# CVEs published 2021-11-30

49 CVEs were published on November 30, 2021: 0 critical, 16 high. Days are UTC.

- [CVE-2021-41256](https://cve.now/CVE-2021-41256.md): Intent URI permissions manipulation in nextcloud news-android (CVSS 5.8, nextcloud news-android)
- [CVE-2021-36330](https://cve.now/CVE-2021-36330.md): Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. (CVSS 8.1, Dell EMC Streaming Data Platform)
- [CVE-2021-36329](https://cve.now/CVE-2021-36329.md): Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. (CVSS 6.5, Dell EMC Streaming Data Platform)
- [CVE-2021-36328](https://cve.now/CVE-2021-36328.md): Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. (CVSS 8.8, Dell EMC Streaming Data Platform)
- [CVE-2021-36327](https://cve.now/CVE-2021-36327.md): Dell EMC Streaming Data Platform versions before 1.3 contain a Server Side Request Forgery Vulnerability. (CVSS 5.3, Dell EMC Streaming Data Platform)
- [CVE-2021-36326](https://cve.now/CVE-2021-36326.md): Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). (CVSS 6.5, Dell EMC Streaming Data Platform)
- [CVE-2021-4026](https://cve.now/CVE-2021-4026.md): Improper Access Control in bookstackapp/bookstack (CVSS 6.5, bookstackapp/bookstack · ssddanbrown/bookstack)
- [CVE-2021-40101](https://cve.now/CVE-2021-40101.md): An issue was discovered in Concrete CMS before 8.5.7. (no CVSS)
- [CVE-2021-42564](https://cve.now/CVE-2021-42564.md): An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers (with permission to prov (no CVSS)
- [CVE-2021-31787](https://cve.now/CVE-2021-31787.md): The Bluetooth Classic implementation on Actions ATS2815 chipsets does not properly handle the reception of continuous unsolicited LMP respon (no CVSS)
- [CVE-2020-7880](https://cve.now/CVE-2020-7880.md): douzone NeoRS remote support program ActiveX vulnerability (CVSS 7.5, douzone NeoRS)
- [CVE-2021-42099](https://cve.now/CVE-2021-42099.md): Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. (no CVSS)
- [CVE-2021-43319](https://cve.now/CVE-2021-43319.md): Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping func (no CVSS)
- [CVE-2021-22095](https://cve.now/CVE-2021-22095.md): In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new Strin (no CVSS, Spring AMQP · org.springframework.amqp:spring-amqp)
- [CVE-2021-43296](https://cve.now/CVE-2021-43296.md): Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor. (no CVSS)
- [CVE-2021-43295](https://cve.now/CVE-2021-43295.md): Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module. (no CVSS)
- [CVE-2021-26612](https://cve.now/CVE-2021-26612.md): tobesoft Nexacro platform arbitrary file creation vulnerability (CVSS 8.1, TOBESOFT NEXACRO17)
- [CVE-2021-43294](https://cve.now/CVE-2021-43294.md): Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module. (no CVSS)
- [CVE-2020-7879](https://cve.now/CVE-2020-7879.md): ipTIME C200 IP Camera command injection vulnerability (CVSS 8.8, EFM networks & multimedia ipTIME C200 IP Camera)
- [CVE-2021-43284](https://cve.now/CVE-2021-43284.md): An issue was discovered on Victure WR1200 devices through 1.0.3. (no CVSS)
- [CVE-2021-43283](https://cve.now/CVE-2021-43283.md): An issue was discovered on Victure WR1200 devices through 1.0.3. (no CVSS)
- [CVE-2021-43282](https://cve.now/CVE-2021-43282.md): An issue was discovered on Victure WR1200 devices through 1.0.3. (no CVSS)
- [CVE-2021-44230](https://cve.now/CVE-2021-44230.md): PortSwigger Burp Suite Enterprise Edition before 2021.11 on Windows has weak file permissions for the embedded H2 database, which might lead (no CVSS)
- [CVE-2021-39000](https://cve.now/CVE-2021-39000.md): IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local attacker to obtain sensitive information by inclusion of sensitive data within diagn (CVSS 5.9, IBM MQ Appliance)
- [CVE-2021-38999](https://cve.now/CVE-2021-38999.md): IBM MQ Appliance could allow a local attacker to obtain sensitive information by inclusion of sensitive data within trace. (CVSS 5.1, IBM MQ Appliance)
- [CVE-2021-38967](https://cve.now/CVE-2021-38967.md): IBM MQ Appliance 9.2 CD and 9.2 LTS could allow a local privileged user to inject and execute malicious code. (CVSS 8.2, IBM MQ Appliance)
- [CVE-2021-38958](https://cve.now/CVE-2021-38958.md): IBM MQ Appliance 9.2 CD and 9.2 LTS is affected by a denial of service attack caused by a concurrency issue. (CVSS 5.1, IBM MQ Appliance)
- [CVE-2021-43202](https://cve.now/CVE-2021-43202.md): In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. (no CVSS)
- [CVE-2021-43998](https://cve.now/CVE-2021-43998.md): HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias i (no CVSS, github.com/hashicorp/vault)
- [CVE-2021-25987](https://cve.now/CVE-2021-25987.md): Hexo - Stored XSS (CVSS 5.0, Hexo)
- [CVE-2021-41679](https://cve.now/CVE-2021-41679.md): A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. (no CVSS)
- [CVE-2021-41678](https://cve.now/CVE-2021-41678.md): A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. (no CVSS)
- [CVE-2021-41677](https://cve.now/CVE-2021-41677.md): A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. (no CVSS)
- [CVE-2021-42545](https://cve.now/CVE-2021-42545.md): Insufficient Session Expiration in TopEase (CVSS 8.1, Business-DNA Solutions TopEase)
- [CVE-2021-42123](https://cve.now/CVE-2021-42123.md): Missing Upload Filter in TopEase (CVSS 7.3, Business-DNA Solutions TopEase)
- [CVE-2021-42544](https://cve.now/CVE-2021-42544.md): Lack of Rate limiting in Authentication in TopEase (CVSS 7.5, Business-DNA Solutions TopEase)
- [CVE-2021-42122](https://cve.now/CVE-2021-42122.md): Denial of Service via Invalid Object Attribute in TopEase (CVSS 4.3, Business-DNA Solutions TopEase)
- [CVE-2021-42120](https://cve.now/CVE-2021-42120.md): Missing Character Length (Denial of Service) in TopEase (CVSS 6.5, Business-DNA Solutions TopEase)
- [CVE-2021-42121](https://cve.now/CVE-2021-42121.md): Denial of Service via Invalid Date Format in TopEase (CVSS 4.3, Business-DNA Solutions TopEase)
- [CVE-2021-42119](https://cve.now/CVE-2021-42119.md): Stored XSS in Search Function in TopEase (CVSS 7.3, Business-DNA Solutions TopEase)
- [CVE-2021-42118](https://cve.now/CVE-2021-42118.md): Stored XSS in TopEase (CVSS 8.1, Business-DNA Solutions TopEase)
- [CVE-2021-42117](https://cve.now/CVE-2021-42117.md): UI Redressing in TopEase (CVSS 3.5, Business-DNA Solutions TopEase)
- [CVE-2021-42116](https://cve.now/CVE-2021-42116.md): Unauthorized Menu Item Access in TopEase (CVSS 4.3, Business-DNA Solutions TopEase)
- [CVE-2021-42115](https://cve.now/CVE-2021-42115.md): Missing HTTPOnly flag on sensitive cookie in TopEase (CVSS 8.1, Business-DNA Solutions TopEase)
- [CVE-2021-43771](https://cve.now/CVE-2021-43771.md): Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could (no CVSS, Trend Micro Antivirus for MAC)
- [CVE-2021-3769](https://cve.now/CVE-2021-3769.md): OS Command Injection in ohmyzsh/ohmyzsh (CVSS 7.5, ohmyzsh/ohmyzsh)
- [CVE-2021-3727](https://cve.now/CVE-2021-3727.md): OS Command Injection in ohmyzsh/ohmyzsh (CVSS 7.5, ohmyzsh/ohmyzsh)
- [CVE-2021-3726](https://cve.now/CVE-2021-3726.md): OS Command Injection in ohmyzsh/ohmyzsh (CVSS 7.5, ohmyzsh/ohmyzsh)
- [CVE-2021-3725](https://cve.now/CVE-2021-3725.md): OS Command Injection in ohmyzsh/ohmyzsh (CVSS 7.5, ohmyzsh/ohmyzsh)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.