Archive

17 November 2021

Vulnerabilities first published on this day (UTC), newest first.

← October 2021 2021 / November /17 December 2021 →

All Critical High Medium Low Exploited only Public exploit

106 results · Feed

Unscored —

DRUPAL-CORE-2021-011

The Drupal project uses the [CKEditor](https://github.com/ckeditor/ckeditor4) library for WYSIWYG editing. CKEditor has…

drupal/core Packagist

Nov 17, 2021
Critical 10.0

CVE-2021-41277 Exploited Public exploit EPSS 97%

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment varia…

metabase metabase

Nov 17, 2021
KEV Nov 12, 2024
Critical 9.3

CVE-2021-41274

Authentication Bypass by CSRF Weakness

solidus_auth_devise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidus_auth_devise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of…

solidusio solidus_auth_devise solidus_auth_devise RubyGems

Nov 17, 2021
Critical 9.3

CVE-2021-41275

Authentication Bypass by CSRF Weakness

spree_auth_devise is an open source library which provides authentication and authorization services for use with the Spree storefront framework by using an underlying Devise authentication framework. In affected versions spree_auth_devise is subject to a CSR…

spree spree_auth_devise spree_auth_devise RubyGems

Nov 17, 2021
Unscored —

CVE-2021-0182

Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user …

Nov 17, 2021
Unscored —

CVE-2021-0180

Uncontrolled resource consumption in the Intel(R) HAXM software before version 7.6.6 may allow an unauthenticated user …

Nov 17, 2021
Unscored —

CVE-2021-0186

Improper input validation in the Intel(R) SGX SDK applications compiled for SGX2 enabled processors may allow a privile…

Nov 17, 2021
Unscored —

CVE-2020-8741

Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may al…

Nov 17, 2021
Unscored —

CVE-2021-0013

Improper input validation for Intel(R) EMA before version 1.5.0 may allow an unauthenticated user to potentially enable…

Nov 17, 2021
Unscored —

CVE-2021-0053

Improper initialization in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allow …

Windows

Nov 17, 2021
Unscored —

CVE-2021-0079

Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allo…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0075

Out-of-bounds write in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Killer(TM…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0069

Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in multiple operating systems and some Kil…

Windows

Nov 17, 2021
Medium 4.3

CVE-2021-41273

Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email a…

pterodactyl panel pterodactyl/panel Packagist

Nov 17, 2021
Unscored —

CVE-2021-0082

Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticat…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0071

Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi in UEFI may allow an unauthenticated user …

Nov 17, 2021
Unscored —

CVE-2021-0078

Improper input validation in software for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allo…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0063

Improper input validation in firmware for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi in Windows 10 may allo…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0135

Improper input validation in the Intel(R) Ethernet Diagnostic Driver for Windows before version 1.4.0.10 may allow a pr…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0146

Hardware allows activation of test or debug logic at runtime for some Intel(R) processors which may allow an unauthenti…

intel-microcode intel-ucode Ubuntu Alpine

Nov 17, 2021
Unscored —

CVE-2021-0110

Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unaut…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0148

Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially …

Nov 17, 2021
Unscored —

CVE-2021-33073

Uncontrolled resource consumption in the Intel(R) Distribution of OpenVINOâ„¢ Toolkit before version 2021.4 may allow a…

Nov 17, 2021
Unscored —

CVE-2021-0152

Improper verification of cryptographic signature in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM…

Windows

Nov 17, 2021
Low 3.0

CVE-2021-41190

Clarify Content-Type handling in OCI spec

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…

opencontainers distribution-spec docker.io docker Ubuntu Alpine Go

Nov 17, 2021
Unscored —

CVE-2021-0151

Improper access control in the installer for some Intel(R) Wireless Bluetooth(R) and Killer(TM) Bluetooth(R) products i…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0065

Incorrect default permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.…

Windows

Nov 17, 2021
Unscored —

CVE-2021-0064

Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22…

Windows

Nov 17, 2021
Critical 9.8

CVE-2021-43996

Incorrect Access Control in Ignition

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

facade/ignition Packagist

Nov 17, 2021
Unscored —

CVE-2021-0199

Improper input validation in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.6.0.6 may …

Nov 17, 2021
Unscored —

CVE-2021-0198

Improper access control in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 may al…

Nov 17, 2021
Unscored —

CVE-2021-0197

Protection mechanism failure in the firmware for the Intel(R) Ethernet Network Controller E810 before version 1.5.5.6 m…

Nov 17, 2021
High 8.2

CVE-2021-41165

HTML comments vulnerability allowing to execute JavaScript code

CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing co…

ckeditor ckeditor4 request-tracker4 ldap-account-manager Debian Ubuntu npm Packagist

Nov 17, 2021
Unscored —

CVE-2021-0200

Out-of-bounds write in the firmware for Intel(R) Ethernet 700 Series Controllers before version 8.2 may allow a privile…

Nov 17, 2021
Unscored —

CVE-2021-33059

Improper input validation in the Intel(R) Administrative Tools for Intel(R) Network Adapters driver for Windows before …

Nov 17, 2021
Unscored —

CVE-2021-33098

Improper input validation in the Intel(R) Ethernet ixgbe driver for Linux before version 3.17.3 may allow an authentica…

linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu

Nov 17, 2021
Unscored —

CVE-2021-33058

Improper access control in the installer Intel(R)Administrative Tools for Intel(R) Network Adaptersfor Windowsbefore ve…

Nov 17, 2021
Unscored —

CVE-2021-33062

Incorrect default permissions in the software installer for the Intel(R) VTune(TM) Profiler before version 2021.3.0 may…

Nov 17, 2021
Unscored —

CVE-2021-33063

Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 …

Windows

Nov 17, 2021
Unscored —

CVE-2021-33118

Improper access control in the software installer for the Intel(R) Serial IO driver for Intel(R) NUC 11 Gen before vers…

Nov 17, 2021