CVEs published November 1, 2021
69 CVEs were published on November 1, 2021: 0 critical, 6 high.
- Published
- 69
- Critical
- 0
- High
- 6
- Medium
- 5
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- Accept Donations with PayPal
- 2
- Antenna House Office Server Document Converter
- 2
- Atlassian Jira Server · Atlassian Jira Data Center
- 2
- BP Better Messages
- 2
- Connections Business Directory
- 2
- Flat Preloader
- 2
- Google libjxl
- 2
- HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Se…
- 2
- McAfee Data Loss Prevention (DLP) ePO extension
- 2
- Stylish Price List
- 2
High 6
- CVE-2021-41187SQL Injection in DHIS2 Tracker APIdhis2-core
- CVE-2021-39341OptinMonster <= 2.6.4 Unprotected REST-API EndpointsOptinMonster
- CVE-2021-39333Hashthemes Demo Importer <= 1.1.1 Improper Access Control Allowing Content DeletionHashthemes Demo Importer
- CVE-2021-31848Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)McAfee Data Loss Prevention (DLP) ePO extension
- CVE-2021-31849Data Loss Prevention (DLP) ePO extension - SQL injectionMcAfee Data Loss Prevention (DLP) ePO extension
- CVE-2021-42694An issue was discovered in the character definitions of the Unicode Specification through 14.0.
Medium, low and unrated 63
- CVE-2021-41310Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-43058An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing.REPLICATED CLASSIC
- CVE-2021-39340Notification – Custom Notifications and Alerts for WordPress <= 7.2.4 Authenticated Stored Cross-Site ScriptingNotification – Custom Notifications and Alerts for WordPress
- CVE-2021-38356NextScripts: Social Networks Auto-Poster <= 4.3.20 Reflected Cross-Site ScriptingNextScripts: Social Networks Auto-Poster
- CVE-2021-39346Google Maps Easy <= 1.9.33 Authenticated Stored Cross-Site ScriptingGoogle Maps Easy
- CVE-2021-20136ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite.ManageEngine Log360
- CVE-2021-26740Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.
- CVE-2021-26739SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter.
- CVE-2021-38847S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel.
- CVE-2020-28702A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information.
- CVE-2021-3705Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigHP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Se…
- CVE-2021-29212A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 iLO Amplifier Pack
- CVE-2021-29213A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, andHPE ProLiant ML30 Gen10 Server; HPE ProLiant DL20 Gen10 Ser…
- CVE-2021-27005Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allowClustered Data ONTAP
- CVE-2021-3704Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow a Denial of Service on the devicHP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Se…
- CVE-2021-3440HP Print and Scan Doctor, an application within the HP Smart App for Windows, is potentially vulnerable to local elevation of privilege.HP Print and Scan Doctor, an application within the HP Smar…
- CVE-2021-22564Out of bounds Copy in Libjxl in large image groupsGoogle libjxl
- CVE-2021-22563Memory Overread in libjxlGoogle libjxl
- CVE-2021-27004System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local aSystem Manager 9.x
- CVE-2021-25878AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which
- CVE-2021-25877AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write.
- CVE-2021-25876AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote att
- CVE-2021-25875AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parame
- CVE-2021-25874AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remo
- CVE-2021-42557In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials.
- CVE-2021-27644DolphinScheduler mysql jdbc connector parameters deserialize remote code executionApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2021-24813Events Made Easy < 2.2.24 - Admin+ Stored Cross-Site ScriptingEvents Made Easy
- CVE-2021-24809BP Better Messages < 1.9.9.41 - Multiple CSRFBP Better Messages
- CVE-2021-24808BP Better Messages < 1.9.9.41 - Reflected Cross-Site ScriptingBP Better Messages
- CVE-2021-24799Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRFFar Future Expiry Header
- CVE-2021-24794Connections Business Directory < 10.4.3 - Admin+ Stored Cross-Site ScriptingConnections Business Directory
- CVE-2021-24793WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site ScriptingWPeMatico RSS Feed Fetcher
- CVE-2021-24789Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site ScriptingFlat Preloader
- CVE-2021-24781Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value ChangeImage Source Control
- CVE-2021-24773WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site ScriptingWordPress Download Manager
- CVE-2021-24770Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image UploadStylish Price List
- CVE-2021-24757Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image UploadStylish Price List
- CVE-2021-24742Logo Slider and Showcase < 1.3.37 - Editor Plugin's Settings UpdateLogo Slider and Showcase
- CVE-2021-24723WP Reactions Lite < 1.3.6 - Authenticated Stored Cross Site ScriptingWP Reactions Lite
- CVE-2021-24722Restaurant Menu by MotoPress < 2.4.2 - Admin+ Stored Cross Site ScriptingRestaurant Menu by MotoPress
- CVE-2021-24717AutomatorWP < 1.7.6 - Missing Authorization and Privilege EscalationAutomatorWP
- CVE-2021-24716Modern Events Calendar Lite < 5.22.3 - Authenticated Stored Cross Site ScriptingModern Events Calendar Lite
- CVE-2021-24715WP Sitemap Page < 1.7.0 - Admin+ Stored Cross Site ScriptingWP Sitemap Page
- CVE-2021-24685Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site ScriptingFlat Preloader
- CVE-2021-24682Cool Tag Cloud < 2.26 - Contributor+ Stored Cross-Site ScriptingCool Tag Cloud
- CVE-2021-24624MP3 Audio Player for Music, Radio & Podcast by Sonaar < 2.4.2 - Multiple Admin+ Cross Site ScriptingMP3 Audio Player for Music, Radio & Podcast by Sonaar
- CVE-2021-24572Paypal Donation < 1.3.1 - CSRF to Arbitrary Post DeletionAccept Donations with PayPal
- CVE-2021-24570Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site ScriptingAccept Donations with PayPal
- CVE-2021-24539Coming Soon, Under Construction & Maintenance Mode By Dazzler < 1.6.7 - Admin+ Stored Cross-Site ScriptingComing Soon, Under Construction & Maintenance Mode By Dazzl…
- CVE-2020-36505Delete All Comments Easily <= 1.3 - All Comments Deletion via CSRFDelete All Comments Easily
- CVE-2020-36504WP-Pro-Quiz <= 0.37 - Arbitrary Quiz Deletion via CSRFWp-Pro-Quiz
- CVE-2020-36503Connections Business Directory < 9.7 - Admin+ CSV InjectionConnections Business Directory
- CVE-2018-25019LearnDash < 2.5.4 - Unauthenticated Arbitrary File UploadLearnDash LMS
- CVE-2015-20067WP Attachment Export < 0.2.4 - Unauthenticated Posts DownloadWP Attachment Export
- CVE-2015-20019Content text slider on post < 6.9 - Authenticated Stored Cross-Site Scripting (XSS)Content text slider on post
- CVE-2015-10001WP-Stats < 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS)WP-Stats
- CVE-2021-41973Apache MINA HTTP listener DOSApache Software Foundation Apache MINA · org.apache.mina:mi…
- CVE-2021-40348Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection.
- CVE-2021-41313Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-20839Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML ExteAntenna House Office Server Document Converter
- CVE-2021-20838Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML ExteAntenna House Office Server Document Converter
- CVE-2021-42574An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0.
- CVE-2021-42917Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed