# CVEs published 2021-11-18

70 CVEs were published on November 18, 2021: 1 critical, 27 high. Days are UTC.

- [CVE-2021-40131](https://cve.now/CVE-2021-40131.md): Cisco Common Services Platform Collector Stored Cross-Site Scripting Vulnerability (CVSS 5.5, Cisco Common Services Platform Collector Software)
- [CVE-2021-40130](https://cve.now/CVE-2021-40130.md): Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability (CVSS 4.9, Cisco Common Services Platform Collector Software)
- [CVE-2021-40129](https://cve.now/CVE-2021-40129.md): Cisco Common Services Platform Collector SQL Injection Vulnerability (CVSS 4.9, Cisco Common Services Platform Collector Software)
- [CVE-2021-41278](https://cve.now/CVE-2021-41278.md): Broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectors (CVSS 5.4, edgexfoundry app-functions-sdk-go · github.com/edgexfoun… +2)
- [CVE-2021-37322](https://cve.now/CVE-2021-37322.md): GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c. (no CVSS)
- [CVE-2021-43017](https://cve.now/CVE-2021-43017.md): Adobe Creative Cloud DLL Hijacking Local Application Denial of Service (CVSS 4.2, Adobe GoCart)
- [CVE-2021-23193](https://cve.now/CVE-2021-23193.md): Improper privilege validation vulnerability in COM Interface of Gallagher Command Centre Server allows authenticated unprivileged operators (CVSS 8.1, Gallagher Command Centre)
- [CVE-2021-23197](https://cve.now/CVE-2021-23197.md): Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account (CVSS 5.2, Gallagher Command Centre)
- [CVE-2021-23167](https://cve.now/CVE-2021-23167.md): Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Comm (CVSS 8.1, Gallagher Command Centre)
- [CVE-2021-23146](https://cve.now/CVE-2021-23146.md): An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification. (CVSS 7.1, Gallagher Command Center)
- [CVE-2021-23162](https://cve.now/CVE-2021-23162.md): Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command C (CVSS 7.7, Gallagher Command Centre Mobile Connect for Android)
- [CVE-2021-23155](https://cve.now/CVE-2021-23155.md): Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Ce (CVSS 9.0, Gallagher Command Centre Mobile Client for Android)
- [CVE-2021-42525](https://cve.now/CVE-2021-42525.md): Adobe Animate SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Animate)
- [CVE-2021-42524](https://cve.now/CVE-2021-42524.md): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2021-42272](https://cve.now/CVE-2021-42272.md): Adobe Animate GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2021-42271](https://cve.now/CVE-2021-42271.md): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2021-42270](https://cve.now/CVE-2021-42270.md): Adobe Animate BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2021-42269](https://cve.now/CVE-2021-42269.md): Adobe Animate FLA File Parsing Use After Free Remote Code Execution (CVSS 7.8, Adobe Animate)
- [CVE-2021-42268](https://cve.now/CVE-2021-42268.md): Adobe Animate FLA File Parsing Null Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe Animate)
- [CVE-2021-42267](https://cve.now/CVE-2021-42267.md): Adobe Animate FLA File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Animate)
- [CVE-2021-42266](https://cve.now/CVE-2021-42266.md): Adobe Animate FLA File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Animate)
- [CVE-2021-40733](https://cve.now/CVE-2021-40733.md): Adobe Animate Memory Corruption Could Lead To Arbitrary Code Execution (CVSS 7.8, Adobe Animate)
- [CVE-2021-35534](https://cve.now/CVE-2021-35534.md): Insufficient Security Control Vulnerability (CVSS 7.2, Hitachi Energy Relion 670 Series · Hitachi Energy Relion… +4)
- [CVE-2021-40761](https://cve.now/CVE-2021-40761.md): Adobe After Effects NULL Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe After Effects)
- [CVE-2021-40760](https://cve.now/CVE-2021-40760.md): Adobe After Effects M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40759](https://cve.now/CVE-2021-40759.md): Adobe After Effects M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40758](https://cve.now/CVE-2021-40758.md): Adobe After Effects WAV File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40757](https://cve.now/CVE-2021-40757.md): Adobe After Effects MXF File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40756](https://cve.now/CVE-2021-40756.md): Adobe After Effects NULL Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe After Effects)
- [CVE-2021-40755](https://cve.now/CVE-2021-40755.md): Adobe After Effects SGI File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40754](https://cve.now/CVE-2021-40754.md): Adobe After Effects WAV File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40753](https://cve.now/CVE-2021-40753.md): Adobe After Effects SVG File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40752](https://cve.now/CVE-2021-40752.md): Adobe After Effects M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40751](https://cve.now/CVE-2021-40751.md): Adobe After Effects M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe After Effects)
- [CVE-2021-35535](https://cve.now/CVE-2021-35535.md): Insufficient Security Control Vulnerability (CVSS 8.1, Hitachi Energy Relion 670 Series · Hitachi Energy Relion… +1)
- [CVE-2021-37939](https://cve.now/CVE-2021-37939.md): It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, which (no CVSS, Elastic Kibana · kibana)
- [CVE-2021-37938](https://cve.now/CVE-2021-37938.md): It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf file (no CVSS, Elastic Kibana)
- [CVE-2021-43669](https://cve.now/CVE-2021-43669.md): A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. (no CVSS, github.com/hyperledger/fabric)
- [CVE-2021-43668](https://cve.now/CVE-2021-43668.md): Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. (no CVSS, github.com/ethereum/go-ethereum)
- [CVE-2021-43667](https://cve.now/CVE-2021-43667.md): A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. (no CVSS, github.com/hyperledger/fabric)
- [CVE-2021-0671](https://cve.now/CVE-2021-0671.md): In apusys, there is a possible memory corruption due to a missing bounds check. (no CVSS, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT…)
- [CVE-2021-0670](https://cve.now/CVE-2021-0670.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT…)
- [CVE-2021-0669](https://cve.now/CVE-2021-0669.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT…)
- [CVE-2021-0668](https://cve.now/CVE-2021-0668.md): In apusys, there is a possible memory corruption due to incorrect error handling. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0667](https://cve.now/CVE-2021-0667.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0666](https://cve.now/CVE-2021-0666.md): In apusys, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0665](https://cve.now/CVE-2021-0665.md): In apusys, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0664](https://cve.now/CVE-2021-0664.md): In ccu, there is a possible memory corruption due to a use after free. (no CVSS, MT6765, MT6768, MT6771, MT6779, MT6785, MT6833, MT6853, MT6…)
- [CVE-2021-0659](https://cve.now/CVE-2021-0659.md): In apusys, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6853, MT6853T, MT6873, MT6875, MT6877, MT6883, MT6885, MT…)
- [CVE-2021-0658](https://cve.now/CVE-2021-0658.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0657](https://cve.now/CVE-2021-0657.md): In apusys, there is a possible out of bounds write due to a stack-based buffer overflow. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0656](https://cve.now/CVE-2021-0656.md): In edma driver, there is a possible memory corruption due to a use after free. (no CVSS, MT6853, MT6853T, MT6873, MT6877, MT6883, MT6885, MT6889, MT…)
- [CVE-2021-0655](https://cve.now/CVE-2021-0655.md): In mdlactl driver, there is a possible memory corruption due to an incorrect bounds check. (no CVSS, MT6873, MT6875, MT6883, MT6885, MT6889, MT6891, MT6893)
- [CVE-2021-0629](https://cve.now/CVE-2021-0629.md): In mdlactl driver, there is a possible memory corruption due to a use after free. (no CVSS, MT6873, MT6875, MT6883, MT6885, MT6889, MT6891, MT6893, MT8…)
- [CVE-2021-0624](https://cve.now/CVE-2021-0624.md): In flv extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT6580, MT6735, MT6737, MT6739, MT6750S, MT6753, MT6755S, M…)
- [CVE-2021-0623](https://cve.now/CVE-2021-0623.md): In asf extractor, there is a possible out of bounds read due to an integer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0622](https://cve.now/CVE-2021-0622.md): In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0621](https://cve.now/CVE-2021-0621.md): In asf extractor, there is a possible out of bounds read due to an integer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0620](https://cve.now/CVE-2021-0620.md): In asf extractor, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, MT5522, MT5527, MT5597, MT5598, MT5599, MT6580, MT6735, MT6…)
- [CVE-2021-0619](https://cve.now/CVE-2021-0619.md): In ape extractor, there is a possible out of bounds read due to a missing bounds check. (no CVSS, MT6739, MT6758, MT6761, MT6762, MT6763, MT6765, MT6768, MT6…)
- [CVE-2021-0672](https://cve.now/CVE-2021-0672.md): In Browser app, there is a possible information disclosure due to a missing permission check. (no CVSS, Android)
- [CVE-2021-36909](https://cve.now/CVE-2021-36909.md): WordPress WP Reset PRO Premium plugin \<= 5.98 - Authenticated Database Reset vulnerability (CVSS 8.8, WebFactory WP Reset PRO)
- [CVE-2021-36908](https://cve.now/CVE-2021-36908.md): WordPress WP Reset PRO Premium Plugin \<= 5.98 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 8.8, WebFactory WP Reset PRO)
- [CVE-2021-27023](https://cve.now/CVE-2021-27023.md): A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a dif (no CVSS, Puppet Enterprise, Puppet Server, Puppet Agent · puppet)
- [CVE-2021-27025](https://cve.now/CVE-2021-27025.md): A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condit (no CVSS, Puppet Enterprise, Puppet Agent · puppet)
- [CVE-2021-27026](https://cve.now/CVE-2021-27026.md): A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged (no CVSS, Puppet Enterprise, Puppet Connect)
- [CVE-2021-27024](https://cve.now/CVE-2021-27024.md): A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access (no CVSS, Puppet Continuous Delivery for Puppet Enterprise)
- [CVE-2021-43549](https://cve.now/CVE-2021-43549.md): OSIsoft PI Web API (CVSS 6.9, OSIsoft PI Web API)
- [CVE-2021-39920](https://cve.now/CVE-2021-39920.md): NULL pointer exception in the IPPUSB dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted capture (CVSS 7.5, Wireshark Foundation Wireshark)
- [CVE-2021-39928](https://cve.now/CVE-2021-39928.md): NULL pointer exception in the IEEE 802.11 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet inje (CVSS 7.5, Wireshark Foundation Wireshark)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.