CVEs published November 16, 2021
49 CVEs were published on November 16, 2021: 4 critical, 15 high.
- Published
- 49
- Critical
- 4
- High
- 15
- Medium
- 6
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- 7
- AMD Ryzen™ Series · AMD Athlon™ Series
- 6
- 3rd Gen AMD EPYC™
- 5
- Adobe Bridge
- 4
- FactorJS Factor
- 4
- TIBCO Software TIBCO PartnerExpress
- 3
- 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™
- 2
- Adobe Prelude
- 2
- getkirby kirby · getkirby/cms
- 2
- Adobe InDesign
- 1
Critical 4
- CVE-2021-43048TIBCO PartnerExpress Click-Jacking vulnerabilityTIBCO Software TIBCO PartnerExpress
- CVE-2021-43047TIBCO PartnerExpress Cross Site Scripting vulnerabilitiesTIBCO Software TIBCO PartnerExpress
- CVE-2021-3958SQL Injection Vulnerability in Ipack SCADA SoftwareIpack Automation Systems Ipack SCADA Software
- CVE-2021-42114Scalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X DevicesMicron ddr4_sdram · Samsung ddr4_sdram +4
High 15
- CVE-2021-43011Adobe Prelude M4A file memory corruption vulnerability could lead to remote code executionAdobe Prelude
- CVE-2021-43012Adobe Prelude M4A file memory corruption vulnerability could lead to remote code executionAdobe Prelude
- CVE-2021-42725Adobe Bridge Memory Corruption could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-42731Adobe Indesign Buffer Overflow Could Lead to Remote Code ExecutionAdobe InDesign
- CVE-2021-42723Adobe Bridge Out-of-bounds read could lead to Arbitrary Code ExecutionAdobe Bridge
- CVE-2021-42721Adobe Bridge Use After Free could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-43013Adobe Media Encoder memory corruption vulnerability could lead to remote code executionAdobe Media Encoder
- CVE-2021-42726Adobe Bridge Memory Corruption could lead to Arbitrary code executionAdobe Bridge
- CVE-2021-41258Cross-site scripting (XSS) from image block content in the site frontendgetkirby kirby · getkirby/cms
- CVE-2021-41252Cross-site scripting (XSS) from writer field content in the site frontendgetkirby kirby · getkirby/cms
- CVE-2021-43046TIBCO PartnerExpress Session Token in URLTIBCO Software TIBCO PartnerExpress
- CVE-2021-25985FactorJS - Insufficient Session Expiration Leads to a Local Account TakeoverFactorJS Factor
- CVE-2021-25940ArangoDB - Insufficient Session Expiration after Password Changearangodb
- CVE-2021-25965Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)calibreweb
- CVE-2021-25976Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF)PiranhaCMS Piranha · Piranha
Medium, low and unrated 30
- CVE-2021-26337Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting inAMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26325Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.3rd Gen AMD EPYC™
- CVE-2021-26330AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26327Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.3rd Gen AMD EPYC™
- CVE-2020-12944Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.AMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26323Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.3rd Gen AMD EPYC™
- CVE-2020-12961A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™
- CVE-2021-26315When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient3rd Gen AMD EPYC™
- CVE-2020-12954A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26331AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbi1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26335Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlleAMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26321Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2020-21627Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current_action.php?action=reboot, which allows atta
- CVE-2020-21639Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule_name parameter.
- CVE-2020-12951Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.AMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26320Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attac1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26336Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subAMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2020-12946Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.AMD Ryzen™ Series · AMD Athlon™ Series
- CVE-2021-26322Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26329AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1
- CVE-2021-26312Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory iAMD EPYC™ Processors · AMD Ryzen™ Series +1
- CVE-2021-26338Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM re2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™
- CVE-2021-26326Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.3rd Gen AMD EPYC™
- CVE-2021-38949IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user.IBM MQ
- CVE-2021-38882IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records before expiration time.IBM Spectrum Scale
- CVE-2021-25984FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply FunctionalityFactorJS Factor
- CVE-2021-25983FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories FunctionalityFactorJS Factor
- CVE-2021-25982FactorJS - Reflected Cross-Site Scripting (XSS) in Search FunctionalityFactorJS Factor
- CVE-2021-37580Apache ShenYu Admin bypass JWT authenticationApache Software Foundation Apache ShenYu Admin · org.apache…
- CVE-2021-42337TVN-202110009AIFU Information Technology CASH