# CVEs published 2021-11-23

89 CVEs were published on November 23, 2021: 2 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2021-43780](https://cve.now/CVE-2021-43780.md): Server-Side Request Forgery (SSRF) in Redash (CVSS 6.8, getredash redash)
- [CVE-2021-41192](https://cve.now/CVE-2021-41192.md): Insecure default configuration (CVSS 8.1, getredash redash)
- [CVE-2021-43777](https://cve.now/CVE-2021-43777.md): Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce) (CVSS 6.8, getredash redash)
- [CVE-2021-42783](https://cve.now/CVE-2021-42783.md): Missing Authentication in debug\_post\_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4 (no CVSS, D-Link DWR-932C E1)
- [CVE-2021-42784](https://cve.now/CVE-2021-42784.md): OS Command Injection in debug\_fcgi in D-Link DWR-932C E1 Firmware 1.0.0.4 (no CVSS, D-Link DWR-932C E1)
- [CVE-2021-42785](https://cve.now/CVE-2021-42785.md): Buffer Overflow in tvnviewer.exe via Crafted Packet in TightVNC Viewer 2.8.59 (no CVSS, GlavSoft TightVNC Viewer)
- [CVE-2021-38004](https://cve.now/CVE-2021-38004.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to leak cross-origin data via a (no CVSS, Google Chrome)
- [CVE-2021-38003](https://cve.now/CVE-2021-38003.md): Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, KEV, Google Chrome)
- [CVE-2021-38002](https://cve.now/CVE-2021-38002.md): Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via (no CVSS, Google Chrome)
- [CVE-2021-38001](https://cve.now/CVE-2021-38001.md): Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-38000](https://cve.now/CVE-2021-38000.md): Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitra (CVSS 6.1, KEV, Google Chrome)
- [CVE-2021-37999](https://cve.now/CVE-2021-37999.md): Insufficient data validation in New Tab Page in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or (no CVSS, Google Chrome)
- [CVE-2021-37998](https://cve.now/CVE-2021-37998.md): Use after free in Garbage Collection in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-37997](https://cve.now/CVE-2021-37997.md): Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to poten (no CVSS, Google Chrome)
- [CVE-2021-35033](https://cve.now/CVE-2021-35033.md): A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password managem (CVSS 7.8, Zyxel NBG6818 series firmware · Zyxel NBG7815 series fir… +4)
- [CVE-2021-36335](https://cve.now/CVE-2021-36335.md): Dell EMC CloudLink 7.1 and all prior versions contain an Improper Input Validation Vulnerability. (CVSS 4.3, Dell CloudLink)
- [CVE-2021-36334](https://cve.now/CVE-2021-36334.md): Dell EMC CloudLink 7.1 and all prior versions contain a CSV formula Injection Vulnerability. (CVSS 5.9, Dell CloudLink)
- [CVE-2021-36333](https://cve.now/CVE-2021-36333.md): Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. (CVSS 5.5, Dell CloudLink)
- [CVE-2021-36332](https://cve.now/CVE-2021-36332.md): Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. (CVSS 5.4, Dell CloudLink)
- [CVE-2021-36314](https://cve.now/CVE-2021-36314.md): Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. (CVSS 7.1, Dell CloudLink)
- [CVE-2021-36313](https://cve.now/CVE-2021-36313.md): Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. (CVSS 9.1, Dell CloudLink)
- [CVE-2021-36312](https://cve.now/CVE-2021-36312.md): Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. (CVSS 9.1, Dell CloudLink)
- [CVE-2021-36311](https://cve.now/CVE-2021-36311.md): Dell EMC Networker versions prior to 19.5 contain an Improper Authorization vulnerability. (CVSS 6.0, Dell NetWorker)
- [CVE-2021-36301](https://cve.now/CVE-2021-36301.md): Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. (CVSS 5.9, Integrated Dell Remote Access Controller)
- [CVE-2021-36300](https://cve.now/CVE-2021-36300.md): iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. (CVSS 6.5, Integrated Dell Remote Access Controller)
- [CVE-2021-36299](https://cve.now/CVE-2021-36299.md): Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. (CVSS 7.1, Integrated Dell Remote Access Controller)
- [CVE-2021-21561](https://cve.now/CVE-2021-21561.md): Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2021-25986](https://cve.now/CVE-2021-25986.md): Django-wiki - Stored Cross-Site Scripting (XSS) in Notifications Section (CVSS 5.4, Django-wiki · wiki)
- [CVE-2021-31851](https://cve.now/CVE-2021-31851.md): Cross-Site Scripting vulnerability in Policy Auditor (CVSS 6.1, McAfee Policy Auditor)
- [CVE-2021-31852](https://cve.now/CVE-2021-31852.md): Cross-Site Scripting vulnerability in Policy Auditor (CVSS 6.1, McAfee Policy Auditor)
- [CVE-2021-24894](https://cve.now/CVE-2021-24894.md): Reviews Plus \< 1.2.14 - Subscriber+ Reviews DoS (no CVSS, Reviews Plus)
- [CVE-2021-24892](https://cve.now/CVE-2021-24892.md): Advanced Forms \< 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR (no CVSS, TODO Advanced Forms Ppro · TODO Advanced Forms)
- [CVE-2021-24891](https://cve.now/CVE-2021-24891.md): Elementor \< 3.4.8 - DOM Cross-Site-Scripting (no CVSS, Elementor Website Builder)
- [CVE-2021-24888](https://cve.now/CVE-2021-24888.md): ImageBoss \< 3.0.6 - Admin+ Stored Cross-Site Scripting (no CVSS, ImageBoss – Images Up To 60% Smaller & CDN)
- [CVE-2021-24882](https://cve.now/CVE-2021-24882.md): Slideshow Gallery \< 1.7.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Slideshow Gallery)
- [CVE-2021-24877](https://cve.now/CVE-2021-24877.md): MainWP Child \< 4.1.8 - Admin+ SQL Injection (no CVSS, MainWP Child - Securely connects sites to the MainWP WordPr…)
- [CVE-2021-24875](https://cve.now/CVE-2021-24875.md): eCommerce Product Catalog for WordPress \< 3.0.39 - Reflected Cross-Site Scripting (no CVSS, eCommerce Product Catalog Plugin for WordPress)
- [CVE-2021-24873](https://cve.now/CVE-2021-24873.md): Tutor LMS \< 1.9.11 - Reflected Cross-Site Scripting (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24830](https://cve.now/CVE-2021-24830.md): Advanced Access Manager \< 6.8.0 - Admin+ Stored Cross-Site Scripting (no CVSS, Advanced Access Manager)
- [CVE-2021-24812](https://cve.now/CVE-2021-24812.md): BetterLinks \< 1.2.6 - Admin+ Stored Cross-Site Scripting (no CVSS, BetterLinks – Shorten, Track and Manage any URL)
- [CVE-2021-24729](https://cve.now/CVE-2021-24729.md): Logo Showcase with Slick Slider \< 1.2.4 - Author+ Stored Cross Site Scripting (no CVSS, Logo Showcase with Slick Slider – Logo Carousel, Logo Slide…)
- [CVE-2021-24713](https://cve.now/CVE-2021-24713.md): Video Lessons Manager - Admin+ Stored Cross-Site Scripting (no CVSS, TODO Video Lessons Manager – Best Video Course LMS · TODO V…)
- [CVE-2021-24703](https://cve.now/CVE-2021-24703.md): Download Plugin \< 1.6.1 - Subscriber+ Arbitrary Plugin Activation (no CVSS, Download Plugin)
- [CVE-2021-24700](https://cve.now/CVE-2021-24700.md): Forminator \< 1.15.4 - Admin+ Stored Cross-Site Scripting (no CVSS, Forminator – Contact Form, Payment Form & Custom Form Build…)
- [CVE-2021-24668](https://cve.now/CVE-2021-24668.md): MAZ Loader \< 1.4.1 - Arbitrary Loader Deletion via CSRF (no CVSS, MAZ Loader – Preloader Builder for WordPress)
- [CVE-2021-24644](https://cve.now/CVE-2021-24644.md): Images to WebP \< 1.9 - Authenticated Local File Inclusion (no CVSS, Images to WebP)
- [CVE-2021-24641](https://cve.now/CVE-2021-24641.md): Images to WebP \< 1.9 - Multiple Cross Site Request Forgery (CSRF) (no CVSS, Images to WebP)
- [CVE-2021-38980](https://cve.now/CVE-2021-38980.md): IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obt (CVSS 2.7, IBM Security Key Lifecycle Manager)
- [CVE-2021-38891](https://cve.now/CVE-2021-38891.md): IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decr (CVSS 5.9, IBM Connect:Direct Web Services)
- [CVE-2021-38890](https://cve.now/CVE-2021-38890.md): IBM Sterling Connect:Direct Web Services 1.0 and 6.0 uses an inadequate account lockout setting that could allow a remote attacker to brute (CVSS 5.9, IBM Connect:Direct Web Services)
- [CVE-2021-38875](https://cve.now/CVE-2021-38875.md): IBM MQ 8.0, 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.1 CD, and 9.2 CD is vulnerable to a denial of service attack caused by an error processing messages (CVSS 6.5, IBM MQ)
- [CVE-2021-41281](https://cve.now/CVE-2021-41281.md): Path traversal in Matrix Synapse (CVSS 7.5, matrix-org synapse · matrix-synapse)
- [CVE-2021-43775](https://cve.now/CVE-2021-43775.md): Arbitrary file reading vulnerability in Aim (CVSS 8.6, aimhubio aim · aim)
- [CVE-2021-43019](https://cve.now/CVE-2021-43019.md): Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability (CVSS 7.8, Adobe Creative Cloud)
- [CVE-2021-35052](https://cve.now/CVE-2021-35052.md): A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to High. (no CVSS, Kaspersky Password Manager for Windows)
- [CVE-2021-37013](https://cve.now/CVE-2021-37013.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the availab (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37006](https://cve.now/CVE-2021-37006.md): There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37010](https://cve.now/CVE-2021-37010.md): There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vul (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37022](https://cve.now/CVE-2021-37022.md): There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permi (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37023](https://cve.now/CVE-2021-37023.md): There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause media files w (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37024](https://cve.now/CVE-2021-37024.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37025](https://cve.now/CVE-2021-37025.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37004](https://cve.now/CVE-2021-37004.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37012](https://cve.now/CVE-2021-37012.md): There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37018](https://cve.now/CVE-2021-37018.md): There is a Data Processing Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37005](https://cve.now/CVE-2021-37005.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37017](https://cve.now/CVE-2021-37017.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37026](https://cve.now/CVE-2021-37026.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37019](https://cve.now/CVE-2021-37019.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37003](https://cve.now/CVE-2021-37003.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37015](https://cve.now/CVE-2021-37015.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37008](https://cve.now/CVE-2021-37008.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37016](https://cve.now/CVE-2021-37016.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause Information Disclo (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37007](https://cve.now/CVE-2021-37007.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause kernel crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37009](https://cve.now/CVE-2021-37009.md): There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37035](https://cve.now/CVE-2021-37035.md): There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpected (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37034](https://cve.now/CVE-2021-37034.md): There is an Unstandardized field names in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37033](https://cve.now/CVE-2021-37033.md): There is an Injection attack vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availabilit (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37032](https://cve.now/CVE-2021-37032.md): There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37031](https://cve.now/CVE-2021-37031.md): There is a Remote DoS vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the app to exit unexpected (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37030](https://cve.now/CVE-2021-37030.md): There is an Improper permission vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availabi (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37029](https://cve.now/CVE-2021-37029.md): There is an Identity verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service availa (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-22356](https://cve.now/CVE-2021-22356.md): There is a weak secure algorithm vulnerability in Huawei products. (no CVSS, IPS Module;NGFW Module;Secospace USG6300;Secospace USG6500;…)
- [CVE-2021-37102](https://cve.now/CVE-2021-37102.md): There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. (no CVSS, FusionCompute)
- [CVE-2021-37036](https://cve.now/CVE-2021-37036.md): There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280\_TD V100R005C00 and V100R005C10. (no CVSS, FusionCompute;eCNS280\_TD)
- [CVE-2021-22410](https://cve.now/CVE-2021-22410.md): There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. (no CVSS, iMaster NCE-Fabric)
- [CVE-2021-39976](https://cve.now/CVE-2021-39976.md): There is a privilege escalation vulnerability in CloudEngine 5800 V200R020C00SPC600. (no CVSS, CloudEngine)
- [CVE-2021-20601](https://cve.now/CVE-2021-20601.md): Improper input validation vulnerability in GOT2000 series GT27 model all versions, GOT2000 series GT25 model all versions, GOT2000 series GT (no CVSS, GOT2000 series GT27 model; GOT2000 series GT25 model; GOT20…)
- [CVE-2021-3672](https://cve.now/CVE-2021-3672.md): A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to o (no CVSS, c-ares)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.