Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2021

71 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2021-42574
    37Monitor

    An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.

    HighCVSS 8.3Proof of conceptEPSS 12%

    unicode · unicodeNov 1, 2021

  • CVE-2021-29212
    43Plan

    A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90

    CriticalCVSS 9.8No exploitEPSS 13%

    hp · ilo amplifier packNov 1, 2021

  • CVE-2021-20136
    42Plan

    ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.

    CriticalCVSS 9.8No exploitEPSS 10%

    zohocorp · manageengine log360Nov 1, 2021

  • CVE-2021-39341
    39Monitor

    OptinMonster <= 2.6.4 Unprotected REST-API Endpoints

    HighCVSS 8.2Proof of conceptEPSS 21%

    optinmonster · optinmonsterNov 1, 2021

  • CVE-2021-42697
    41Plan

    Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote at

    HighCVSS 7.5Proof of conceptEPSS 36%

    akka · http serverNov 2, 2021

  • CVE-2021-43267
    56Plan

    An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16.

    CriticalCVSS 9.8Proof of conceptEPSS 57%

    linux · linux kernelNov 2, 2021

  • CVE-2021-39238
    42Plan

    Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buf

    CriticalCVSS 9.8No exploitEPSS 11%

    hp · futuresmart 3Nov 2, 2021

  • CVE-2021-41174
    50Plan

    XSS vulnerability allowing arbitrary JavaScript execution

    MediumCVSS 6.1Proof of conceptEPSS 85%

    grafana · grafanaNov 3, 2021

  • CVE-2021-38428
    22Monitor

    Delta Electronics DIALink

    MediumCVSS 4.8No exploitEPSS 11%

    deltaww · dialinkNov 3, 2021

  • CVE-2021-38488
    23Monitor

    Delta Electronics DIALink

    MediumCVSS 4.8No exploitEPSS 12%

    deltaww · dialinkNov 3, 2021

  • CVE-2021-39906
    42Plan

    Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vic

    MediumCVSS 6.1No exploitEPSS 60%

    gitlab · gitlabNov 4, 2021

  • CVE-2021-42237
    98Now

    Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achi

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    sitecore · experience platformNov 5, 2021

  • CVE-2021-42667
    44Plan

    A SQL Injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP in event-management/views.

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    online event booking and reservation system project · online event booking and reservation systemNov 5, 2021

  • CVE-2021-42669
    46Plan

    A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the ava

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    engineers online portal project · engineers online portalNov 5, 2021

  • CVE-2021-42671
    36Monitor

    An incorrect access control vulnerability exists in Sourcecodester Engineers Online Portal in PHP in nia_munoz_monitoring_system/admin/uploa

    HighCVSS 7.5Proof of conceptEPSS 19%

    engineers online portal project · engineers online portalNov 5, 2021

  • CVE-2021-43405
    46Plan

    An issue was discovered in FusionPBX before 4.5.30.

    HighCVSS 8.8Proof of conceptEPSS 35%

    fusionpbx · fusionpbxNov 5, 2021

  • CVE-2021-31602
    45Plan

    An issue was discovered in Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x.

    HighCVSS 7.5Proof of conceptEPSS 51%

    hitachi · vantara pentahoNov 8, 2021

  • CVE-2021-24827
    43Plan

    Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    asgaros · asgaros forumNov 8, 2021

  • CVE-2021-38666
    40Plan

    Remote Desktop Client Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 15%

    microsoft · windows 10Nov 9, 2021

  • CVE-2021-41349
    54Plan

    Microsoft Exchange Server Spoofing Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 93%

    microsoft · exchange serverNov 9, 2021

  • CVE-2021-41379
    58Plan

    Windows Installer Elevation of Privilege Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 19%

    microsoft · windows 10 1507Nov 9, 2021

  • CVE-2021-42278
    82Now

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 73%

    microsoft · windows server 2004Nov 9, 2021

  • CVE-2021-42287
    83Now

    Active Directory Domain Services Elevation of Privilege Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 77%

    microsoft · windows server 2004Nov 9, 2021

  • CVE-2021-42292
    74This week

    Microsoft Excel Security Feature Bypass Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 43%

    microsoft · 365 appsNov 9, 2021

  • CVE-2021-42321
    93Now

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 91%

    microsoft · exchange serverNov 9, 2021

  • CVE-2021-43136
    44Plan

    An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to t

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    formalms · formalmsNov 10, 2021

  • CVE-2021-3060
    42Plan

    PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)

    HighCVSS 8.1Proof of conceptEPSS 32%

    paloaltonetworks · prisma accessNov 10, 2021

  • CVE-2021-3064
    45Plan

    PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces

    CriticalCVSS 9.8Proof of conceptEPSS 20%

    paloaltonetworks · pan-osNov 10, 2021

  • CVE-2021-22048
    38Monitor

    The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism.

    HighCVSS 8.8No exploitEPSS 10%

    vmware · cloud foundationNov 10, 2021

  • CVE-2021-33618
    48Plan

    Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY el

    MediumCVSS 6.1No exploitEPSS 79%

    dolibarr · dolibarr erp\/crmNov 10, 2021

  • CVE-2021-41081
    58Plan

    Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    zohocorp · manageengine network configuration managerNov 11, 2021

  • CVE-2021-42847
    60This week

    Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.

    CriticalCVSS 9.8WeaponizedEPSS 70%

    zohocorp · manageengine adaudit plusNov 11, 2021

  • CVE-2002-20001
    37Monitor

    The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not pub

    HighCVSS 7.5Proof of conceptEPSS 24%

    balasys · dheaterNov 11, 2021

  • CVE-2021-21699
    48Plan

    Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters,

    MediumCVSS 5.4No exploitEPSS 88%

    jenkins · active choicesNov 12, 2021

  • CVE-2021-43496
    35Monitor

    Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 15%

    clustering project · clusteringNov 12, 2021

  • CVE-2021-3577
    53Plan

    An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an att

    HighCVSS 8.8Proof of conceptEPSS 60%

    binatoneglobal · halo\+ camera firmwareNov 12, 2021

  • CVE-2021-3840
    36Monitor

    A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote co

    HighCVSS 8.8No exploitEPSS 2%

    lenovo · antillesNov 12, 2021

  • CVE-2021-41653
    62This week

    The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    tp-link · tl-wr840n firmwareNov 13, 2021

  • CVE-2021-43617
    45Plan

    Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/Val

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    laravel · frameworkNov 14, 2021

  • CVE-2020-16152
    60This week

    The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers

    CriticalCVSS 9.8WeaponizedEPSS 35%

    extremenetworks · aerohive netconfigNov 14, 2021

  • CVE-2021-41765
    59Plan

    A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated att

    CriticalCVSS 9.8No exploitEPSS 67%

    montala · resourcespaceNov 15, 2021

  • CVE-2021-41950
    58Plan

    A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on t

    CriticalCVSS 9.1No exploitEPSS 74%

    montala · resourcespaceNov 15, 2021

  • CVE-2021-41951
    47Plan

    ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php vi

    MediumCVSS 6.1Proof of conceptEPSS 77%

    montala · resourcespaceNov 15, 2021

  • CVE-2021-41266
    53Plan

    Authentication bypass issue in the Operator Console

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    min · minio consoleNov 15, 2021

  • CVE-2021-37580
    52Plan

    Apache ShenYu Admin bypass JWT authentication

    CriticalCVSS 9.8Proof of conceptEPSS 41%

    apache · shenyuNov 16, 2021

  • CVE-2021-3958
    43Plan

    SQL Injection Vulnerability in Ipack SCADA Software

    CriticalCVSS 9.8No exploitEPSS 14%

    ipack · scada automationNov 16, 2021

  • CVE-2021-42362
    59Plan

    WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload

    HighCVSS 8.8WeaponizedEPSS 79%

    wordpress popular posts project · wordpress popular postsNov 17, 2021

  • CVE-2021-41277
    89Now

    GeoJSON URL validation can expose server files and environment variables to unauthorized users

    HighCVSS 7.5KEVWeaponizedEPSS 97%

    metabase · metabaseNov 17, 2021

  • CVE-2021-44026
    90Now

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    CriticalCVSS 9.8KEVWeaponizedEPSS 69%

    roundcube · webmailNov 19, 2021

  • CVE-2021-22053
    39Monitor

    Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted

    HighCVSS 8.8Proof of conceptEPSS 13%

    vmware · spring cloud netflixNov 19, 2021

  • CVE-2021-43555
    42Plan

    mySCADA myDESIGNER Versions 8.20.0 and prior fails to properly validate contents of an imported project file, which may make the product vul

    HighCVSS 7.8No exploitEPSS 38%

    myscada · mydesignerNov 19, 2021

  • CVE-2021-38146
    34Monitor

    The File Download API in Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read arbitrary files via absolute p

    HighCVSS 7.5Proof of conceptEPSS 11%

    wipro · holmesNov 22, 2021

  • CVE-2021-43557
    34Monitor

    Path traversal in request_uri variable

    HighCVSS 7.5Proof of conceptEPSS 12%

    apache · apisixNov 22, 2021

  • CVE-2021-42727
    43Plan

    Adobe Bridge Buffer Overflow Arbitrary code execution

    HighCVSS 7.8No exploitEPSS 39%

    adobe · robohelp serverNov 22, 2021

  • CVE-2021-24891
    32Monitor

    Elementor < 3.4.8 - DOM Cross-Site-Scripting

    MediumCVSS 6.1Proof of conceptEPSS 25%

    elementor · website builderNov 23, 2021

  • CVE-2021-36299
    41Plan

    Dell iDRAC9 versions 4.40.00.00 and later, but prior to 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability.

    HighCVSS 8.1No exploitEPSS 29%

    dell · emc idrac9 firmwareNov 23, 2021

  • CVE-2021-36300
    42Plan

    iDRAC9 versions prior to 5.00.00.00 contain an improper input validation vulnerability.

    HighCVSS 8.2No exploitEPSS 33%

    dell · emc idrac9 firmwareNov 23, 2021

  • CVE-2021-36301
    36Monitor

    Dell iDRAC 9 prior to version 4.40.40.00 and iDRAC 8 prior to version 2.80.80.80 contain a Stack Buffer Overflow in Racadm.

    HighCVSS 7.2No exploitEPSS 27%

    dell · emc idrac8 firmwareNov 23, 2021

  • CVE-2021-38000
    60This week

    Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitra

    MediumCVSS 6.1KEVWeaponizedEPSS 4%

    google · chromeNov 23, 2021

  • CVE-2021-38001
    43Plan

    Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted H

    HighCVSS 8.8Proof of conceptEPSS 26%

    google · chromeNov 23, 2021

  • CVE-2021-38003
    77This week

    Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption v

    HighCVSS 8.8KEVWeaponizedEPSS 38%

    google · chromeNov 23, 2021

  • CVE-2021-42783
    40Plan

    Missing Authentication in debug_post_set.cgi in D-Link DWR-932C E1 Firmware 1.0.0.4

    CriticalCVSS 9.8No exploitEPSS 3%

    dlink · dwr-932c e1 firmwareNov 23, 2021

  • CVE-2021-43778
    46Plan

    Path traversal in GLPI barcode plugin

    HighCVSS 7.5Proof of conceptEPSS 52%

    glpi-project · barcodeNov 24, 2021

  • CVE-2021-44223
    48Plan

    WordPress before 5.8 lacks support for the Update URI plugin header.

    CriticalCVSS 9.8No exploitEPSS 28%

    wordpress · wordpressNov 25, 2021

  • CVE-2021-44077
    97Now

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to un

    CriticalCVSS 9.8KEVWeaponizedEPSS 93%

    zohocorp · manageengine servicedesk plusNov 29, 2021

  • CVE-2021-21707
    29Monitor

    Special characters break path parsing in XML functions

    MediumCVSS 5.3Proof of conceptEPSS 25%

    php · phpNov 29, 2021

  • CVE-2021-38147
    46Plan

    Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensiti

    HighCVSS 7.5Proof of conceptEPSS 53%

    wipro · holmesNov 29, 2021

  • CVE-2021-24915
    43Plan

    Contest Gallery < 13.1.0.6 - Missing Access Controls to Unauthenticated SQL injection / Email Address Disclosure

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    contest gallery · contest galleryNov 29, 2021

  • CVE-2021-43788
    28Monitor

    Path traversal in translator module of NobeBB

    MediumCVSS 5.0No exploitEPSS 25%

    nodebb · nodebbNov 29, 2021

  • CVE-2021-44427
    54Plan

    An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers t

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    rosariosis · rosariosisNov 29, 2021

  • CVE-2021-43319
    45Plan

    Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping func

    CriticalCVSS 9.8No exploitEPSS 21%

    zohocorp · manageengine network configuration managerNov 30, 2021