# CVEs published 2021-11-29

53 CVEs were published on November 29, 2021: 4 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-43790](https://cve.now/CVE-2021-43790.md): Use After Free in lucet (CVSS 8.5, bytecodealliance lucet · lucet-runtime)
- [CVE-2021-44428](https://cve.now/CVE-2021-44428.md): Pinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1. (no CVSS)
- [CVE-2021-44429](https://cve.now/CVE-2021-44429.md): Serva 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcode 1, a related issue (no CVSS)
- [CVE-2021-44427](https://cve.now/CVE-2021-44427.md): An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers t (CVSS 9.8, francoisjacquet/rosariosis)
- [CVE-2021-43788](https://cve.now/CVE-2021-43788.md): Path traversal in translator module of NobeBB (CVSS 5.0, NodeBB)
- [CVE-2021-43786](https://cve.now/CVE-2021-43786.md): API token verification can be bypassed (CVSS 9.8, NodeBB)
- [CVE-2021-43787](https://cve.now/CVE-2021-43787.md): XSS via prototype pollution (CVSS 9.0, NodeBB)
- [CVE-2021-43783](https://cve.now/CVE-2021-43783.md): Path Traversal in @backstage/plugin-scaffolder-backend (CVSS 8.5, backstage · @backstage/plugin-scaffolder-backend)
- [CVE-2021-34800](https://cve.now/CVE-2021-34800.md): Sensitive information could be logged (no CVSS, Acronis Agent)
- [CVE-2021-44200](https://cve.now/CVE-2021-44200.md): Self cross-site scripting (XSS) was possible on devices page (no CVSS, Acronis Cyber Protect)
- [CVE-2021-44199](https://cve.now/CVE-2021-44199.md): DLL hijacking could lead to denial of service (no CVSS, Acronis Cyber Protect · Acronis Agent)
- [CVE-2021-44202](https://cve.now/CVE-2021-44202.md): Stored cross-site scripting (XSS) was possible in activity details (no CVSS, Acronis Cyber Protect)
- [CVE-2021-44203](https://cve.now/CVE-2021-44203.md): Stored cross-site scripting (XSS) was possible in protection plan details (no CVSS, Acronis Cyber Protect)
- [CVE-2021-44198](https://cve.now/CVE-2021-44198.md): DLL hijacking could lead to local privilege escalation (no CVSS, Acronis Cyber Protect)
- [CVE-2021-44201](https://cve.now/CVE-2021-44201.md): Cross-site scripting (XSS) was possible in notification pop-ups (no CVSS, Acronis Cyber Protect)
- [CVE-2021-42364](https://cve.now/CVE-2021-42364.md): Stetic \<= 1.0.6 Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 8.8, Stetic)
- [CVE-2021-42365](https://cve.now/CVE-2021-42365.md): Asgaros Forums \<= 1.15.13 Authenticated Stored XSS (CVSS 4.8, Asgaros Forums)
- [CVE-2021-42358](https://cve.now/CVE-2021-42358.md): Contact Form With Captcha \<= 1.6.2 Cross-Site Request Forgery to Reflected Cross-Site Scripting (CVSS 8.8, Contact Form With Captcha)
- [CVE-2021-39995](https://cve.now/CVE-2021-39995.md): Some Huawei products use the OpenHpi software for hardware management. (no CVSS, eCNS280\_TD;eSE620X vESS)
- [CVE-2021-43691](https://cve.now/CVE-2021-43691.md): tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load\_font.php. (no CVSS)
- [CVE-2021-43692](https://cve.now/CVE-2021-43692.md): youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php. (no CVSS)
- [CVE-2021-43693](https://cve.now/CVE-2021-43693.md): vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php. (no CVSS)
- [CVE-2021-43695](https://cve.now/CVE-2021-43695.md): issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-43696](https://cve.now/CVE-2021-43696.md): twmap v2.91\_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-43697](https://cve.now/CVE-2021-43697.md): Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-43698](https://cve.now/CVE-2021-43698.md): phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-24927](https://cve.now/CVE-2021-24927.md): My Calendar \< 3.2.18 - Subscriber+ Reflected Cross-Site Scripting (no CVSS, My Calendar)
- [CVE-2021-24918](https://cve.now/CVE-2021-24918.md): Smash Balloon Social Post Feed \< 4.0.1 - Subscriber+ Arbitrary Plugin Settings Update to Stored XSS (no CVSS, Smash Balloon Social Post Feed)
- [CVE-2021-24915](https://cve.now/CVE-2021-24915.md): Contest Gallery \< 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure (no CVSS, Contest Gallery – Photo Contest Plugin for WordPress)
- [CVE-2021-24908](https://cve.now/CVE-2021-24908.md): Check & Log Email \< 1.0.4 - Reflected Cross-Site Scripting (no CVSS, Check & Log Email)
- [CVE-2021-24899](https://cve.now/CVE-2021-24899.md): Media-Tags \<= 3.2.0.2 - Admin+ Stored Cross-Site Scripting (no CVSS, Media Tags)
- [CVE-2021-24889](https://cve.now/CVE-2021-24889.md): Ninja Forms \< 3.6.4 - Admin+ SQL Injection (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-24883](https://cve.now/CVE-2021-24883.md): Popup Anything \< 2.0.4 - Contributor+ Stored Cross-Site Scripting (no CVSS, Popup Anything – A Marketing Popup)
- [CVE-2021-24876](https://cve.now/CVE-2021-24876.md): Registrations for The Events Calendar \< 2.7.5 - Reflected Cross-Site Scripting (no CVSS, Registrations for the Events Calendar – Event Registration…)
- [CVE-2021-24860](https://cve.now/CVE-2021-24860.md): BSK PDF Manager \< 3.1.2 - Admin+ SQL Injection (no CVSS, BSK PDF Manager)
- [CVE-2021-24842](https://cve.now/CVE-2021-24842.md): Bulk Datetime Change \< 1.12 - Missing Authorisation (no CVSS, Bulk Datetime Change)
- [CVE-2021-24822](https://cve.now/CVE-2021-24822.md): Stylish Cost Calculator \< 7.04 - Subscriber+ Unauthorised AJAX Calls to Stored XSS (no CVSS, Stylish Cost Calculator)
- [CVE-2021-24811](https://cve.now/CVE-2021-24811.md): Shop Page WP \< 1.2.8 - Admin+ Stored Cross-Site Scripting (no CVSS, Shop Page WP)
- [CVE-2021-24768](https://cve.now/CVE-2021-24768.md): WP RSS Aggregator \< 4.19.2 - Admin+ Stored Cross-Site Scripting (no CVSS, WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…)
- [CVE-2021-24755](https://cve.now/CVE-2021-24755.md): myCred \< 2.3 - Subscriber+ SQL Injection (no CVSS, myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…)
- [CVE-2021-24751](https://cve.now/CVE-2021-24751.md): GenerateBlocks \< 1.4.0 - Contributor+ Stored Cross-Site Scripting (no CVSS, GenerateBlocks)
- [CVE-2021-24749](https://cve.now/CVE-2021-24749.md): URL Shortify \< 1.5.1 - Arbitrary Link/Group Deletion via CSRF (no CVSS, URL Shortify – Simple, Powerful and Easy URL Shortener Plug…)
- [CVE-2021-24748](https://cve.now/CVE-2021-24748.md): Email Before Download \< 6.8 - Admin+ SQL Injection (no CVSS, Email Before Download)
- [CVE-2021-24745](https://cve.now/CVE-2021-24745.md): About Author Box \< 1.0.2 - Contributor+ Stored Cross-Site Scripting (no CVSS, About Author Box)
- [CVE-2017-20008](https://cve.now/CVE-2017-20008.md): myCRED \< 1.7.8 - Reflected Cross-Site Scripting (no CVSS, myCred – Points, Rewards, Gamification, Ranks, Badges & Loy…)
- [CVE-2021-38283](https://cve.now/CVE-2021-38283.md): Wipro Holmes Orchestrator 20.4.1 (20.4.1\_02\_11\_2020) allows remote attackers to read application log files containing sensitive information (no CVSS)
- [CVE-2021-38147](https://cve.now/CVE-2021-38147.md): Wipro Holmes Orchestrator 20.4.1 (20.4.1\_02\_11\_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti (no CVSS)
- [CVE-2021-21707](https://cve.now/CVE-2021-21707.md): Special characters break path parsing in XML functions (CVSS 5.3, PHP Group PHP)
- [CVE-2021-44077](https://cve.now/CVE-2021-44077.md): Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un (CVSS 9.8, KEV)
- [CVE-2021-32061](https://cve.now/CVE-2021-32061.md): S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a \<Key\>../ substring in a ListBucketResult elemen (no CVSS, s3scanner)
- [CVE-2019-8921](https://cve.now/CVE-2019-8921.md): An issue was discovered in bluetoothd in BlueZ through 5.48. (CVSS 6.5)
- [CVE-2019-8922](https://cve.now/CVE-2019-8922.md): A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. (CVSS 8.8)
- [CVE-2021-3802](https://cve.now/CVE-2021-3802.md): A vulnerability found in udisks2. (no CVSS, udisks2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.