# CVEs published 2021-11-17

104 CVEs were published on November 17, 2021: 3 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41277](https://cve.now/CVE-2021-41277.md): GeoJSON URL validation can expose server files and environment variables to unauthorized users (CVSS 10.0, KEV, metabase)
- [CVE-2021-41274](https://cve.now/CVE-2021-41274.md): Authentication Bypass by CSRF Weakness (CVSS 9.3, solidusio solidus\_auth\_devise · solidus\_auth\_devise)
- [CVE-2021-41275](https://cve.now/CVE-2021-41275.md): Authentication Bypass by CSRF Weakness (CVSS 9.3, spree\_auth\_devise)
- [CVE-2021-0182](https://cve.now/CVE-2021-0182.md): Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable (no CVSS, Intel(R) HAXM software)
- [CVE-2021-0180](https://cve.now/CVE-2021-0180.md): Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user to potentially enable (no CVSS, Intel(R) HAXM software)
- [CVE-2021-0186](https://cve.now/CVE-2021-0186.md): Improper input validation in the Intel(R) SGX SDK applications compiled for SGX2 enabled processors may allow a privileged user to potential (no CVSS, Intel(R) SGX SDK applications compiled for SGX2 enabled pro…)
- [CVE-2020-8741](https://cve.now/CVE-2020-8741.md): Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated (no CVSS, Intel(R) Thunderbolt)
- [CVE-2021-0013](https://cve.now/CVE-2021-0013.md): Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable denial of service vi (no CVSS, Intel(R) EMA)
- [CVE-2021-0053](https://cve.now/CVE-2021-0053.md): Improper initialization in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an authenticated user (no CVSS, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows)
- [CVE-2021-0079](https://cve.now/CVE-2021-0079.md): Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated (no CVSS, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows)
- [CVE-2021-0075](https://cve.now/CVE-2021-0075.md): Out-of-bounds write in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windows 10 (no CVSS, Intel(R) PROSet/Wireless WiFi in multiple operating systems…)
- [CVE-2021-0069](https://cve.now/CVE-2021-0069.md): Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM) WiFi in Windo (no CVSS, Intel(R) PROSet/Wireless WiFi in multiple operating systems…)
- [CVE-2021-41273](https://cve.now/CVE-2021-41273.md): Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys (CVSS 4.3, pterodactyl panel · pterodactyl/panel)
- [CVE-2021-0082](https://cve.now/CVE-2021-0082.md): Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentiall (no CVSS, Intel(R) PROSet/Wireless WiFi in Windows)
- [CVE-2021-0071](https://cve.now/CVE-2021-0071.md): Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user to potentially enable (no CVSS, Intel(R) PROSet/Wireless WiFi in UEFI)
- [CVE-2021-0078](https://cve.now/CVE-2021-0078.md): Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated (no CVSS, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows)
- [CVE-2021-0063](https://cve.now/CVE-2021-0063.md): Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow an unauthenticated (no CVSS, Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows)
- [CVE-2021-0135](https://cve.now/CVE-2021-0135.md): Improper input validation in the Intel(R) Ethernet Diagnostic Driver for Windows before version 1.4.0.10 may allow a privileged user to pote (no CVSS, Intel(R) Ethernet Diagnostic Driver for Windows)
- [CVE-2021-0146](https://cve.now/CVE-2021-0146.md): Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenticated user to potenti (no CVSS, Intel(R) processors which)
- [CVE-2021-0110](https://cve.now/CVE-2021-0110.md): Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to po (no CVSS, Intel(R) Thunderbolt(TM) Windows DCH Drivers)
- [CVE-2021-0148](https://cve.now/CVE-2021-0148.md): Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information di (no CVSS, Intel(R) SSD DC)
- [CVE-2021-33073](https://cve.now/CVE-2021-33073.md): Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow an unauthenticated use (no CVSS, Intel(R) Distribution of OpenVINOâ„¢ Toolkit)
- [CVE-2021-0152](https://cve.now/CVE-2021-0152.md): Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) produc (no CVSS, Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…)
- [CVE-2021-41190](https://cve.now/CVE-2021-41190.md): Clarify Content-Type handling in OCI spec (CVSS 3.0, opencontainers distribution-spec · github.com/opencontainer…)
- [CVE-2021-0151](https://cve.now/CVE-2021-0151.md): Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products in Windows 10 may allo (no CVSS, Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R)…)
- [CVE-2021-0065](https://cve.now/CVE-2021-0065.md): Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authe (no CVSS, Intel(R) PROSet/Wireless WiFi software installer for Windows)
- [CVE-2021-0064](https://cve.now/CVE-2021-0064.md): Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an auth (no CVSS, Intel(R) PROSet/Wireless WiFi software installer for Windows)
- [CVE-2021-43996](https://cve.now/CVE-2021-43996.md): The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect acc (no CVSS, facade/ignition)
- [CVE-2021-0199](https://cve.now/CVE-2021-0199.md): Improper input validation in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.6.0.6 may allow a privileged us (no CVSS, Intel(R) Ethernet Network Controller E810)
- [CVE-2021-0198](https://cve.now/CVE-2021-0198.md): Improper access control in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged user (no CVSS, Intel(R) Ethernet Network Controller E810)
- [CVE-2021-0197](https://cve.now/CVE-2021-0197.md): Protection mechanism failure in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may allow a privileged (no CVSS, Intel(R) Ethernet Network Controller E810)
- [CVE-2021-41165](https://cve.now/CVE-2021-41165.md): HTML comments vulnerability allowing to execute JavaScript code (CVSS 8.2, ckeditor4 · ckeditor/ckeditor)
- [CVE-2021-0200](https://cve.now/CVE-2021-0200.md): Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privileged user to potential (no CVSS, Intel(R) Ethernet 700 Series Controllers)
- [CVE-2021-33059](https://cve.now/CVE-2021-33059.md): Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before version 1.4.0.15, may (no CVSS, Intel(R) Administrative Tools for Intel(R) Network Adapters)
- [CVE-2021-33098](https://cve.now/CVE-2021-33098.md): Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authenticated user to potential (no CVSS, Intel(R) Ethernet ixgbe driver for Linux)
- [CVE-2021-33058](https://cve.now/CVE-2021-33058.md): Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore version 1.4.0.21 may al (no CVSS, version)
- [CVE-2021-33062](https://cve.now/CVE-2021-33062.md): Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may allow an authenticat (no CVSS, Intel(R) VTune(TM) Profiler)
- [CVE-2021-33063](https://cve.now/CVE-2021-33063.md): Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenti (no CVSS, Intel(R) RealSense(TM) D400 Series UWP driver for Windows)
- [CVE-2021-33118](https://cve.now/CVE-2021-33118.md): Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before version 30.100.2104.1 may (no CVSS, Intel(R) Serial IO driver for Intel(R) NUC 11 Gen)
- [CVE-2021-0158](https://cve.now/CVE-2021-0158.md): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of (CVSS 6.7, Intel(R) Processors)
- [CVE-2021-0157](https://cve.now/CVE-2021-0157.md): Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable esc (CVSS 6.7, Intel(R) Processors)
- [CVE-2021-33071](https://cve.now/CVE-2021-33071.md): Incorrect default permissions in the installer for the Intel(R) oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated us (no CVSS, Intel(R) oneAPI Rendering Toolkit)
- [CVE-2021-33097](https://cve.now/CVE-2021-33097.md): Time-of-check time-of-use vulnerability in the Crypto API Toolkit for Intel(R) SGX may allow a privileged user to potentially enable escalat (no CVSS, Intel(R) SGX)
- [CVE-2021-0120](https://cve.now/CVE-2021-0120.md): Improper initialization in the installer for some Intel(R) Graphics DCH Drivers for Windows 10 before version 27.20.100.9316 may allow an au (no CVSS, Intel(R) Graphics DCH Drivers for Windows)
- [CVE-2021-0121](https://cve.now/CVE-2021-0121.md): Improper access control in the installer for some Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Windows 10 before version 27.20.100 (no CVSS, Intel(R) Iris(R) Xe MAX Dedicated Graphics Drivers for Wind…)
- [CVE-2021-33086](https://cve.now/CVE-2021-33086.md): Out-of-bounds write in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable denial of service via local acc (no CVSS, Intel(R) NUCs)
- [CVE-2021-33090](https://cve.now/CVE-2021-33090.md): Incorrect default permissionsin the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10i5FN, NUC10i7FN be (no CVSS, Intel(R) NUC HDMI Firmware Update Tool for NUC10i3FN, NUC10…)
- [CVE-2021-33089](https://cve.now/CVE-2021-33089.md): Improper access control in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5BE, NUC8i7BE before ver (no CVSS, Intel(R) NUC HDMI Firmware Update Tool for NUC8i3BE, NUC8i5…)
- [CVE-2021-0096](https://cve.now/CVE-2021-0096.md): Improper authentication in the software installer for the Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5DN, NUC7i7DN before ver (no CVSS, Intel(R) NUC HDMI Firmware Update Tool for NUC7i3DN, NUC7i5…)
- [CVE-2021-33087](https://cve.now/CVE-2021-33087.md): Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may a (no CVSS, Intel(R) NUC M15 Laptop Kit Management Engine driver pack)
- [CVE-2021-33095](https://cve.now/CVE-2021-33095.md): Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow (no CVSS, Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack)
- [CVE-2021-33094](https://cve.now/CVE-2021-33094.md): Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 (no CVSS, Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack)
- [CVE-2021-33093](https://cve.now/CVE-2021-33093.md): Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit Serial IO driver pack before version 30.100.2104.1 may a (no CVSS, Intel(R) NUC M15 Laptop Kit Serial IO driver pack)
- [CVE-2021-33092](https://cve.now/CVE-2021-33092.md): Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack before version 2.2.1.383 may (no CVSS, Intel(R) NUC M15 Laptop Kit HID Event Filter driver pack)
- [CVE-2021-33091](https://cve.now/CVE-2021-33091.md): Insecure inherited permissions in the installer for the Intel(R) NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authen (no CVSS, Intel(R) NUC M15 Laptop Kit audio driver pack)
- [CVE-2021-33088](https://cve.now/CVE-2021-33088.md): Incorrect default permissions in the installer for the Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pack before version 5.4.1.44 (no CVSS, Intel(R) NUC M15 Laptop Kit Integrated Sensor Hub driver pa…)
- [CVE-2021-33106](https://cve.now/CVE-2021-33106.md): Integer overflow in the Safestring library maintained by Intel(R) may allow an authenticated user to potentially enable escalation of privil (no CVSS, Intel(R) Safestring Library)
- [CVE-2021-42361](https://cve.now/CVE-2021-42361.md): Contact Form Email \<= 1.3.24 Authenticated Stored Cross-Site Scripting (CVSS 4.8, Contact Form Email)
- [CVE-2021-43979](https://cve.now/CVE-2021-43979.md): Styra Open Policy Agent (OPA) Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. (no CVSS)
- [CVE-2021-43553](https://cve.now/CVE-2021-43553.md): OSIsoft PI Vision (CVSS 3.1, OSIsoft PI Vision)
- [CVE-2021-43551](https://cve.now/CVE-2021-43551.md): OSIsoft PI Vision (CVSS 6.5, OSIsoft PI Vision)
- [CVE-2021-35528](https://cve.now/CVE-2021-35528.md): Authentication Bypass Vulnerability Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB) (CVSS 7.2, Hitachi Energy Retail Operations · Hitachi Energy Counterpa…)
- [CVE-2021-42360](https://cve.now/CVE-2021-42360.md): Starter Templates — Elementor, Gutenberg & Beaver Builder Templates \<= 2.7.0 Authenticated Block Import to Stored XSS (CVSS 7.6, BrainStormForce Starter Templates — Elementor, Gutenberg &…)
- [CVE-2021-42362](https://cve.now/CVE-2021-42362.md): WordPress Popular Posts \<= 5.3.2 Authenticated Arbitrary File Upload (CVSS 8.8, WordPress Popular Posts)
- [CVE-2021-43977](https://cve.now/CVE-2021-43977.md): SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS. (no CVSS)
- [CVE-2021-32234](https://cve.now/CVE-2021-32234.md): SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows remote code execution. (no CVSS)
- [CVE-2021-43975](https://cve.now/CVE-2021-43975.md): In the Linux kernel through 5.15.2, hw\_atl\_utils\_fw\_rpc\_wait in drivers/net/ethernet/aquantia/atlantic/hw\_atl/hw\_atl\_utils.c allows an attac (no CVSS, :linux\_kernel:)
- [CVE-2021-40745](https://cve.now/CVE-2021-40745.md): Adobe Campaign Path Traversal Leads to Information Exposure (CVSS 7.5, Adobe Campaign)
- [CVE-2021-42250](https://cve.now/CVE-2021-42250.md): Possible log injection (no CVSS, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-38959](https://cve.now/CVE-2021-38959.md): IBM SPSS Statistics for Windows 24.0, 25.0, 26.0, 27.0, 27.0.1, and 28.0 could allow a local user to cause a denial of service by writing ar (CVSS 6.2, IBM SPSS Statistics)
- [CVE-2021-29861](https://cve.now/CVE-2021-29861.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in EFS to expose sensitive information. (CVSS 6.2, IBM AIX · IBM VIOS)
- [CVE-2021-29860](https://cve.now/CVE-2021-29860.md): IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the libc.a library to expose sensitive (CVSS 6.2, IBM VIOS · IBM AIX)
- [CVE-2021-42955](https://cve.now/CVE-2021-42955.md): Zoho Remote Access Plus Server Windows Desktop binary fixed in version 10.1.2132 is affected by an unauthorized password reset vulnerability (CVSS 7.3)
- [CVE-2021-42954](https://cve.now/CVE-2021-42954.md): Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. (CVSS 7.8)
- [CVE-2021-42956](https://cve.now/CVE-2021-42956.md): Zoho Remote Access Plus Server Windows Desktop Binary fixed in 10.1.2132.6 is affected by a sensitive information disclosure vulnerability. (CVSS 7.8)
- [CVE-2021-32600](https://cve.now/CVE-2021-32600.md): An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, (CVSS 5.0, Fortinet FortiOS)
- [CVE-2021-41931](https://cve.now/CVE-2021-41931.md): The Company's Recruitment Management System in id=2 of the parameter from view\_vacancy app on-page appears to be vulnerable to SQL injection (no CVSS)
- [CVE-2021-24856](https://cve.now/CVE-2021-24856.md): Shared Files \< 1.6.61 - Admin+ Stored Cross-Site Scripting (no CVSS, Shared Files – Easy Download Manager and File Sharing Plugi…)
- [CVE-2021-24854](https://cve.now/CVE-2021-24854.md): QR Redirector \< 1.6.1 - Contributor+ Stored Cross-Site Scripting (no CVSS, QR Redirector)
- [CVE-2021-24853](https://cve.now/CVE-2021-24853.md): QR Redirector \< 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update (no CVSS, QR Redirector)
- [CVE-2021-24852](https://cve.now/CVE-2021-24852.md): MouseWheel Smooth Scroll \< 5.7 - Plugin's Setting Update via CSRF (no CVSS, MouseWheel Smooth Scroll)
- [CVE-2021-24851](https://cve.now/CVE-2021-24851.md): Insert Pages \< 3.7.0 - Contributor+ Arbitrary Posts/Pages Access (no CVSS, Insert Pages)
- [CVE-2021-24850](https://cve.now/CVE-2021-24850.md): Insert Pages \< 3.7.0 - Contributor+ Stored Cross-Site Scripting (no CVSS, Insert Pages)
- [CVE-2021-24847](https://cve.now/CVE-2021-24847.md): SEO Redirection \< 8.2 - Subscriber+ SQL Injection (no CVSS, SEO Redirection Plugin – 301 Redirect Manager)
- [CVE-2021-24841](https://cve.now/CVE-2021-24841.md): Helpful \< 4.4.59 - Admin+ Stored Cross-Site Scripting (no CVSS, Helpful)
- [CVE-2021-24834](https://cve.now/CVE-2021-24834.md): YOP Poll \< 6.3.1 - Author+ Stored Cross-Site Scripting via Options Module (no CVSS, YOP Poll)
- [CVE-2021-24833](https://cve.now/CVE-2021-24833.md): YOP Poll \< 6.3.1 - Author+ Stored Cross-Site Scripting via Preview Module (no CVSS, YOP Poll)
- [CVE-2021-24815](https://cve.now/CVE-2021-24815.md): Paypal Donation \< 1.3.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Accept Donations with PayPal)
- [CVE-2021-24804](https://cve.now/CVE-2021-24804.md): Simple JWT Login \< 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF (no CVSS, Simple JWT Login – Login and Register to WordPress using JWT)
- [CVE-2021-24802](https://cve.now/CVE-2021-24802.md): Colorful Categories \< 2.0.15 - Arbitrary Colors Update via CSRF (no CVSS, Colorful Categories)
- [CVE-2021-24796](https://cve.now/CVE-2021-24796.md): My Tickets \< 1.8.31 - Unauthenticated Stored Cross-Site Scripting (no CVSS, My Tickets)
- [CVE-2021-24787](https://cve.now/CVE-2021-24787.md): Client Invoicing by Sprout Invoices \< 19.9.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Client Invoicing by Sprout Invoices – Easy Estimates and In…)
- [CVE-2021-24776](https://cve.now/CVE-2021-24776.md): WP Performance Score Booster \< 2.1 - Settings Change via CSRF (no CVSS, WP Performance Score Booster – Optimize Speed, Enable Cache…)
- [CVE-2021-24772](https://cve.now/CVE-2021-24772.md): Stream \< 3.8.2 - Admin+ SQL Injection (no CVSS, Stream)
- [CVE-2021-24758](https://cve.now/CVE-2021-24758.md): Email Log \< 2.4.7 - Admin+ SQL Injection (no CVSS, Email Log)
- [CVE-2021-24598](https://cve.now/CVE-2021-24598.md): Testimonial Builder \< 1.6.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Testimonial)
- [CVE-2021-43337](https://cve.now/CVE-2021-43337.md): SchedMD Slurm 21.08.\* before 21.08.4 has Incorrect Access Control. (no CVSS)
- [CVE-2021-3939](https://cve.now/CVE-2021-3939.md): Free of static data in accountsservice (CVSS 7.8, Ubuntu accountsservice)
- [CVE-2021-33479](https://cve.now/CVE-2021-33479.md): A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in measure\_pitch() in pgm2asc.c. (no CVSS, gocr)
- [CVE-2021-33480](https://cve.now/CVE-2021-33480.md): An use-after-free vulnerability was discovered in gocr through 0.53-20200802 in context\_correction() in pgm2asc.c. (no CVSS, gocr)
- [CVE-2021-33481](https://cve.now/CVE-2021-33481.md): A stack-based buffer overflow vulnerability was discovered in gocr through 0.53-20200802 in try\_to\_divide\_boxes() in pgm2asc.c. (no CVSS, gocr)
- [CVE-2021-41164](https://cve.now/CVE-2021-41164.md): Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML (CVSS 8.2, ckeditor4)
- [CVE-2021-43976](https://cve.now/CVE-2021-43976.md): In the Linux kernel through 5.15.2, mwifiex\_usb\_recv in drivers/net/wireless/marvell/mwifiex/usb.c allows an attacker (who can connect a cra (no CVSS)
- [CVE-2021-43997](https://cve.now/CVE-2021-43997.md): FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-kernel code from calling the xPortRaisePrivilege internal function to raise privi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.