CVEs published November 29, 2021
53 CVEs were published on November 29, 2021: 4 critical, 5 high. 1 is now in CISA KEV.
- Published
- 53
- Critical
- 4
- High
- 5
- Medium
- 4
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 1
- Fix available
- 32
Most affected products
- Acronis Cyber Protect
- 5
- NodeBB
- 3
- myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…
- 2
- About Author Box
- 1
- Acronis Agent
- 1
- Acronis Cyber Protect · Acronis Agent
- 1
- Asgaros Forums
- 1
- backstage · @backstage/plugin-scaffolder-backend
- 1
- BSK PDF Manager
- 1
- Bulk Datetime Change
- 1
Critical 4
- CVE-2021-44427An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers tfrancoisjacquet/rosariosis
- CVE-2021-43786API token verification can be bypassedNodeBB
- CVE-2021-43787XSS via prototype pollutionNodeBB
- CVE-2021-44077Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un
High 5
- CVE-2021-43790Use After Free in lucetbytecodealliance lucet · lucet-runtime
- CVE-2021-43783Path Traversal in @backstage/plugin-scaffolder-backendbackstage · @backstage/plugin-scaffolder-backend
- CVE-2021-42364Stetic <= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site ScriptingStetic
- CVE-2021-42358Contact Form With Captcha <= 1.6.2 Cross-Site Request Forgery to Reflected Cross-Site ScriptingContact Form With Captcha
- CVE-2019-8922A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48.
Medium, low and unrated 44
- CVE-2021-44428Pinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1.
- CVE-2021-44429Serva 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1, a related issue
- CVE-2021-43788Path traversal in translator module of NobeBBNodeBB
- CVE-2021-34800Sensitive information could be loggedAcronis Agent
- CVE-2021-44200Self cross-site scripting (XSS) was possible on devices pageAcronis Cyber Protect
- CVE-2021-44199DLL hijacking could lead to denial of serviceAcronis Cyber Protect · Acronis Agent
- CVE-2021-44202Stored cross-site scripting (XSS) was possible in activity detailsAcronis Cyber Protect
- CVE-2021-44203Stored cross-site scripting (XSS) was possible in protection plan detailsAcronis Cyber Protect
- CVE-2021-44198DLL hijacking could lead to local privilege escalationAcronis Cyber Protect
- CVE-2021-44201Cross-site scripting (XSS) was possible in notification pop-upsAcronis Cyber Protect
- CVE-2021-42365Asgaros Forums <= 1.15.13 Authenticated Stored XSSAsgaros Forums
- CVE-2021-39995Some Huawei products use the OpenHpi software for hardware management.eCNS280_TD;eSE620X vESS
- CVE-2021-43691tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php.
- CVE-2021-43692youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php.
- CVE-2021-43693vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
- CVE-2021-43695issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-43696twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-43697Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-43698phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-24927My Calendar < 3.2.18 - Subscriber+ Reflected Cross-Site ScriptingMy Calendar
- CVE-2021-24918Smash Balloon Social Post Feed < 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSSSmash Balloon Social Post Feed
- CVE-2021-24915Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address DisclosureContest Gallery – Photo Contest Plugin for WordPress
- CVE-2021-24908Check & Log Email < 1.0.4 - Reflected Cross-Site ScriptingCheck & Log Email
- CVE-2021-24899Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site ScriptingMedia Tags
- CVE-2021-24889Ninja Forms < 3.6.4 - Admin+ SQL InjectionNinja Forms Contact Form – The Drag and Drop Form Builder f…
- CVE-2021-24883Popup Anything < 2.0.4 - Contributor+ Stored Cross-Site ScriptingPopup Anything – A Marketing Popup
- CVE-2021-24876Registrations for The Events Calendar < 2.7.5 - Reflected Cross-Site ScriptingRegistrations for the Events Calendar – Event Registration…
- CVE-2021-24860BSK PDF Manager < 3.1.2 - Admin+ SQL InjectionBSK PDF Manager
- CVE-2021-24842Bulk Datetime Change < 1.12 - Missing AuthorisationBulk Datetime Change
- CVE-2021-24822Stylish Cost Calculator < 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSSStylish Cost Calculator
- CVE-2021-24811Shop Page WP < 1.2.8 - Admin+ Stored Cross-Site ScriptingShop Page WP
- CVE-2021-24768WP RSS Aggregator < 4.19.2 - Admin+ Stored Cross-Site ScriptingWP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…
- CVE-2021-24755myCred < 2.3 - Subscriber+ SQL InjectionmyCred – Points, Rewards, Gamification, Ranks, Badges & Loy…
- CVE-2021-24751GenerateBlocks < 1.4.0 - Contributor+ Stored Cross-Site ScriptingGenerateBlocks
- CVE-2021-24749URL Shortify < 1.5.1 - Arbitrary Link/Group Deletion via CSRFURL Shortify – Simple, Powerful and Easy URL Shortener Plug…
- CVE-2021-24748Email Before Download < 6.8 - Admin+ SQL InjectionEmail Before Download
- CVE-2021-24745About Author Box < 1.0.2 - Contributor+ Stored Cross-Site ScriptingAbout Author Box
- CVE-2017-20008myCRED < 1.7.8 - Reflected Cross-Site ScriptingmyCred – Points, Rewards, Gamification, Ranks, Badges & Loy…
- CVE-2021-38283Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information
- CVE-2021-38147Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti
- CVE-2021-21707Special characters break path parsing in XML functionsPHP Group PHP
- CVE-2021-32061S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a ListBucketResult elemens3scanner
- CVE-2019-8921An issue was discovered in bluetoothd in BlueZ through 5.48.
- CVE-2021-3802A vulnerability found in udisks2.udisks2