# CVEs published 2021-11-24

43 CVEs were published on November 24, 2021: 2 critical, 3 high. Days are UTC.

- [CVE-2021-44219](https://cve.now/CVE-2021-44219.md): Gin-Vue-Admin before 2.4.6 mishandles a SQL database. (no CVSS)
- [CVE-2021-41270](https://cve.now/CVE-2021-41270.md): CSV Injection in Symfony (CVSS 6.5, symfony · symfony/serializer +1)
- [CVE-2021-41267](https://cve.now/CVE-2021-41267.md): Webcache Poisoning in Symfony (CVSS 6.5, symfony · symfony/http-kernel +1)
- [CVE-2021-41268](https://cve.now/CVE-2021-41268.md): Cookie persistence in Symfony (CVSS 6.5, symfony · symfony/security-bundle +1)
- [CVE-2021-43778](https://cve.now/CVE-2021-43778.md): Path traversal in GLPI barcode plugin (CVSS 9.1, pluginsGLPI barcode)
- [CVE-2021-22957](https://cve.now/CVE-2021-22957.md): A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor (no CVSS, UniFi Protect application)
- [CVE-2021-34424](https://cve.now/CVE-2021-34424.md): Process memory exposure in Zoom Client and other products (CVSS 5.3, Zoom Video Communications Zoom Client for Meetings · Zo… +15)
- [CVE-2021-34423](https://cve.now/CVE-2021-34423.md): Buffer overflow in Zoom client and other products (CVSS 7.3, Zoom Video Communications Zoom Client for Meetings · Zo… +16)
- [CVE-2021-22049](https://cve.now/CVE-2021-22049.md): The vSphere Web Client (FLEX/Flash) contains an SSRF (Server Side Request Forgery) vulnerability in the vSAN Web Client (vSAN UI) plug-in. (no CVSS, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-21980](https://cve.now/CVE-2021-21980.md): The vSphere Web Client (FLEX/Flash) contains an unauthorized arbitrary file read vulnerability. (no CVSS, VMware vCenter Server and VMware Cloud Foundation)
- [CVE-2021-36916](https://cve.now/CVE-2021-36916.md): WordPress Hide My WP premium plugin \<= 6.2.3 - Unauthenticated SQL injection (SQLi) vulnerability (CVSS 8.6, wpWave Hide My WP)
- [CVE-2021-36917](https://cve.now/CVE-2021-36917.md): WordPress Hide My WP premium plugin \<= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability (CVSS 6.5, wpWave Hide My WP)
- [CVE-2021-43268](https://cve.now/CVE-2021-43268.md): An issue was discovered in VxWorks 6.9 through 7. (no CVSS)
- [CVE-2021-38873](https://cve.now/CVE-2021-38873.md): IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. (CVSS 6.8, IBM Planning Analytics)
- [CVE-2021-3553](https://cve.now/CVE-2021-3553.md): Server-Side Request Forgery in EPPUpdateService remote config file (VA-9825) (CVSS 5.3, Bitdefender Endpoint Security Tools · Bitdefender Unifie… +1)
- [CVE-2021-3554](https://cve.now/CVE-2021-3554.md): Improper Access Control vulnerability in the patchesUpdate API (CVSS 9.0, Bitdefender Endpoint Security Tools for Linux · Bitdefen… +1)
- [CVE-2021-3552](https://cve.now/CVE-2021-3552.md): Insufficient validation on regular expression in EPPUpdateService config file (VA-9825) (CVSS 5.3, Bitdefender Endpoint Security Tools · Bitdefender GravityZo…)
- [CVE-2021-44140](https://cve.now/CVE-2021-44140.md): Arbitrary file deletion on logout (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2021-40369](https://cve.now/CVE-2021-40369.md): XSS vulnerability on Denounce plugin (no CVSS, Apache Software Foundation Apache JSPWiki · org.apache.jspw…)
- [CVE-2021-32037](https://cve.now/CVE-2021-32037.md): User may trigger invariant when allowed to send commands directly to shards (CVSS 6.5, MongoDB Server)
- [CVE-2021-20850](https://cve.now/CVE-2021-20850.md): PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series (End-of-Life, (no CVSS, Alfasado PowerCMS XMLRPC API)
- [CVE-2021-20848](https://cve.now/CVE-2021-20848.md): Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified (no CVSS, Zack Scholl rwtxt · github.com/schollz/rwtxt)
- [CVE-2021-20846](https://cve.now/CVE-2021-20846.md): Cross-site request forgery (CSRF) vulnerability in Push Notifications for WordPress (Lite) versions prior to 6.0.1 allows a remote attacker (no CVSS, Delite Studio Push Notifications for WordPress)
- [CVE-2021-20845](https://cve.now/CVE-2021-20845.md): Cross-site request forgery (CSRF) vulnerability in Unlimited Sitemap Generator versions prior to v8.2 allows a remote attacker to hijack the (no CVSS, XML-Sitemaps Unlimited Sitemap Generator)
- [CVE-2021-20844](https://cve.now/CVE-2021-20844.md): Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 (no CVSS, Yamaha RTX830, NVR510, NVR700W, RTX1210)
- [CVE-2021-20843](https://cve.now/CVE-2021-20843.md): Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and earlier, NVR700W Rev.15 (no CVSS, Yamaha RTX830, NVR510, NVR700W, RTX1210)
- [CVE-2021-20842](https://cve.now/CVE-2021-20842.md): Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication o (no CVSS, EC-CUBE CO. EC-CUBE 2 series · ec-cube/ec-cube)
- [CVE-2021-20841](https://cve.now/CVE-2021-20841.md): Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access re (no CVSS, EC-CUBE CO. EC-CUBE 2 series · ec-cube/ec-cube)
- [CVE-2021-20840](https://cve.now/CVE-2021-20840.md): Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 allows a remote attacke (no CVSS, Saasproject Booking Package - Appointment Booking Calendar…)
- [CVE-2021-20835](https://cve.now/CVE-2021-20835.md): Improper authorization in handler for custom URL scheme vulnerability in Android App 'Mercari (Merpay) - Marketplace and Mobile Payments App (no CVSS, Android App 'Mercari (Merpay) - Marketplace and Mobile Paym…)
- [CVE-2021-43221](https://cve.now/CVE-2021-43221.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 4.2, Microsoft Edge)
- [CVE-2021-43220](https://cve.now/CVE-2021-43220.md): Microsoft Edge for iOS Spoofing Vulnerability (CVSS 3.1, Microsoft Edge for iOS)
- [CVE-2021-43211](https://cve.now/CVE-2021-43211.md): Windows 10 Update Assistant Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows Update Assistant)
- [CVE-2021-42306](https://cve.now/CVE-2021-42306.md): Azure Active Directory Information Disclosure Vulnerability (CVSS 8.1, Microsoft Azure Active Directory · Microsoft Azure Autom… +2)
- [CVE-2021-42308](https://cve.now/CVE-2021-42308.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 3.1, Microsoft Edge)
- [CVE-2021-42297](https://cve.now/CVE-2021-42297.md): Windows 10 Update Assistant Elevation of Privilege Vulnerability (CVSS 5.0, Microsoft Windows Update Assistant)
- [CVE-2021-31822](https://cve.now/CVE-2021-31822.md): When Octopus Tentacle is installed on a Linux operating system, the systemd service file permissions are misconfigured. (no CVSS, Octopus Deploy Octopus Tentacle)
- [CVE-2021-28704](https://cve.now/CVE-2021-28704.md): PoD operations on misaligned GFNs T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor (no CVSS, xen)
- [CVE-2021-28705](https://cve.now/CVE-2021-28705.md): issues with partially successful P2M updates on x86 T\[his CNA information record relates to multiple CVEs; the text explains which aspects/v (no CVSS, xen)
- [CVE-2021-28706](https://cve.now/CVE-2021-28706.md): guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercal (no CVSS, xen)
- [CVE-2021-28707](https://cve.now/CVE-2021-28707.md): PoD operations on misaligned GFNs T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor (no CVSS, xen)
- [CVE-2021-28708](https://cve.now/CVE-2021-28708.md): PoD operations on misaligned GFNs T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor (no CVSS, xen)
- [CVE-2021-28709](https://cve.now/CVE-2021-28709.md): issues with partially successful P2M updates on x86 T\[his CNA information record relates to multiple CVEs; the text explains which aspects/v (no CVSS, xen)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.