CVEs published November 22, 2021
54 CVEs were published on November 22, 2021: 1 critical, 13 high.
- Published
- 54
- Critical
- 1
- High
- 13
- Medium
- 10
- Low
- 2
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Adobe Prelude
- 8
- Amazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6
- 4
- moodle · moodle/moodle
- 4
- Adobe Bridge
- 2
- Adobe InCopy
- 2
- WECON PLC Editor
- 2
- Apache Software Foundation Apache APISIX
- 1
- asterix-decoder
- 1
- docker-cli-js
- 1
- EFM networks & multimedia ipTIME C200 IP Camera
- 1
Critical 1
High 13
- CVE-2021-42705WECON PLC EditorWECON PLC Editor
- CVE-2021-42707WECON PLC EditorWECON PLC Editor
- CVE-2021-38448Trane Symbio Improper Control of Generation of CodeTrane Symbio
- CVE-2021-42727Adobe Bridge Buffer Overflow Arbitrary code executionAdobe Bridge
- CVE-2021-43015Adobe InCopy GIF File Parsing Memory Corruption Arbitrary Code ExecutionAdobe InCopy
- CVE-2021-42738Adobe Prelude MXF File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2021-42737Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2021-40775Adobe Prelude SVG File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2021-40772Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2021-40771Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2021-40770Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code ExecutionAdobe Prelude
- CVE-2020-7882anySign directory traversal vulnerabilityHancomwith anySign4PC
- CVE-2021-26614IpTime C200 IP camera remote code execution vulnerabilityEFM networks & multimedia ipTIME C200 IP Camera
Medium, low and unrated 40
- CVE-2021-40831Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devicesAmazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6
- CVE-2021-40830Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsAmazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6
- CVE-2021-40829TLS hostname validation issues within AWS IoT Device SDKs on macOSAmazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6
- CVE-2021-40828TLS hostname validation issues within AWS IoT Device SDKs on WindowsAmazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6
- CVE-2020-22719Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi
- CVE-2021-44150The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.
- CVE-2021-44147An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose loc
- CVE-2021-32004GateManager does not enforce strict hostname matching for WEB serverSecomea GateManager
- CVE-2021-44144Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date.asterix-decoder
- CVE-2021-44143A flaw was found in mbsync in isync 1.4.0 through 1.4.3.
- CVE-2021-23673Cross-site Scripting (XSS)pekeupload
- CVE-2021-23718Server-side Request Forgery (SSRF)ssrf-agent
- CVE-2019-5640Rapid7 Nexpose Information Disclosure after logoutRapid7 Nexpose
- CVE-2021-43560A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2021-43559A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2021-43558A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2021-3943A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions.moodle · moodle/moodle
- CVE-2021-3935When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection ipgbouncer
- CVE-2021-43016Adobe InCopy NULL Pointer Dereference Application Denial of ServiceAdobe InCopy
- CVE-2021-42733Adobe Bridge NULL Pointer Dereference could lead to Application denial-of-serviceAdobe Bridge
- CVE-2021-40774Adobe Prelude NULL Pointer Dereference Application Denial of ServiceAdobe Prelude
- CVE-2021-40773Adobe Prelude NULL Pointer Dereference Application Denial of ServiceAdobe Prelude
- CVE-2021-43582A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11.
- CVE-2021-43581An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11.
- CVE-2021-38378OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name.
- CVE-2021-38377OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable
- CVE-2021-38376OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call.
- CVE-2021-38375OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message.
- CVE-2021-38374OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL.
- CVE-2021-38146The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p
- CVE-2021-33495OX App Suite 7.10.5 allows XSS via an OX Chat system message.
- CVE-2021-33494OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.
- CVE-2021-43557Path traversal in request_uri variableApache Software Foundation Apache APISIX
- CVE-2021-33493The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.
- CVE-2021-33492OX App Suite 7.10.5 allows XSS via an OX Chat room name.
- CVE-2021-33491OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths
- CVE-2021-33490OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.
- CVE-2021-33489OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.
- CVE-2021-33488chat in OX App Suite 7.10.5 has Improper Input Validation.
- CVE-2021-44079In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially