CVEs published November 19, 2021
72 CVEs were published on November 19, 2021: 5 critical, 17 high. 1 is now in CISA KEV.
- Published
- 72
- Critical
- 5
- High
- 17
- Medium
- 13
- Low
- 0
- Unrated
- 37
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Apache Software Foundation Apache Ozone · org.apache.ozone:…
- 7
- Wireshark Foundation Wireshark
- 7
- https://github.com/concrete5/concrete5 · concrete5/core
- 6
- kevinpapst/kimai2
- 3
- LibreCAD
- 3
- Philips MRI
- 3
- vim/vim
- 3
- 4MOSAn GCB Doctor
- 1
- Adobe Audition
- 1
- algoliasearch-helper
- 1
Critical 5
- CVE-2021-41280OS command injection in Sharetribe Gosharetribe
- CVE-2021-40391An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and Gerbv
- CVE-2021-43409WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scriptingwpo365.com WordPress + Microsoft Office 365 / Azure AD | LO…
- CVE-2021-423384MOSAn GCB Doctor - Improper Authorization4MOSAn GCB Doctor
- CVE-2021-44026Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
High 17
- CVE-2021-43555mySCADA myDESIGNERmySCADA myDESIGNER
- CVE-2021-39923Large loop in the PNRP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or crafted caWireshark Foundation Wireshark
- CVE-2021-39353Easy Registration Forms <= 2.1.1 Cross-Site Request Forgery to Stored Cross-Site ScriptingEasy Registration Forms
- CVE-2021-3950Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskdjango-helpdesk/django-helpdesk · django-helpdesk
- CVE-2021-3961Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2021-3968Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-3973Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-21898A code execution vulnerability exists in the dwgCompressor::decompress18() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580.LibreCAD
- CVE-2021-21899A code execution vulnerability exists in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580.LibreCAD
- CVE-2021-21900A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580.LibreCAD
- CVE-2021-3974Use After Free in vim/vimvim/vim
- CVE-2021-39921NULL pointer exception in the Modbus dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injectionWireshark Foundation Wireshark
- CVE-2021-39922Buffer overflow in the C12.22 dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or craWireshark Foundation Wireshark
- CVE-2021-39924Large loop in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injection or cWireshark Foundation Wireshark
- CVE-2021-39925Buffer overflow in the Bluetooth SDP dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet injectionWireshark Foundation Wireshark
- CVE-2021-39926Buffer overflow in the Bluetooth HCI_ISO dissector in Wireshark 3.4.0 to 3.4.9 allows denial of service via packet injection or crafted captWireshark Foundation Wireshark
- CVE-2021-39929Uncontrolled Recursion in the Bluetooth DHT dissector in Wireshark 3.4.0 to 3.4.9 and 3.2.0 to 3.2.17 allows denial of service via packet inWireshark Foundation Wireshark
Medium, low and unrated 50
- CVE-2021-39198The disqualify lead action may be executed without CSRF token checkoroinc crm · oro/crm
- CVE-2021-23433Prototype Pollutionalgoliasearch-helper
- CVE-2021-26248Philips MRI 1.5T and 3T Incorrect Ownership AssignmentPhilips MRI
- CVE-2021-42744Philips MRI 1.5T and 3T Information ExposurePhilips MRI
- CVE-2021-26262Philips MRI 1.5T and 3T Improper Access ControlPhilips MRI
- CVE-2021-44038An issue was discovered in Quagga through 1.2.4.
- CVE-2021-36884WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilityBackupbliss Backup Migration
- CVE-2021-22968A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concretehttps://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-22967In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to https://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-22965A vulnerability in Pulse Connect Secure before 9.1R12.1 could allow an unauthenticated administrator to causes a denial of service when a maPulse Connect Secure
- CVE-2021-22951Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.https://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-22966Privilege escalation from Editor to Admin using Groups in Concrete CMS versions 8.5.6 and below.https://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-22970Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable tohttps://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-22969Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability thttps://github.com/concrete5/concrete5 · concrete5/core
- CVE-2021-42254BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2021-41569SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion.
- CVE-2021-44037Team Password Manager (aka TeamPasswordManager) before 10.135.236 allows password-reset poisoning.
- CVE-2021-44036Team Password Manager (aka TeamPasswordManager) before 10.135.236 has a CSRF vulnerability during import.
- CVE-2021-29329OpenSource Moddable v10.5.0 was discovered to contain a stack overflow in the fxBinaryExpressionNodeDistribute function at /moddable/xs/sour
- CVE-2021-29328OpenSource Moddable v10.5.0 was discovered to contain buffer over-read in the fxDebugThrow function at /moddable/xs/sources/xsDebug.c.
- CVE-2021-29327OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_ArrayBuffer function at /moddable/xs/sources/xsDataVi
- CVE-2021-29326OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fxIDToString function at /moddable/xs/sources/xsSymbol.c
- CVE-2021-29325OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow in the fx_String_prototype_repeat function at /moddable/xs/sour
- CVE-2021-29323OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component /modules/network/wifi/esp/modwifi.c.
- CVE-2021-29324OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c.
- CVE-2021-22028In versions of Greenplum database prior to 5.28.6 and 6.14.0, greenplum database contains a file path traversal vulnerability leading to infgpfdist
- CVE-2021-3962A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes.ImageMagick
- CVE-2021-22030In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) infoGPDB
- CVE-2021-36003Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Audition
- CVE-2021-22053Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted Spring Cloud Netflix · org.springframework.cloud:spring-clo…
- CVE-2021-33850There is a Cross-Site Scripting vulnerability in Microsoft Clarity version 0.3.Microsoft Clarity
- CVE-2021-43408Duplicate Post WordPress Plugin SQL Injection VulnerabilityCopy Delete Posts Duplicate Post WordPress Plugin
- CVE-2021-42363Preview E-Mails for WooCommerce <= 1.6.8 Reflected Cross-Site ScriptingPreview E-Mails for WooCommerce
- CVE-2021-37592Suricata before 5.0.8 and 6.x before 6.0.4 allows TCP evasion via a client with a crafted TCP/IP stack that can send a certain sequence of s
- CVE-2021-3920Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admingetgrav/grav-plugin-admin
- CVE-2021-3957Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-3963Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-41435A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, R
- CVE-2021-41436An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U,
- CVE-2021-3976Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-41532Unauthenticated access to Ozone Recon HTTP endpointsApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-39236Owners of the S3 tokens are not validatedApache Software Foundation Apache Ozone · org.apache.hadoop…
- CVE-2021-39235Access mode of block tokens are not enforcedApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-39234Raw block data can be read bypassing ACL/authorizationApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-39233Container-related datanode operations can be called without authorizationApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-39232Missing admin check for SCM related admin commandsApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-39231Missing authentication/authorization on internal RPC endpointsApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-36372Original block tokens are persisted and can be retrievedApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2021-44033In Ionic Identity Vault before 5.0.5, the protection mechanism for invalid unlock attempts can be bypassed.
- CVE-2021-44025Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type w