CVEs published November 26, 2021
17 CVEs were published on November 26, 2021: 2 critical, 9 high.
- Published
- 17
- Critical
- 2
- High
- 9
- Medium
- 5
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- baserproject basercms · baserproject/basercms
- 2
- QNAP Systems QVR
- 2
- Acurax Technologies Floating Social Media Icon
- 1
- afreecatvstreamer.exe
- 1
- Awesome Support
- 1
- backstage · @backstage/plugin-auth-backend
- 1
- bandisoft ARK
- 1
- F-Secure endpoint protection products on Windows and Mac. F…
- 1
- Goqual GKW-IC052
- 1
- Hitachi Energy RTU500 series
- 1
Critical 2
High 9
- CVE-2021-43785Cross Site Scripting Vulnerability in @joeattardi/emoji-buttonjoeattardi emoji-button · @joeattardi/emoji-button
- CVE-2021-43776XSS vulnerability in @backstage/plugin-auth-backendbackstage · @backstage/plugin-auth-backend
- CVE-2021-41279Zip Slip Vulnerability in BaserCMSbaserproject basercms · baserproject/basercms
- CVE-2021-35533Specially Crafted IEC 60870-5-104 Packet Vulnerability in RTU500 seriesHitachi Energy RTU500 series
- CVE-2021-26615bandisoft ARK library integer overflow vulnerabilitybandisoft ARK
- CVE-2021-26611HejHome IP Camera use of hard-coded credentials vulnerabilityGoqual GKW-IC052
- CVE-2020-7881AfreecaTV streamer service stack-based buffer overflowafreecatvstreamer.exe
- CVE-2021-36807An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before version 9.708 MR8.Sophos SG UTM
- CVE-2021-38686Improper Authentication Vulnerability in VioStorQNAP Systems QVR
Medium, low and unrated 6
- CVE-2021-23654Improper Input Validationhtml-to-csv
- CVE-2021-36919WordPress Awesome Support plugin <= 6.0.6 - Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilitiesAwesome Support
- CVE-2021-40833Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…
- CVE-2021-36843WordPress Floating Social Media Icon plugin <= 4.3.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerabilityAcurax Technologies Floating Social Media Icon
- CVE-2021-25269A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability inSophos Intercept X Advanced · Sophos Exploit Prevention
- CVE-2021-44225In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manip