CVE-2021-42705: WECON PLC Editor
PLC Editor Versions 1.3.8 and prior is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code.
Published Nov 22, 2021 · Updated Sep 16, 2024
CVE archive
November 2021
Browse CVE records published in November 2021, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 1519 matching CVEs · Page 10 of 31.
CVE-2021-36312: Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability.
Dell EMC CloudLink 7.1 and all prior versions contain a Hard-coded Password Vulnerability. A remote high privileged attacker, with the knowledge of the hard-coded credentials, may potentially exploit this vulnerability to gain unauthorized access to the system.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-36300: iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.
iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to crash the webserver or cause information disclosure.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-42337: TVN-202110009
The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the remote attacker can access account information except passwords by crafting URL parameters.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-42723: Adobe Bridge Out-of-bounds read could lead to Arbitrary Code Execution
Adobe Bridge version 11.1.1 (and earlier) is affected by an out-of-bounds read vulnerability when parsing a crafted SGI file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-36329: Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability.
Dell EMC Streaming Data Platform versions before 1.3 contain an Indirect Object Reference Vulnerability. A remote malicious user may potentially exploit this vulnerability to gain sensitive information.
Published Nov 30, 2021 · Updated Sep 16, 2024
CVE-2021-43553: OSIsoft PI Vision
PI Vision could disclose information to a user with insufficient privileges for an AF attribute that is the child of another attribute and is configured as a Limits property.
Published Nov 17, 2021 · Updated Sep 16, 2024
CVE-2021-23433: Prototype Pollution
The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.
Published Nov 19, 2021 · Updated Sep 16, 2024
CVE-2021-38418: Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization.
Published Nov 3, 2021 · Updated Sep 16, 2024
CVE-2021-34800: Sensitive information could be logged
Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147
Published Nov 29, 2021 · Updated Sep 16, 2024
CVE-2021-21561: Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability.
Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE privileges to gain access to sensitive information in the log files.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-23624: Prototype Pollution
This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays.
Published Nov 3, 2021 · Updated Sep 16, 2024
CVE-2021-38980: IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 cou...
IBM Tivoli Key Lifecycle Manager (IBM Security Guardium Key Lifecycle Manager) 3.0, 3.0.1, 4.0, and 4.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 212786.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-36332: Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability.
Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, directing end user to arbitrary and potentially malicious websites.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-38976: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which...
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 stores user credentials in plain clear text which can be read by a local user. X-Force ID: 212781.
Published Nov 15, 2021 · Updated Sep 16, 2024
CVE-2021-21528: Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Direc...
Dell EMC PowerScale OneFS versions 9.1.0, 9.2.0.x, 9.2.1.x contain an Exposure of Information through Directory Listing vulnerability. This vulnerability is triggered when upgrading from a previous versions.
Published Nov 12, 2021 · Updated Sep 16, 2024
CVE-2021-23718: Server-side Request Forgery (SSRF)
The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
Published Nov 22, 2021 · Updated Sep 16, 2024
CVE-2021-37910: ASUS GT-AXE11000, RT-AX3000, RT-AX55, RT-AX58U, TUF-AX3000 - Improper Authentication
ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-SAE) has improper control of Interaction frequency vulnerability, an unauthenticated attacker can remotely disconnect other users' connections by sending specially crafted SAE authentication frames.
Published Nov 12, 2021 · Updated Sep 16, 2024
CVE-2021-36333: Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability.
Dell EMC CloudLink 7.1 and all prior versions contain a Buffer Overflow Vulnerability. A local low privileged attacker, may potentially exploit this vulnerability, leading to an application crash.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-26321: Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform...
Insufficient ID command validation in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-3060: PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)
An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.
Published Nov 10, 2021 · Updated Sep 16, 2024
CVE-2021-36308: Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authenticat...
Networking OS10, versions prior to October 2021 with Smart Fabric Services enabled, contains an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to gain access and perform actions on the affected system.
Published Nov 20, 2021 · Updated Sep 16, 2024
CVE-2021-43046: TIBCO PartnerExpress Session Token in URL
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain an easily exploitable vulnerability that allows an unauthenticated attacker with network access to obtain session tokens for the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-38416: Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed.
Published Nov 3, 2021 · Updated Sep 16, 2024
CVE-2021-35534: Insufficient Security Control Vulnerability
Insufficient security control vulnerability in internal database access mechanism of Hitachi Energy Relion 670/650/SAM600-IO, Relion 650, GMS600, PWC600 allows attacker who successfully exploited this vulnerability, of which the product does not sufficiently restrict access to an internal database tables, could allow anybody with user credentials to bypass security controls that is enforced by the product. Consequently, exploitation may lead to unauthorized modifications on data/firmware, and/or to permanently disabling the product. This issue affects: Hitachi Energy Relion 670 Series 2.0 all revisions; 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.5. Hitachi Energy Relion 670/650 Series 2.1 all revisions. 2.2.0 all revisions; 2.2.4 all revisions; Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions; 2.2.5 versions prior to 2.2.5.2. Hitachi Energy Relion 650 1.0 all revisions. 1.1 all revisions; 1.2 all revisions; 1.3 versions prior to 1.3.0.8; Hitachi Energy GMS600 1.3.0; 1.3.0.1; 1.2.0. Hitachi Energy PWC600 1.0.1 version 1.0.1.4 and prior versions; 1.1.0 version 1.1.0.1 and prior versions.
Published Nov 18, 2021 · Updated Sep 16, 2024
CVE-2021-42362: WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Published Nov 17, 2021 · Updated Sep 16, 2024
CVE-2021-36313: Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability.
Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it may be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-34598: Phoenix Contact: FL MGUARD lack of memory release in remote logging functionality
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 the remote logging functionality is impaired by the lack of memory release for data structures from syslog-ng when remote logging is active
Published Nov 10, 2021 · Updated Sep 16, 2024
CVE-2021-26320: Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may...
Insufficient validation of the AMD SEV Signing Key (ASK) in the SEND_START command in the SEV Firmware may allow a local authenticated attacker to perform a denial of service of the PSP
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-36305: Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA...
Dell PowerScale OneFS contains an Unsynchronized Access to Shared Data in a Multithreaded Context in SMB CA handling. An authenticated user of SMB on a cluster with CA could potentially exploit this vulnerability, leading to a denial of service over SMB.
Published Nov 12, 2021 · Updated Sep 16, 2024
CVE-2021-26335: Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an a...
Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-42726: Adobe Bridge Memory Corruption could lead to Arbitrary code execution
Adobe Bridge version 11.1.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious M4A file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-43173: Hanging RRDP request
In NLnet Labs Routinator prior to 0.10.2, a validation run can be delayed significantly by an RRDP repository by not answering but slowly drip-feeding bytes to keep the connection alive. This can be used to effectively stall validation. While Routinator has a configurable time-out value for RRDP connections, this time-out was only applied to individual read or write operations rather than the complete request. Thus, if an RRDP repository sends a little bit of data before that time-out expired, it can continuously extend the time it takes for the request to finish. Since validation will only continue once the update of an RRDP repository has concluded, this delay will cause validation to stall, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
Published Nov 9, 2021 · Updated Sep 16, 2024
CVE-2021-23197: Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to exec...
Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ;
Published Nov 18, 2021 · Updated Sep 16, 2024
CVE-2021-36324: Dell BIOS contains an improper input validation vulnerability.
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
Published Nov 12, 2021 · Updated Sep 16, 2024
CVE-2021-26330: AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
AMD System Management Unit (SMU) may experience a heap-based overflow which may result in a loss of resources.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-34597: Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerability
Improper Input Validation vulnerability in PC Worx Automation Suite of Phoenix Contact up to version 1.88 could allow an attacker with a manipulated project file to unpack arbitrary files outside of the selected project directory.
Published Nov 4, 2021 · Updated Sep 16, 2024
CVE-2021-38420: Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files.
Published Nov 3, 2021 · Updated Sep 16, 2024
CVE-2021-38977: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorizatio...
IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, 4.0, and 4.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 212782.
Published Nov 15, 2021 · Updated Sep 16, 2024
CVE-2021-3939: Free of static data in accountsservice
Ubuntu-specific modifications to accountsservice (in patch file debian/patches/0010-set-language.patch) caused the fallback_locale variable, pointing to static storage, to be freed, in the user_change_language_authorized_cb function. This is reachable via the SetLanguage dbus function. This is fixed in versions 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1.
Published Nov 17, 2021 · Updated Sep 16, 2024
CVE-2021-26312: Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead...
Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-26326: Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
Failure to validate VM_HSAVE_PA during SNP_INIT may result in a loss of memory integrity.
Published Nov 16, 2021 · Updated Sep 16, 2024
CVE-2021-29771: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting.
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published Nov 2, 2021 · Updated Sep 16, 2024
CVE-2021-3061: PAN-OS: OS Command Injection Vulnerability in the Command Line Interface (CLI)
An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 firewalls are impacted by this issue.
Published Nov 10, 2021 · Updated Sep 16, 2024
CVE-2021-36314: Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability.
Dell EMC CloudLink 7.1 and all prior versions contain an Arbitrary File Creation Vulnerability. A remote unauthenticated attacker, may potentially exploit this vulnerability, leading to the execution of arbitrary files on the end user system.
Published Nov 23, 2021 · Updated Sep 16, 2024
CVE-2021-38422: Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges.
Published Nov 3, 2021 · Updated Sep 16, 2024
CVE-2021-23654: Improper Input Validation
This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
Published Nov 26, 2021 · Updated Sep 16, 2024
CVE-2021-35535: Insufficient Security Control Vulnerability
Insecure Boot Image vulnerability in Hitachi Energy Relion Relion 670/650/SAM600-IO series allows an attacker who manages to get access to the front network port and to cause a reboot sequences of the device may exploit the vulnerability, where there is a tiny time gap during the booting process where an older version of VxWorks is loaded prior to application firmware booting, could exploit the vulnerability in the older version of VxWorks and cause a denial-of-service on the product. This issue affects: Hitachi Energy Relion 670 Series 2.2.2 all revisions; 2.2.3 versions prior to 2.2.3.3. Hitachi Energy Relion 670/650 Series 2.2.0 all revisions; 2.2.4 all revisions. Hitachi Energy Relion 670/650/SAM600-IO 2.2.1 all revisions.
Published Nov 18, 2021 · Updated Sep 16, 2024
CVE-2021-3552: Insufficient validation on regular expression in EPPUpdateService config file (VA-9825)
A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attacker to proxy requests to the relay server. This issue affects: Bitdefender Endpoint Security Tools versions prior to 6.6.27.390; versions prior to 7.1.2.33. Bitdefender GravityZone 6.24.1-1.
Published Nov 24, 2021 · Updated Sep 16, 2024
CVE-2021-26336: Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that...
Insufficient bounds checking in System Management Unit (SMU) may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components.
Published Nov 16, 2021 · Updated Sep 16, 2024