CVEs published November 17, 2021
104 CVEs were published on November 17, 2021: 3 critical, 10 high. 1 is now in CISA KEV.
- Published
- 104
- Critical
- 3
- High
- 10
- Medium
- 9
- Low
- 2
- Unrated
- 80
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows
- 4
- gocr
- 3
- Intel(R) Ethernet Network Controller E810
- 3
- Insert Pages
- 2
- Intel(R) HAXM software
- 2
- Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack
- 2
- Intel(R) Processors
- 2
- Intel(R) PROSet/Wireless WiFi in multiple operating systems…
- 2
- Intel(R) PROSet/Wireless WiFi software installer for Windows
- 2
- Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- 2
Critical 3
High 10
- CVE-2021-41165HTML comments vulnerability allowing to execute JavaScript codeckeditor4 · ckeditor/ckeditor
- CVE-2021-35528Authentication Bypass Vulnerability Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)Hitachi Energy Retail Operations · Hitachi Energy Counterpa…
- CVE-2021-42360Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSSBrainStormForce Starter Templates — Elementor, Gutenberg &…
- CVE-2021-42362WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File UploadWordPress Popular Posts
- CVE-2021-40745Adobe Campaign Path Traversal Leads to Information ExposureAdobe Campaign
- CVE-2021-42955Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability
- CVE-2021-42954Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control.
- CVE-2021-42956Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability.
- CVE-2021-3939Free of static data in accountsserviceUbuntu accountsservice
- CVE-2021-41164Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLckeditor4
Medium, low and unrated 91
- CVE-2021-0182Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enableIntel(R) HAXM software
- CVE-2021-0180Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enableIntel(R) HAXM software
- CVE-2021-0186Improper input validation in the Intel(R) SGX SDK applications compiled for SGX2 enabled processors may allow a privileged user to potentialIntel(R) SGX SDK applications compiled for SGX2 enabled pro…
- CVE-2020-8741Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated Intel(R) Thunderbolt
- CVE-2021-0013Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service viIntel(R) EMA
- CVE-2021-0053Improper initialization in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an authenticated userIntel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows
- CVE-2021-0079Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows
- CVE-2021-0075Out-of-bounds write in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windows 10 Intel(R) PROSet/Wireless WiFi in multiple operating systems…
- CVE-2021-0069Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in WindoIntel(R) PROSet/Wireless WiFi in multiple operating systems…
- CVE-2021-41273Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keyspterodactyl panel · pterodactyl/panel
- CVE-2021-0082Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentiallIntel(R) PROSet/Wireless WiFi in Windows
- CVE-2021-0071Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enableIntel(R) PROSet/Wireless WiFi in UEFI
- CVE-2021-0078Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows
- CVE-2021-0063Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows
- CVE-2021-0135Improper input validation in the Intel(R) Ethernet Diagnostic Driver for Windows before version 1.4.0.10 may allow a privileged user to poteIntel(R) Ethernet Diagnostic Driver for Windows
- CVE-2021-0146Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potentiIntel(R) processors which
- CVE-2021-0110Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to poIntel(R) Thunderbolt(TM) Windows DCH Drivers
- CVE-2021-0148Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information diIntel(R) SSD DC
- CVE-2021-33073Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated useIntel(R) Distribution of OpenVINOâ„¢ Toolkit
- CVE-2021-0152Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) producIntel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2021-41190Clarify Content-Type handling in OCI specopencontainers distribution-spec · github.com/opencontainer…
- CVE-2021-0151Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may alloIntel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…
- CVE-2021-0065Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an autheIntel(R) PROSet/Wireless WiFi software installer for Windows
- CVE-2021-0064Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authIntel(R) PROSet/Wireless WiFi software installer for Windows
- CVE-2021-43996The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect accfacade/ignition
- CVE-2021-0199Improper input validation in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.6.0.6 may allow a privileged usIntel(R) Ethernet Network Controller E810
- CVE-2021-0198Improper access control in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged userIntel(R) Ethernet Network Controller E810
- CVE-2021-0197Protection mechanism failure in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privilegedIntel(R) Ethernet Network Controller E810
- CVE-2021-0200Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privileged user to potentialIntel(R) Ethernet 700 Series Controllers
- CVE-2021-33059Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, mayIntel(R) Administrative Tools for Intel(R) Network Adapters
- CVE-2021-33098Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potentialIntel(R) Ethernet ixgbe driver for Linux
- CVE-2021-33058Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may alversion
- CVE-2021-33062Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticatIntel(R) VTune(TM) Profiler
- CVE-2021-33063Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authentiIntel(R) RealSense(TM) D400 Series UWP driver for Windows
- CVE-2021-33118Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 mayIntel(R) Serial IO driver for Intel(R) NUC 11 Gen
- CVE-2021-0158Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of Intel(R) Processors
- CVE-2021-0157Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escIntel(R) Processors
- CVE-2021-33071Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated usIntel(R) oneAPI Rendering Toolkit
- CVE-2021-33097Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalatIntel(R) SGX
- CVE-2021-0120Improper initialization in the installer for some Intel(R) Graphics DCH Drivers for Windows 10 before version 27.20.100.9316 may allow an auIntel(R) Graphics DCH Drivers for Windows
- CVE-2021-0121Improper access control in the installer for some Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Windows 10 before version 27.20.100Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Wind…
- CVE-2021-33086Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local accIntel(R) NUCs
- CVE-2021-33090Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN beIntel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10…
- CVE-2021-33089Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before verIntel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5…
- CVE-2021-0096Improper authentication in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN, NUC7i7DN before verIntel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5…
- CVE-2021-33087Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may aIntel(R) NUC M15 Laptop Kit Management Engine driver pack
- CVE-2021-33095Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack
- CVE-2021-33094Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack
- CVE-2021-33093Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may aIntel(R) NUC M15 Laptop Kit Serial IO driver pack
- CVE-2021-33092Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 mayIntel(R) NUC M15 Laptop Kit HID Event Filter driver pack
- CVE-2021-33091Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenIntel(R) NUC M15 Laptop Kit audio driver pack
- CVE-2021-33088Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.44Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pa…
- CVE-2021-33106Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privilIntel(R) Safestring Library
- CVE-2021-42361Contact Form Email <= 1.3.24 Authenticated Stored Cross-Site ScriptingContact Form Email
- CVE-2021-43979Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control.
- CVE-2021-43553OSIsoft PI VisionOSIsoft PI Vision
- CVE-2021-43551OSIsoft PI VisionOSIsoft PI Vision
- CVE-2021-43977SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.
- CVE-2021-32234SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution.
- CVE-2021-43975In the Linux kernel through 5.15.2, hw_atl_utils_fw_rpc_wait in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c allows an attac:linux_kernel:
- CVE-2021-42250Possible log injectionApache Software Foundation Apache Superset · apache-superset
- CVE-2021-38959IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing arIBM SPSS Statistics
- CVE-2021-29861IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sensitive information.IBM AIX · IBM VIOS
- CVE-2021-29860IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the libc.a library to expose sensitive IBM VIOS · IBM AIX
- CVE-2021-32600An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, Fortinet FortiOS
- CVE-2021-41931The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection
- CVE-2021-24856Shared Files < 1.6.61 - Admin+ Stored Cross-Site ScriptingShared Files – Easy Download Manager and File Sharing Plugi…
- CVE-2021-24854QR Redirector < 1.6.1 - Contributor+ Stored Cross-Site ScriptingQR Redirector
- CVE-2021-24853QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status UpdateQR Redirector
- CVE-2021-24852MouseWheel Smooth Scroll < 5.7 - Plugin's Setting Update via CSRFMouseWheel Smooth Scroll
- CVE-2021-24851Insert Pages < 3.7.0 - Contributor+ Arbitrary Posts/Pages AccessInsert Pages
- CVE-2021-24850Insert Pages < 3.7.0 - Contributor+ Stored Cross-Site ScriptingInsert Pages
- CVE-2021-24847SEO Redirection < 8.2 - Subscriber+ SQL InjectionSEO Redirection Plugin – 301 Redirect Manager
- CVE-2021-24841Helpful < 4.4.59 - Admin+ Stored Cross-Site ScriptingHelpful
- CVE-2021-24834YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Options ModuleYOP Poll
- CVE-2021-24833YOP Poll < 6.3.1 - Author+ Stored Cross-Site Scripting via Preview ModuleYOP Poll
- CVE-2021-24815Paypal Donation < 1.3.2 - Admin+ Stored Cross-Site ScriptingAccept Donations with PayPal
- CVE-2021-24804Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRFSimple JWT Login – Login and Register to WordPress using JWT
- CVE-2021-24802Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRFColorful Categories
- CVE-2021-24796My Tickets < 1.8.31 - Unauthenticated Stored Cross-Site ScriptingMy Tickets
- CVE-2021-24787Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site ScriptingClient Invoicing by Sprout Invoices – Easy Estimates and In…
- CVE-2021-24776WP Performance Score Booster < 2.1 - Settings Change via CSRFWP Performance Score Booster – Optimize Speed, Enable Cache…
- CVE-2021-24772Stream < 3.8.2 - Admin+ SQL InjectionStream
- CVE-2021-24758Email Log < 2.4.7 - Admin+ SQL InjectionEmail Log
- CVE-2021-24598Testimonial Builder < 1.6.0 - Admin+ Stored Cross-Site ScriptingTestimonial
- CVE-2021-43337SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control.
- CVE-2021-33479A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure_pitch() in pgm2asc.c.gocr
- CVE-2021-33480An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context_correction() in pgm2asc.c.gocr
- CVE-2021-33481A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try_to_divide_boxes() in pgm2asc.c.gocr
- CVE-2021-43976In the Linux kernel through 5.15.2, mwifiex_usb_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a cra
- CVE-2021-43997FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privi