# CVEs published 2021-11-16

49 CVEs were published on November 16, 2021: 4 critical, 15 high. Days are UTC.

- [CVE-2021-43011](https://cve.now/CVE-2021-43011.md): Adobe Prelude M4A file memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-43012](https://cve.now/CVE-2021-43012.md): Adobe Prelude M4A file memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-42725](https://cve.now/CVE-2021-42725.md): Adobe Bridge Memory Corruption could lead to Arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-42731](https://cve.now/CVE-2021-42731.md): Adobe Indesign Buffer Overflow Could Lead to Remote Code Execution (CVSS 7.8, Adobe InDesign)
- [CVE-2021-42723](https://cve.now/CVE-2021-42723.md): Adobe Bridge Out-of-bounds read could lead to Arbitrary Code Execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-42721](https://cve.now/CVE-2021-42721.md): Adobe Bridge Use After Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-43013](https://cve.now/CVE-2021-43013.md): Adobe Media Encoder memory corruption vulnerability could lead to remote code execution (CVSS 7.8, Adobe Media Encoder)
- [CVE-2021-42726](https://cve.now/CVE-2021-42726.md): Adobe Bridge Memory Corruption could lead to Arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-26337](https://cve.now/CVE-2021-26337.md): Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26325](https://cve.now/CVE-2021-26325.md): Insufficient input validation in the SNP\_GUEST\_REQUEST command may lead to a potential data abort error and a denial of service. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2021-26330](https://cve.now/CVE-2021-26330.md): AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources. (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-26327](https://cve.now/CVE-2021-26327.md): Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2020-12944](https://cve.now/CVE-2020-12944.md): Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution. (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26323](https://cve.now/CVE-2021-26323.md): Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2020-12961](https://cve.now/CVE-2020-12961.md): A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the (no CVSS, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-26315](https://cve.now/CVE-2021-26315.md): When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2020-12954](https://cve.now/CVE-2020-12954.md): A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-26331](https://cve.now/CVE-2021-26331.md): AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbi (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-26335](https://cve.now/CVE-2021-26335.md): Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlle (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26321](https://cve.now/CVE-2021-26321.md): Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP. (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2020-21627](https://cve.now/CVE-2020-21627.md): Ruijie RG-UAC commit 9071227 was discovered to contain a vulnerability in the component /current\_action.php?action=reboot, which allows atta (no CVSS)
- [CVE-2020-21639](https://cve.now/CVE-2020-21639.md): Ruijie RG-UAC 6000-E50 commit 9071227 was discovered to contain a cross-site scripting (XSS) vulnerability via the rule\_name parameter. (no CVSS)
- [CVE-2020-12951](https://cve.now/CVE-2020-12951.md): Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations. (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-41258](https://cve.now/CVE-2021-41258.md): Cross-site scripting (XSS) from image block content in the site frontend (CVSS 7.3, getkirby kirby · getkirby/cms)
- [CVE-2021-26320](https://cve.now/CVE-2021-26320.md): Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND\_START command in the SEV Firmware may allow a local authenticated attac (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-41252](https://cve.now/CVE-2021-41252.md): Cross-site scripting (XSS) from writer field content in the site frontend (CVSS 7.3, getkirby kirby · getkirby/cms)
- [CVE-2021-26336](https://cve.now/CVE-2021-26336.md): Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and sub (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2020-12946](https://cve.now/CVE-2020-12946.md): Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service. (no CVSS, AMD Ryzen™ Series · AMD Athlon™ Series)
- [CVE-2021-26322](https://cve.now/CVE-2021-26322.md): Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”. (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-26329](https://cve.now/CVE-2021-26329.md): AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss (no CVSS, 1st Gen AMD EPYC™ · 2nd Gen AMD EPYC™ +1)
- [CVE-2021-26312](https://cve.now/CVE-2021-26312.md): Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory i (no CVSS, AMD EPYC™ Processors · AMD Ryzen™ Series +1)
- [CVE-2021-26338](https://cve.now/CVE-2021-26338.md): Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM re (no CVSS, 2nd Gen AMD EPYC™ · 3rd Gen AMD EPYC™)
- [CVE-2021-26326](https://cve.now/CVE-2021-26326.md): Failure to validate VM\_HSAVE\_PA during SNP\_INIT may result in a loss of memory integrity. (no CVSS, 3rd Gen AMD EPYC™)
- [CVE-2021-43048](https://cve.now/CVE-2021-43048.md): TIBCO PartnerExpress Click-Jacking vulnerability (CVSS 9.8, TIBCO Software TIBCO PartnerExpress)
- [CVE-2021-43047](https://cve.now/CVE-2021-43047.md): TIBCO PartnerExpress Cross Site Scripting vulnerabilities (CVSS 9.0, TIBCO Software TIBCO PartnerExpress)
- [CVE-2021-43046](https://cve.now/CVE-2021-43046.md): TIBCO PartnerExpress Session Token in URL (CVSS 7.5, TIBCO Software TIBCO PartnerExpress)
- [CVE-2021-38949](https://cve.now/CVE-2021-38949.md): IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. (CVSS 6.2, IBM MQ)
- [CVE-2021-38882](https://cve.now/CVE-2021-38882.md): IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records before expiration time. (CVSS 4.4, IBM Spectrum Scale)
- [CVE-2021-3958](https://cve.now/CVE-2021-3958.md): SQL Injection Vulnerability in Ipack SCADA Software (CVSS 9.8, Ipack Automation Systems Ipack SCADA Software)
- [CVE-2021-42114](https://cve.now/CVE-2021-42114.md): Scalable Rowhammering In the Frequency Domain to Bypass TRR Mitigations On Modern DDR4/LPDDR4X Devices (CVSS 9.0, Micron ddr4\_sdram · Samsung ddr4\_sdram +4)
- [CVE-2021-25985](https://cve.now/CVE-2021-25985.md): FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover (CVSS 7.8, FactorJS Factor)
- [CVE-2021-25984](https://cve.now/CVE-2021-25984.md): FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality (CVSS 6.1, FactorJS Factor)
- [CVE-2021-25983](https://cve.now/CVE-2021-25983.md): FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality (CVSS 6.1, FactorJS Factor)
- [CVE-2021-25982](https://cve.now/CVE-2021-25982.md): FactorJS - Reflected Cross-Site Scripting (XSS) in Search Functionality (CVSS 6.1, FactorJS Factor)
- [CVE-2021-37580](https://cve.now/CVE-2021-37580.md): Apache ShenYu Admin bypass JWT authentication (no CVSS, Apache Software Foundation Apache ShenYu Admin · org.apache…)
- [CVE-2021-25940](https://cve.now/CVE-2021-25940.md): ArangoDB - Insufficient Session Expiration after Password Change (CVSS 8.8, arangodb)
- [CVE-2021-25965](https://cve.now/CVE-2021-25965.md): Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF) (CVSS 8.8, calibreweb)
- [CVE-2021-25976](https://cve.now/CVE-2021-25976.md): Piranha CMS - Site-wide Cross-Site Request Forgery (CSRF) (CVSS 8.1, PiranhaCMS Piranha · Piranha)
- [CVE-2021-42337](https://cve.now/CVE-2021-42337.md): TVN-202110009 (CVSS 4.3, AIFU Information Technology CASH)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.