CVEs published November 30, 2021
49 CVEs were published on November 30, 2021: 0 critical, 16 high.
- Published
- 49
- Critical
- 0
- High
- 16
- Medium
- 13
- Low
- 1
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Business-DNA Solutions TopEase
- 11
- Dell EMC Streaming Data Platform
- 5
- IBM MQ Appliance
- 4
- ohmyzsh/ohmyzsh
- 4
- bookstackapp/bookstack · ssddanbrown/bookstack
- 1
- douzone NeoRS
- 1
- EFM networks & multimedia ipTIME C200 IP Camera
- 1
- github.com/hashicorp/vault
- 1
- Hexo
- 1
- nextcloud news-android
- 1
High 16
- CVE-2021-36330Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability.Dell EMC Streaming Data Platform
- CVE-2021-36328Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability.Dell EMC Streaming Data Platform
- CVE-2020-7880douzone NeoRS remote support program ActiveX vulnerabilitydouzone NeoRS
- CVE-2021-26612tobesoft Nexacro platform arbitrary file creation vulnerabilityTOBESOFT NEXACRO17
- CVE-2020-7879ipTIME C200 IP Camera command injection vulnerabilityEFM networks & multimedia ipTIME C200 IP Camera
- CVE-2021-38967IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code.IBM MQ Appliance
- CVE-2021-42545Insufficient Session Expiration in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42123Missing Upload Filter in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42544Lack of Rate limiting in Authentication in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42119Stored XSS in Search Function in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42118Stored XSS in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42115Missing HTTPOnly flag on sensitive cookie in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-3769OS Command Injection in ohmyzsh/ohmyzshohmyzsh/ohmyzsh
- CVE-2021-3727OS Command Injection in ohmyzsh/ohmyzshohmyzsh/ohmyzsh
- CVE-2021-3726OS Command Injection in ohmyzsh/ohmyzshohmyzsh/ohmyzsh
- CVE-2021-3725OS Command Injection in ohmyzsh/ohmyzshohmyzsh/ohmyzsh
Medium, low and unrated 33
- CVE-2021-41256Intent URI permissions manipulation in nextcloud news-androidnextcloud news-android
- CVE-2021-36329Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability.Dell EMC Streaming Data Platform
- CVE-2021-36327Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability.Dell EMC Streaming Data Platform
- CVE-2021-36326Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI).Dell EMC Streaming Data Platform
- CVE-2021-4026Improper Access Control in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-40101An issue was discovered in Concrete CMS before 8.5.7.
- CVE-2021-42564An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov
- CVE-2021-31787The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP respon
- CVE-2021-42099Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
- CVE-2021-43319Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping func
- CVE-2021-22095In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new StrinSpring AMQP · org.springframework.amqp:spring-amqp
- CVE-2021-43296Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.
- CVE-2021-43295Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.
- CVE-2021-43294Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.
- CVE-2021-43284An issue was discovered on Victure WR1200 devices through 1.0.3.
- CVE-2021-43283An issue was discovered on Victure WR1200 devices through 1.0.3.
- CVE-2021-43282An issue was discovered on Victure WR1200 devices through 1.0.3.
- CVE-2021-44230PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead
- CVE-2021-39000IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagnIBM MQ Appliance
- CVE-2021-38999IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace.IBM MQ Appliance
- CVE-2021-38958IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue.IBM MQ Appliance
- CVE-2021-43202In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.
- CVE-2021-43998HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias igithub.com/hashicorp/vault
- CVE-2021-25987Hexo - Stored XSSHexo
- CVE-2021-41679A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.
- CVE-2021-41678A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.
- CVE-2021-41677A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database.
- CVE-2021-42122Denial of Service via Invalid Object Attribute in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42120Missing Character Length (Denial of Service) in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42121Denial of Service via Invalid Date Format in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42117UI Redressing in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-42116Unauthorized Menu Item Access in TopEaseBusiness-DNA Solutions TopEase
- CVE-2021-43771Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could Trend Micro Antivirus for MAC