CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In November 2021

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
951 CVE-2021-27024 732 2021-11-18 2021-11-23
5.5
 None Remote Low ??? Partial Partial None
A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0
952 CVE-2021-27023 2021-11-18 2022-01-24
5.0
 None Remote Low Not required Partial None None
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
953 CVE-2021-27005 400 2021-11-01 2021-11-02
5.0
 None Remote Low Not required None None Partial
Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.
954 CVE-2021-27004 922 2021-11-01 2021-11-02
1.7
 None Local Low ??? Partial None None
System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local attacker to discover plaintext iSCSI CHAP credentials.
955 CVE-2021-26844 79 XSS 2021-11-05 2021-11-09
3.5
 None Remote Medium ??? None Partial None
A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.
956 CVE-2021-26795 89 Sql +Info 2021-11-14 2021-11-17
6.5
 None Remote Low ??? Partial Partial Partial
A SQL Injection vulnerability in /appliance/shiftmgn.php in TalariaX sendQuick Alert Plus Server Admin 4.3 before 8HF11 allows attackers to obtain sensitive information via a Roster Time to Roster Management.
957 CVE-2021-26786 Exec Code 2021-11-03 2021-11-05
6.5
 None Remote Low ??? Partial Partial Partial
An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the purchace code to the config.php.
958 CVE-2021-26740 434 Exec Code 2021-11-01 2021-11-02
7.5
 None Remote Low Not required Partial Partial Partial
Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.
959 CVE-2021-26739 89 Exec Code Sql 2021-11-01 2021-11-02
7.5
 None Remote Low Not required Partial Partial Partial
SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.
960 CVE-2021-26615 190 Exec Code Overflow 2021-11-26 2021-11-30
6.8
 None Remote Medium Not required Partial Partial Partial
ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an integer overflow.
961 CVE-2021-26614 Exec Code 2021-11-22 2021-11-26
10.0
 None Remote Low Not required Complete Complete Complete
ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.
962 CVE-2021-26612 20 Exec Code 2021-11-30 2021-12-01
7.5
 None Remote Low Not required Partial Partial Partial
An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code.
963 CVE-2021-26611 798 2021-11-26 2021-11-30
7.5
 None Remote Low Not required Partial Partial Partial
HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
964 CVE-2021-26558 502 2021-11-11 2021-11-16
5.0
 None Remote Low Not required None Partial None
Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.
965 CVE-2021-26444 2021-11-10 2021-11-17
1.9
 None Local Medium Not required Partial None None
Azure RTOS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-42301, CVE-2021-42323.
966 CVE-2021-26443 Exec Code 2021-11-10 2021-11-10
7.7
 None Local Network Low ??? Complete Complete Complete
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
967 CVE-2021-26338 2021-11-16 2021-11-18
7.8
 None Remote Low Not required None None Complete
Improper access controls in System Management Unit (SMU) may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources.
968 CVE-2021-26337 2021-11-16 2022-05-12
2.1
 None Local Low Not required Partial None None
Insufficient DRAM address validation in System Management Unit (SMU) may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing further requests.
969 CVE-2021-26336 119 Overflow 2021-11-16 2022-05-12
4.9
 None Local Low Not required None None Complete
Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components.
970 CVE-2021-26335 Exec Code 2021-11-16 2022-05-12
7.2
 None Local Low Not required Complete Complete Complete
Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution.
971 CVE-2021-26331 Exec Code 2021-11-16 2021-11-19
7.2
 None Local Low Not required Complete Complete Complete
AMD System Management Unit (SMU) contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution.
972 CVE-2021-26330 787 Overflow 2021-11-16 2021-11-19
2.1
 None Local Low Not required None None Partial
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
973 CVE-2021-26329 190 Overflow 2021-11-16 2021-11-18
2.1
 None Local Low Not required None None Partial
AMD System Management Unit (SMU) may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources.
974 CVE-2021-26327 668 2021-11-16 2021-11-19
2.1
 None Local Low Not required Partial None None
Insufficient validation of guest context in the SNP Firmware could lead to a potential loss of guest confidentiality.
975 CVE-2021-26326 665 2021-11-16 2021-11-18
7.2
 None Local Low Not required Complete Complete Complete
Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
976 CVE-2021-26325 20 DoS 2021-11-16 2021-11-19
2.1
 None Local Low Not required None None Partial
Insufficient input validation in the SNP_GUEST_REQUEST command may lead to a potential data abort error and a denial of service.
977 CVE-2021-26323 20 2021-11-16 2021-11-19
4.6
 None Local Low Not required Partial Partial Partial
Failure to validate SEV Commands while SNP is active may result in a potential impact to memory integrity.
978 CVE-2021-26322 330 2021-11-16 2021-11-18
5.0
 None Remote Low Not required Partial None None
Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
979 CVE-2021-26321 77 DoS 2021-11-16 2021-11-19
4.9
 None Local Low Not required None None Complete
Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.
980 CVE-2021-26320 295 DoS 2021-11-16 2021-11-18
2.1
 None Local Low Not required None None Partial
Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP
981 CVE-2021-26315 345 Exec Code 2021-11-16 2021-11-18
4.6
 None Local Low Not required Partial Partial Partial
When the AMD Platform Security Processor (PSP) boot rom loads, authenticates, and subsequently decrypts an encrypted FW, due to insufficient verification of the integrity of decrypted image, arbitrary code may be executed in the PSP when encrypted firmware images are used.
982 CVE-2021-26312 668 2021-11-16 2022-05-11
2.1
 None Local Low Not required Partial None None
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
983 CVE-2021-26262 284 2021-11-19 2021-11-23
5.0
 None Remote Low Not required Partial None None
Philips MRI 1.5T and MRI 3T Version 5.x.x does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
984 CVE-2021-26248 708 2021-11-19 2021-11-23
2.1
 None Local Low Not required Partial None None
Philips MRI 1.5T and MRI 3T Version 5.x.x assigns an owner who is outside the intended control sphere to a resource.
985 CVE-2021-26107 863 2021-11-02 2021-11-03
4.0
 None Remote Low ??? None Partial None
An improper access control vulnerability [CWE-284] in FortiManager versions 6.4.4 and 6.4.5 may allow an authenticated attacker with a restricted user profile to modify the VPN tunnel status of other VDOMs using VPN Manager.
986 CVE-2021-25987 79 +Priv XSS 2021-11-30 2021-11-30
1.9
 None Local Medium Not required None Partial None
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code.
987 CVE-2021-25986 79 XSS 2021-11-23 2021-11-29
3.5
 None Remote Medium ??? None Partial None
In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
988 CVE-2021-25985 613 XSS 2021-11-16 2021-11-18
7.5
 None Remote Low Not required Partial Partial Partial
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
989 CVE-2021-25984 79 Exec Code XSS 2021-11-16 2021-11-17
4.3
 None Remote Medium Not required None Partial None
In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting (XSS) at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
990 CVE-2021-25983 79 Exec Code XSS 2021-11-16 2021-11-17
4.3
 None Remote Medium Not required None Partial None
In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
991 CVE-2021-25982 79 Exec Code XSS 2021-11-16 2021-11-17
4.3
 None Remote Medium Not required None Partial None
In Factor (App Framework & Headless CMS) forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.
992 CVE-2021-25980 74 2021-11-11 2021-11-16
6.8
 None Remote Medium Not required Partial Partial Partial
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
993 CVE-2021-25979 613 2021-11-08 2021-11-18
7.5
 None Remote Low Not required Partial Partial Partial
Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions.
994 CVE-2021-25978 79 XSS 2021-11-07 2021-11-09
3.5
 None Remote Medium ??? None Partial None
Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module, which triggers XSS once viewed.
995 CVE-2021-25976 352 CSRF 2021-11-16 2021-11-17
4.0
 None Remote High Not required None Partial Partial
In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
996 CVE-2021-25975 79 XSS 2021-11-10 2021-11-12
3.5
 None Remote Medium ??? None Partial None
In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
997 CVE-2021-25974 79 Exec Code XSS 2021-11-10 2021-11-12
3.5
 None Remote Medium ??? None Partial None
In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
998 CVE-2021-25973 863 2021-11-02 2021-11-17
6.4
 None Remote Low Not required Partial Partial None
In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.
999 CVE-2021-25965 352 CSRF 2021-11-16 2021-11-17
6.8
 None Remote Medium Not required Partial Partial Partial
In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application.
1000 CVE-2021-25940 613 2021-11-16 2021-11-17
6.0
 None Remote Medium ??? Partial Partial Partial
In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system.
Total number of vulnerabilities : 1511   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 (This Page)21 22 23 24 25 26 27 28 29 30 31
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.