# CVEs published 2021-11-22

54 CVEs were published on November 22, 2021: 1 critical, 13 high. Days are UTC.

- [CVE-2021-40831](https://cve.now/CVE-2021-40831.md): Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devices (CVSS 6.3, Amazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6)
- [CVE-2021-40830](https://cve.now/CVE-2021-40830.md): Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systems (CVSS 6.3, Amazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6)
- [CVE-2021-40829](https://cve.now/CVE-2021-40829.md): TLS hostname validation issues within AWS IoT Device SDKs on macOS (CVSS 6.3, Amazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6)
- [CVE-2021-40828](https://cve.now/CVE-2021-40828.md): TLS hostname validation issues within AWS IoT Device SDKs on Windows (CVSS 6.3, Amazon Web Services AWS IoT Device SDK v2 for Java · Ama… +6)
- [CVE-2020-22719](https://cve.now/CVE-2020-22719.md): Shimo Document v2.0.1 contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML vi (no CVSS)
- [CVE-2021-44150](https://cve.now/CVE-2021-44150.md): The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content. (no CVSS)
- [CVE-2021-44147](https://cve.now/CVE-2021-44147.md): An XML External Entity issue in Claris FileMaker Pro and Server (including WebDirect) before 19.4.1 allows a remote attacker to disclose loc (no CVSS)
- [CVE-2021-32004](https://cve.now/CVE-2021-32004.md): GateManager does not enforce strict hostname matching for WEB server (CVSS 3.7, Secomea GateManager)
- [CVE-2021-44144](https://cve.now/CVE-2021-44144.md): Croatia Control Asterix 2.8.1 has a heap-based buffer over-read, with additional details to be disclosed at a later date. (no CVSS, asterix-decoder)
- [CVE-2021-44143](https://cve.now/CVE-2021-44143.md): A flaw was found in mbsync in isync 1.4.0 through 1.4.3. (no CVSS)
- [CVE-2021-42705](https://cve.now/CVE-2021-42705.md): WECON PLC Editor (CVSS 7.8, WECON PLC Editor)
- [CVE-2021-42707](https://cve.now/CVE-2021-42707.md): WECON PLC Editor (CVSS 7.8, WECON PLC Editor)
- [CVE-2021-38448](https://cve.now/CVE-2021-38448.md): Trane Symbio Improper Control of Generation of Code (CVSS 7.5, Trane Symbio)
- [CVE-2021-23673](https://cve.now/CVE-2021-23673.md): Cross-site Scripting (XSS) (CVSS 5.4, pekeupload)
- [CVE-2021-23732](https://cve.now/CVE-2021-23732.md): Arbitrary Code Execution (CVSS 9.0, docker-cli-js)
- [CVE-2021-23718](https://cve.now/CVE-2021-23718.md): Server-side Request Forgery (SSRF) (CVSS 6.5, ssrf-agent)
- [CVE-2019-5640](https://cve.now/CVE-2019-5640.md): Rapid7 Nexpose Information Disclosure after logout (CVSS 3.3, Rapid7 Nexpose)
- [CVE-2021-43560](https://cve.now/CVE-2021-43560.md): A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-43559](https://cve.now/CVE-2021-43559.md): A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-43558](https://cve.now/CVE-2021-43558.md): A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-3943](https://cve.now/CVE-2021-3943.md): A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. (no CVSS, moodle · moodle/moodle)
- [CVE-2021-3935](https://cve.now/CVE-2021-3935.md): When PgBouncer is configured to use "cert" authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection i (no CVSS, pgbouncer)
- [CVE-2021-42727](https://cve.now/CVE-2021-42727.md): Adobe Bridge Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Bridge)
- [CVE-2021-43016](https://cve.now/CVE-2021-43016.md): Adobe InCopy NULL Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe InCopy)
- [CVE-2021-43015](https://cve.now/CVE-2021-43015.md): Adobe InCopy GIF File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe InCopy)
- [CVE-2021-42738](https://cve.now/CVE-2021-42738.md): Adobe Prelude MXF File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-42737](https://cve.now/CVE-2021-42737.md): Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-42733](https://cve.now/CVE-2021-42733.md): Adobe Bridge NULL Pointer Dereference could lead to Application denial-of-service (CVSS 5.5, Adobe Bridge)
- [CVE-2021-40775](https://cve.now/CVE-2021-40775.md): Adobe Prelude SVG File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-40774](https://cve.now/CVE-2021-40774.md): Adobe Prelude NULL Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe Prelude)
- [CVE-2021-40773](https://cve.now/CVE-2021-40773.md): Adobe Prelude NULL Pointer Dereference Application Denial of Service (CVSS 5.5, Adobe Prelude)
- [CVE-2021-40772](https://cve.now/CVE-2021-40772.md): Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-40771](https://cve.now/CVE-2021-40771.md): Adobe Prelude WAV File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2021-40770](https://cve.now/CVE-2021-40770.md): Adobe Prelude M4A File Parsing Memory Corruption Arbitrary Code Execution (CVSS 7.8, Adobe Prelude)
- [CVE-2020-7882](https://cve.now/CVE-2020-7882.md): anySign directory traversal vulnerability (CVSS 7.5, Hancomwith anySign4PC)
- [CVE-2021-26614](https://cve.now/CVE-2021-26614.md): IpTime C200 IP camera remote code execution vulnerability (CVSS 7.5, EFM networks & multimedia ipTIME C200 IP Camera)
- [CVE-2021-43582](https://cve.now/CVE-2021-43582.md): A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. (no CVSS)
- [CVE-2021-43581](https://cve.now/CVE-2021-43581.md): An Out-of-Bounds Read vulnerability exists when reading a U3D file using Open Design Alliance PRC SDK before 2022.11. (no CVSS)
- [CVE-2021-38378](https://cve.now/CVE-2021-38378.md): OX App Suite 7.10.5 allows Information Exposure because a caching mechanism can caused a Modified By response to show a person's name. (no CVSS)
- [CVE-2021-38377](https://cve.now/CVE-2021-38377.md): OX App Suite through 7.10.5 allows XSS via JavaScript code in an anchor HTML comment within truncated e-mail, because there is a predictable (no CVSS)
- [CVE-2021-38376](https://cve.now/CVE-2021-38376.md): OX App Suite through 7.10.5 has Incorrect Access Control for retrieval of session information via the rampup action of the login API call. (no CVSS)
- [CVE-2021-38375](https://cve.now/CVE-2021-38375.md): OX App Suite through 7.10.5 allows XSS via the alt attribute of an IMG element in a truncated e-mail message. (no CVSS)
- [CVE-2021-38374](https://cve.now/CVE-2021-38374.md): OX App Suite through through 7.10.5 allows XSS via a crafted snippet that has an app loader reference within an app loader URL. (no CVSS)
- [CVE-2021-38146](https://cve.now/CVE-2021-38146.md): The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1\_02\_11\_2020) allows remote attackers to read arbitrary files via absolute p (no CVSS)
- [CVE-2021-33495](https://cve.now/CVE-2021-33495.md): OX App Suite 7.10.5 allows XSS via an OX Chat system message. (no CVSS)
- [CVE-2021-33494](https://cve.now/CVE-2021-33494.md): OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering. (no CVSS)
- [CVE-2021-43557](https://cve.now/CVE-2021-43557.md): Path traversal in request\_uri variable (no CVSS, Apache Software Foundation Apache APISIX)
- [CVE-2021-33493](https://cve.now/CVE-2021-33493.md): The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format. (no CVSS)
- [CVE-2021-33492](https://cve.now/CVE-2021-33492.md): OX App Suite 7.10.5 allows XSS via an OX Chat room name. (no CVSS)
- [CVE-2021-33491](https://cve.now/CVE-2021-33491.md): OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths (no CVSS)
- [CVE-2021-33490](https://cve.now/CVE-2021-33490.md): OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature. (no CVSS)
- [CVE-2021-33489](https://cve.now/CVE-2021-33489.md): OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file. (no CVSS)
- [CVE-2021-33488](https://cve.now/CVE-2021-33488.md): chat in OX App Suite 7.10.5 has Improper Input Validation. (no CVSS)
- [CVE-2021-44079](https://cve.now/CVE-2021-44079.md): In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5, untrusted user agents are passed to a curl command line, potentially (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.