CVEs published November 23, 2021
89 CVEs were published on November 23, 2021: 2 critical, 9 high. 2 are now in CISA KEV.
- Published
- 89
- Critical
- 2
- High
- 9
- Medium
- 16
- Low
- 1
- Unrated
- 61
- Now in CISA KEV
- 2
- Fix available
- 41
Most affected products
- Huawei HarmonyOS
- 20
- Google Chrome
- 8
- Dell CloudLink
- 7
- Huawei EMUI · Huawei Magic UI
- 7
- getredash redash
- 3
- Integrated Dell Remote Access Controller
- 3
- D-Link DWR-932C E1
- 2
- IBM Connect:Direct Web Services
- 2
- Images to WebP
- 2
- McAfee Policy Auditor
- 2
Critical 2
High 9
- CVE-2021-41192Insecure default configurationgetredash redash
- CVE-2021-38003Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-35033A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managemZyxel NBG6818 series firmware · Zyxel NBG7815 series fir… +4
- CVE-2021-36314Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability.Dell CloudLink
- CVE-2021-36299Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-21561Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability.Dell PowerScale OneFS
- CVE-2021-41281Path traversal in Matrix Synapsematrix-org synapse · matrix-synapse
- CVE-2021-43775Arbitrary file reading vulnerability in Aimaimhubio aim · aim
- CVE-2021-43019Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation VulnerabilityAdobe Creative Cloud
Medium, low and unrated 78
- CVE-2021-43780Server-Side Request Forgery (SSRF) in Redashgetredash redash
- CVE-2021-43777Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)getredash redash
- CVE-2021-42783Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4D-Link DWR-932C E1
- CVE-2021-42784OS Command Injection in debug_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4D-Link DWR-932C E1
- CVE-2021-42785Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59GlavSoft TightVNC Viewer
- CVE-2021-38004Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2021-38002Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape viaGoogle Chrome
- CVE-2021-38001Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-38000Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitraGoogle Chrome
- CVE-2021-37999Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts orGoogle Chrome
- CVE-2021-37998Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-37997Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potenGoogle Chrome
- CVE-2021-36335Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability.Dell CloudLink
- CVE-2021-36334Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability.Dell CloudLink
- CVE-2021-36333Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability.Dell CloudLink
- CVE-2021-36332Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability.Dell CloudLink
- CVE-2021-36311Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability.Dell NetWorker
- CVE-2021-36301Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.Integrated Dell Remote Access Controller
- CVE-2021-36300iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.Integrated Dell Remote Access Controller
- CVE-2021-25986Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications SectionDjango-wiki · wiki
- CVE-2021-31851Cross-Site Scripting vulnerability in Policy AuditorMcAfee Policy Auditor
- CVE-2021-31852Cross-Site Scripting vulnerability in Policy AuditorMcAfee Policy Auditor
- CVE-2021-24894Reviews Plus < 1.2.14 - Subscriber+ Reviews DoSReviews Plus
- CVE-2021-24892Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDORTODO Advanced Forms Ppro · TODO Advanced Forms
- CVE-2021-24891Elementor < 3.4.8 - DOM Cross-Site-ScriptingElementor Website Builder
- CVE-2021-24888ImageBoss < 3.0.6 - Admin+ Stored Cross-Site ScriptingImageBoss – Images Up To 60% Smaller & CDN
- CVE-2021-24882Slideshow Gallery < 1.7.4 - Admin+ Stored Cross-Site ScriptingSlideshow Gallery
- CVE-2021-24877MainWP Child < 4.1.8 - Admin+ SQL InjectionMainWP Child - Securely connects sites to the MainWP WordPr…
- CVE-2021-24875eCommerce Product Catalog for WordPress < 3.0.39 - Reflected Cross-Site ScriptingeCommerce Product Catalog Plugin for WordPress
- CVE-2021-24873Tutor LMS < 1.9.11 - Reflected Cross-Site ScriptingTutor LMS – eLearning and online course solution
- CVE-2021-24830Advanced Access Manager < 6.8.0 - Admin+ Stored Cross-Site ScriptingAdvanced Access Manager
- CVE-2021-24812BetterLinks < 1.2.6 - Admin+ Stored Cross-Site ScriptingBetterLinks – Shorten, Track and Manage any URL
- CVE-2021-24729Logo Showcase with Slick Slider < 1.2.4 - Author+ Stored Cross Site ScriptingLogo Showcase with Slick Slider – Logo Carousel, Logo Slide…
- CVE-2021-24713Video Lessons Manager - Admin+ Stored Cross-Site ScriptingTODO Video Lessons Manager – Best Video Course LMS · TODO V…
- CVE-2021-24703Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin ActivationDownload Plugin
- CVE-2021-24700Forminator < 1.15.4 - Admin+ Stored Cross-Site ScriptingForminator – Contact Form, Payment Form & Custom Form Build…
- CVE-2021-24668MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRFMAZ Loader – Preloader Builder for WordPress
- CVE-2021-24644Images to WebP < 1.9 - Authenticated Local File InclusionImages to WebP
- CVE-2021-24641Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)Images to WebP
- CVE-2021-38980IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtIBM Security Key Lifecycle Manager
- CVE-2021-38891IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrIBM Connect:Direct Web Services
- CVE-2021-38890IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute IBM Connect:Direct Web Services
- CVE-2021-38875IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messagesIBM MQ
- CVE-2021-35052A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High.Kaspersky Password Manager for Windows
- CVE-2021-37013There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the availabHuawei HarmonyOS
- CVE-2021-37006There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Huawei HarmonyOS
- CVE-2021-37010There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulHuawei HarmonyOS
- CVE-2021-37022There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permiHuawei HarmonyOS
- CVE-2021-37023There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files wHuawei HarmonyOS
- CVE-2021-37024There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37025There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37004There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37012There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.Huawei HarmonyOS
- CVE-2021-37018There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.Huawei HarmonyOS
- CVE-2021-37005There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37017There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37026There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37019There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37003There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37015There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.Huawei HarmonyOS
- CVE-2021-37008There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crasHuawei HarmonyOS
- CVE-2021-37016There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Information DiscloHuawei HarmonyOS
- CVE-2021-37007There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash.Huawei HarmonyOS
- CVE-2021-37009There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of Huawei HarmonyOS
- CVE-2021-37035There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedHuawei EMUI · Huawei Magic UI
- CVE-2021-37034There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentialityHuawei EMUI · Huawei Magic UI
- CVE-2021-37033There is an Injection attack vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availabilitHuawei EMUI · Huawei Magic UI
- CVE-2021-37032There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to workHuawei EMUI · Huawei Magic UI
- CVE-2021-37031There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpectedHuawei EMUI · Huawei Magic UI
- CVE-2021-37030There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availabiHuawei EMUI · Huawei Magic UI
- CVE-2021-37029There is an Identity verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availaHuawei EMUI · Huawei Magic UI
- CVE-2021-22356There is a weak secure algorithm vulnerability in Huawei products.IPS Module;NGFW Module;Secospace USG6300;Secospace USG6500;…
- CVE-2021-37102There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file.FusionCompute
- CVE-2021-37036There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10.FusionCompute;eCNS280_TD
- CVE-2021-22410There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10.iMaster NCE-Fabric
- CVE-2021-39976There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600.CloudEngine
- CVE-2021-20601Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GTGOT2000 series GT27 model; GOT2000 series GT25 model; GOT20…
- CVE-2021-3672A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to oc-ares