November 2021

12 results · Clear filters · Feed

• High 8.8
  CVE-2021-38003 Exploited Public exploit EPSS 39%

  Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially expl…

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  Nov 23, 2021

  KEV Nov 3, 2021
• High 7.5
  CVE-2020-7882 Public exploit

  anySign directory traversal vulnerability

  Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal characters(ie. '../../../')

  Hancomwith anySign4PC
  Nov 22, 2021
• High 7.6
  CVE-2021-22053 Public exploit EPSS 13%

  Code injection in spring-cloud-netflix-hystrix-dashboard

  Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-…

  org.springframework.cloud:spring-cloud-netflix-hystrix-dashboard Maven
  Nov 19, 2021
• High 8.8
  CVE-2021-42362 Public exploit EPSS 80%

  WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload

  The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malic…

  WordPress Popular Posts WordPress Popular Posts Web / CMS
  Nov 17, 2021
• High 8.1
  CVE-2021-3060 Public exploit EPSS 33%

  PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP)

  An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root us…

  Palo Alto Networks PAN-OS Prisma Access Network devices
  Nov 10, 2021
• High 8.8
  CVE-2021-42321 Exploited · Ransomware Public exploit EPSS 92%

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Exchange Server Remote Code Execution Vulnerability

  Microsoft Microsoft Exchange Server 2019 Cumulative Update 11 Microsoft Exchange Server 2016 Cumulative Update 22 Microsoft Exchange Server 2016 Cumulative Update 21
  Nov 10, 2021

  KEV Nov 17, 2021
• High 7.8
  CVE-2021-42292 Exploited Public exploit EPSS 43%

  Microsoft Excel Security Feature Bypass Vulnerability

  Microsoft Excel Security Feature Bypass Vulnerability

  Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC for Mac 2021
  Nov 10, 2021

  KEV Nov 17, 2021
• High 7.5
  CVE-2021-42287 Exploited · Ransomware Public exploit EPSS 77%

  Active Directory Domain Services Elevation of Privilege Vulnerability

  Active Directory Domain Services Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  Nov 10, 2021

  KEV Apr 11, 2022
• High 7.5
  CVE-2021-42278 Exploited · Ransomware Public exploit EPSS 73%

  Active Directory Domain Services Elevation of Privilege Vulnerability

  Active Directory Domain Services Elevation of Privilege Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  Nov 10, 2021

  KEV Apr 11, 2022
• High 8.8
  CVE-2021-38666 Public exploit EPSS 15%

  Remote Desktop Client Remote Code Execution Vulnerability

  Remote Desktop Client Remote Code Execution Vulnerability

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Nov 10, 2021
• High 7.5
  CVE-2021-42697 Public exploit EPSS 36%

  Uncontrolled Recursion in Akka HTTP

  Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.

  com.typesafe.akka:akka-http-core_2.11 com.typesafe.akka:akka-http-core_2.12 com.typesafe.akka:akka-http-core_2.13 com.typesafe.akka:akka-http-core_2.13.0-RC3 Maven
  Nov 2, 2021
• High 8.3
  CVE-2021-42694 Public exploit

  An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allow…

  Nov 1, 2021