CVEs published November 24, 2021
43 CVEs were published on November 24, 2021: 2 critical, 3 high.
- Published
- 43
- Critical
- 2
- High
- 3
- Medium
- 12
- Low
- 2
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- xen
- 6
- Apache Software Foundation Apache JSPWiki · org.apache.jspw…
- 2
- EC-CUBE CO. EC-CUBE 2 series · ec-cube/ec-cube
- 2
- Microsoft Edge
- 2
- Microsoft Windows Update Assistant
- 2
- VMware vCenter Server and VMware Cloud Foundation
- 2
- wpWave Hide My WP
- 2
- Yamaha RTX830, NVR510, NVR700W, RTX1210
- 2
- Alfasado PowerCMS XMLRPC API
- 1
- Android App 'Mercari (Merpay) - Marketplace and Mobile Paym…
- 1
Critical 2
High 3
- CVE-2021-34423Buffer overflow in Zoom client and other productsZoom Video Communications Zoom Client for Meetings · Zo… +16
- CVE-2021-36916WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerabilitywpWave Hide My WP
- CVE-2021-42306Azure Active Directory Information Disclosure VulnerabilityMicrosoft Azure Active Directory · Microsoft Azure Autom… +2
Medium, low and unrated 38
- CVE-2021-44219Gin-Vue-Admin before 2.4.6 mishandles a SQL database.
- CVE-2021-41270CSV Injection in Symfonysymfony · symfony/serializer +1
- CVE-2021-41267Webcache Poisoning in Symfonysymfony · symfony/http-kernel +1
- CVE-2021-41268Cookie persistence in Symfonysymfony · symfony/security-bundle +1
- CVE-2021-22957A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor UniFi Protect application
- CVE-2021-34424Process memory exposure in Zoom Client and other productsZoom Video Communications Zoom Client for Meetings · Zo… +15
- CVE-2021-22049The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in.VMware vCenter Server and VMware Cloud Foundation
- CVE-2021-21980The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability.VMware vCenter Server and VMware Cloud Foundation
- CVE-2021-36917WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerabilitywpWave Hide My WP
- CVE-2021-43268An issue was discovered in VxWorks 6.9 through 7.
- CVE-2021-38873IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection.IBM Planning Analytics
- CVE-2021-3553Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825)Bitdefender Endpoint Security Tools · Bitdefender Unifie… +1
- CVE-2021-3552Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)Bitdefender Endpoint Security Tools · Bitdefender GravityZo…
- CVE-2021-44140Arbitrary file deletion on logoutApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2021-40369XSS vulnerability on Denounce pluginApache Software Foundation Apache JSPWiki · org.apache.jspw…
- CVE-2021-32037User may trigger invariant when allowed to send commands directly to shardsMongoDB Server
- CVE-2021-20850PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life,Alfasado PowerCMS XMLRPC API
- CVE-2021-20848Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified Zack Scholl rwtxt · github.com/schollz/rwtxt
- CVE-2021-20846Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker Delite Studio Push Notifications for WordPress
- CVE-2021-20845Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack theXML-Sitemaps Unlimited Sitemap Generator
- CVE-2021-20844Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510Yamaha RTX830, NVR510, NVR700W, RTX1210
- CVE-2021-20843Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15Yamaha RTX830, NVR510, NVR700W, RTX1210
- CVE-2021-20842Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication oEC-CUBE CO. EC-CUBE 2 series · ec-cube/ec-cube
- CVE-2021-20841Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access reEC-CUBE CO. EC-CUBE 2 series · ec-cube/ec-cube
- CVE-2021-20840Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attackeSaasproject Booking Package - Appointment Booking Calendar…
- CVE-2021-20835Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments AppAndroid App 'Mercari (Merpay) - Marketplace and Mobile Paym…
- CVE-2021-43221Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2021-43220Microsoft Edge for iOS Spoofing VulnerabilityMicrosoft Edge for iOS
- CVE-2021-43211Windows 10 Update Assistant Elevation of Privilege VulnerabilityMicrosoft Windows Update Assistant
- CVE-2021-42308Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2021-42297Windows 10 Update Assistant Elevation of Privilege VulnerabilityMicrosoft Windows Update Assistant
- CVE-2021-31822When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured.Octopus Deploy Octopus Tentacle
- CVE-2021-28704PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corxen
- CVE-2021-28705issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vxen
- CVE-2021-28706guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalxen
- CVE-2021-28707PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corxen
- CVE-2021-28708PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corxen
- CVE-2021-28709issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vxen