.md): An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation o (no CVSS, AMD Radeon Software)
- [CVE-2021-41951](https://cve.now/CVE-2021-41951.md): ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress\_sso/pages/index.php vi (no CVSS)
- [CVE-2020-12904](https://cve.now/CVE-2020-12904.md): Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure. (no CVSS, AMD Radeon Software)
- [CVE-2020-12964](https://cve.now/CVE-2020-12964.md): A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler. (no CVSS, AMD Radeon Software)
- [CVE-2021-22959](https://cve.now/CVE-2021-22959.md): The parser in accepts requests with a space (SP) right after the header name before the colon. (no CVSS, NodeJS Node)
- [CVE-2021-43574](https://cve.now/CVE-2021-43574.md): WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. (no CVSS)
- [CVE-2021-42703](https://cve.now/CVE-2021-42703.md): AzeoTech DAQFactory (CVSS 5.4, Advantech HMI Designer)
- [CVE-2021-42706](https://cve.now/CVE-2021-42706.md): AzeoTech DAQFactory (CVSS 7.8, Advantech HMI Designer)
- [CVE-2021-43495](https://cve.now/CVE-2021-43495.md): AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO (no CVSS)
- [CVE-2021-42839](https://cve.now/CVE-2021-42839.md): Grand Vice info Co. webopac7 - Arbitrary File Upload (CVSS 8.8, Grand Vice info webopac7)
- [CVE-2021-42838](https://cve.now/CVE-2021-42838.md): Grand Vice info Co. webopac7 - Reflected XSS (CVSS 6.1, Grand Vice info webopac7)
- [CVE-2021-41289](https://cve.now/CVE-2021-41289.md): ASUS P453UJ - Improper Restriction of Operations within the Bounds of a Memory Buffer (CVSS 6.3, ASUS P453UJ BIOS)
- [CVE-2021-43620](https://cve.now/CVE-2021-43620.md): An issue was discovered in the fruity crate through 0.2.0 for Rust. (no CVSS, fruity)
- [CVE-2021-42373](https://cve.now/CVE-2021-42373.md): A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given (no CVSS, busybox)
- [CVE-2021-42374](https://cve.now/CVE-2021-42374.md): An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is (CVSS 5.3, busybox)
- [CVE-2021-42375](https://cve.now/CVE-2021-42375.md): An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due t (CVSS 5.5, busybox)
- [CVE-2021-42376](https://cve.now/CVE-2021-42376.md): A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing valid (no CVSS, busybox)
- [CVE-2021-42377](https://cve.now/CVE-2021-42377.md): An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafte (no CVSS, busybox)
- [CVE-2021-42378](https://cve.now/CVE-2021-42378.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42379](https://cve.now/CVE-2021-42379.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42380](https://cve.now/CVE-2021-42380.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42381](https://cve.now/CVE-2021-42381.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42382](https://cve.now/CVE-2021-42382.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42383](https://cve.now/CVE-2021-42383.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42384](https://cve.now/CVE-2021-42384.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42385](https://cve.now/CVE-2021-42385.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-42386](https://cve.now/CVE-2021-42386.md): A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the (CVSS 7.2, busybox)
- [CVE-2021-43618](https://cve.now/CVE-2021-43618.md): GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp\_raw.c integer overflow and resultant buffer overflow via crafte (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.