# CVEs published 2021-11-01

69 CVEs were published on November 1, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2021-41310](https://cve.now/CVE-2021-41310.md): Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Cro (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41187](https://cve.now/CVE-2021-41187.md): SQL Injection in DHIS2 Tracker API (CVSS 8.1, dhis2-core)
- [CVE-2021-43058](https://cve.now/CVE-2021-43058.md): An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. (no CVSS, REPLICATED CLASSIC)
- [CVE-2021-39341](https://cve.now/CVE-2021-39341.md): OptinMonster \<= 2.6.4 Unprotected REST-API Endpoints (CVSS 8.2, OptinMonster)
- [CVE-2021-39340](https://cve.now/CVE-2021-39340.md): Notification – Custom Notifications and Alerts for WordPress \<= 7.2.4 Authenticated Stored Cross-Site Scripting (CVSS 4.8, Notification – Custom Notifications and Alerts for WordPress)
- [CVE-2021-39333](https://cve.now/CVE-2021-39333.md): Hashthemes Demo Importer \<= 1.1.1 Improper Access Control Allowing Content Deletion (CVSS 8.1, Hashthemes Demo Importer)
- [CVE-2021-38356](https://cve.now/CVE-2021-38356.md): NextScripts: Social Networks Auto-Poster \<= 4.3.20 Reflected Cross-Site Scripting (CVSS 6.1, NextScripts: Social Networks Auto-Poster)
- [CVE-2021-39346](https://cve.now/CVE-2021-39346.md): Google Maps Easy \<= 1.9.33 Authenticated Stored Cross-Site Scripting (CVSS 4.8, Google Maps Easy)
- [CVE-2021-20136](https://cve.now/CVE-2021-20136.md): ManageEngine Log360 Builds \< 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. (no CVSS, ManageEngine Log360)
- [CVE-2021-31848](https://cve.now/CVE-2021-31848.md): Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS) (CVSS 8.4, McAfee Data Loss Prevention (DLP) ePO extension)
- [CVE-2021-31849](https://cve.now/CVE-2021-31849.md): Data Loss Prevention (DLP) ePO extension - SQL injection (CVSS 8.4, McAfee Data Loss Prevention (DLP) ePO extension)
- [CVE-2021-26740](https://cve.now/CVE-2021-26740.md): Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code. (no CVSS)
- [CVE-2021-26739](https://cve.now/CVE-2021-26739.md): SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter. (no CVSS)
- [CVE-2021-38847](https://cve.now/CVE-2021-38847.md): S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. (no CVSS)
- [CVE-2020-28702](https://cve.now/CVE-2020-28702.md): A SQL injection vulnerability in TopicMapper.xml of PybbsCMS v5.2.1 allows attackers to access sensitive database information. (no CVSS)
- [CVE-2021-3705](https://cve.now/CVE-2021-3705.md): Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfig (no CVSS, HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Se…)
- [CVE-2021-29212](https://cve.now/CVE-2021-29212.md): A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 (no CVSS, iLO Amplifier Pack)
- [CVE-2021-29213](https://cve.now/CVE-2021-29213.md): A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and (no CVSS, HPE ProLiant ML30 Gen10 Server; HPE ProLiant DL20 Gen10 Ser…)
- [CVE-2021-27005](https://cve.now/CVE-2021-27005.md): Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow (no CVSS, Clustered Data ONTAP)
- [CVE-2021-3704](https://cve.now/CVE-2021-3704.md): Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow a Denial of Service on the devic (no CVSS, HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Se…)
- [CVE-2021-3440](https://cve.now/CVE-2021-3440.md): HP Print and Scan Doctor, an application within the HP Smart App for Windows, is potentially vulnerable to local elevation of privilege. (no CVSS, HP Print and Scan Doctor, an application within the HP Smar…)
- [CVE-2021-22564](https://cve.now/CVE-2021-22564.md): Out of bounds Copy in Libjxl in large image groups (CVSS 4.5, Google libjxl)
- [CVE-2021-22563](https://cve.now/CVE-2021-22563.md): Memory Overread in libjxl (CVSS 4.5, Google libjxl)
- [CVE-2021-27004](https://cve.now/CVE-2021-27004.md): System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which could allow a local a (no CVSS, System Manager 9.x)
- [CVE-2021-25878](https://cve.now/CVE-2021-25878.md): AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which (no CVSS)
- [CVE-2021-25877](https://cve.now/CVE-2021-25877.md): AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. (no CVSS)
- [CVE-2021-25876](https://cve.now/CVE-2021-25876.md): AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote att (no CVSS)
- [CVE-2021-25875](https://cve.now/CVE-2021-25875.md): AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parame (no CVSS)
- [CVE-2021-25874](https://cve.now/CVE-2021-25874.md): AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remo (no CVSS)
- [CVE-2021-42557](https://cve.now/CVE-2021-42557.md): In Jeedom through 4.1.19, a bug allows a remote attacker to bypass API access and retrieve users credentials. (no CVSS)
- [CVE-2021-27644](https://cve.now/CVE-2021-27644.md): DolphinScheduler mysql jdbc connector parameters deserialize remote code execution (no CVSS, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2021-24813](https://cve.now/CVE-2021-24813.md): Events Made Easy \< 2.2.24 - Admin+ Stored Cross-Site Scripting (no CVSS, Events Made Easy)
- [CVE-2021-24809](https://cve.now/CVE-2021-24809.md): BP Better Messages \< 1.9.9.41 - Multiple CSRF (no CVSS, BP Better Messages)
- [CVE-2021-24808](https://cve.now/CVE-2021-24808.md): BP Better Messages \< 1.9.9.41 - Reflected Cross-Site Scripting (no CVSS, BP Better Messages)
- [CVE-2021-24799](https://cve.now/CVE-2021-24799.md): Far Future Expiry Header \< 1.5 - Plugin's Settings Update via CSRF (no CVSS, Far Future Expiry Header)
- [CVE-2021-24794](https://cve.now/CVE-2021-24794.md): Connections Business Directory \< 10.4.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Connections Business Directory)
- [CVE-2021-24793](https://cve.now/CVE-2021-24793.md): WPeMatico RSS Feed Fetcher \< 2.6.12 - Admin+ Stored Cross-Site Scripting (no CVSS, WPeMatico RSS Feed Fetcher)
- [CVE-2021-24789](https://cve.now/CVE-2021-24789.md): Flat Preloader \< 1.5.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Flat Preloader)
- [CVE-2021-24781](https://cve.now/CVE-2021-24781.md): Image Source Control \< 2.3.1 - Contributor+ Arbitrary Post Meta Value Change (no CVSS, Image Source Control)
- [CVE-2021-24773](https://cve.now/CVE-2021-24773.md): WordPress Download Manager \< 3.2.16 - Admin+ Stored Cross-Site Scripting (no CVSS, WordPress Download Manager)
- [CVE-2021-24770](https://cve.now/CVE-2021-24770.md): Stylish Price List \< 6.9.1 - Subscriber+ Arbitrary Image Upload (no CVSS, Stylish Price List)
- [CVE-2021-24757](https://cve.now/CVE-2021-24757.md): Stylish Price List \< 6.9.0 - Unauthenticated Arbitrary Image Upload (no CVSS, Stylish Price List)
- [CVE-2021-24742](https://cve.now/CVE-2021-24742.md): Logo Slider and Showcase \< 1.3.37 - Editor Plugin's Settings Update (no CVSS, Logo Slider and Showcase)
- [CVE-2021-24723](https://cve.now/CVE-2021-24723.md): WP Reactions Lite \< 1.3.6 - Authenticated Stored Cross Site Scripting (no CVSS, WP Reactions Lite)
- [CVE-2021-24722](https://cve.now/CVE-2021-24722.md): Restaurant Menu by MotoPress \< 2.4.2 - Admin+ Stored Cross Site Scripting (no CVSS, Restaurant Menu by MotoPress)
- [CVE-2021-24717](https://cve.now/CVE-2021-24717.md): AutomatorWP \< 1.7.6 - Missing Authorization and Privilege Escalation (no CVSS, AutomatorWP)
- [CVE-2021-24716](https://cve.now/CVE-2021-24716.md): Modern Events Calendar Lite \< 5.22.3 - Authenticated Stored Cross Site Scripting (no CVSS, Modern Events Calendar Lite)
- [CVE-2021-24715](https://cve.now/CVE-2021-24715.md): WP Sitemap Page \< 1.7.0 - Admin+ Stored Cross Site Scripting (no CVSS, WP Sitemap Page)
- [CVE-2021-24685](https://cve.now/CVE-2021-24685.md): Flat Preloader \< 1.5.4 - CSRF to Stored Cross-Site Scripting (no CVSS, Flat Preloader)
- [CVE-2021-24682](https://cve.now/CVE-2021-24682.md): Cool Tag Cloud \< 2.26 - Contributor+ Stored Cross-Site Scripting (no CVSS, Cool Tag Cloud)
- [CVE-2021-24624](https://cve.now/CVE-2021-24624.md): MP3 Audio Player for Music, Radio & Podcast by Sonaar \< 2.4.2 - Multiple Admin+ Cross Site Scripting (no CVSS, MP3 Audio Player for Music, Radio & Podcast by Sonaar)
- [CVE-2021-24572](https://cve.now/CVE-2021-24572.md): Paypal Donation \< 1.3.1 - CSRF to Arbitrary Post Deletion (no CVSS, Accept Donations with PayPal)
- [CVE-2021-24570](https://cve.now/CVE-2021-24570.md): Paypal Donation \< 1.3.1 - CSRF to Stored Cross-Site Scripting (no CVSS, Accept Donations with PayPal)
- [CVE-2021-24539](https://cve.now/CVE-2021-24539.md): Coming Soon, Under Construction & Maintenance Mode By Dazzler \< 1.6.7 - Admin+ Stored Cross-Site Scripting (no CVSS, Coming Soon, Under Construction & Maintenance Mode By Dazzl…)
- [CVE-2020-36505](https://cve.now/CVE-2020-36505.md): Delete All Comments Easily \<= 1.3 - All Comments Deletion via CSRF (no CVSS, Delete All Comments Easily)
- [CVE-2020-36504](https://cve.now/CVE-2020-36504.md): WP-Pro-Quiz \<= 0.37 - Arbitrary Quiz Deletion via CSRF (no CVSS, Wp-Pro-Quiz)
- [CVE-2020-36503](https://cve.now/CVE-2020-36503.md): Connections Business Directory \< 9.7 - Admin+ CSV Injection (no CVSS, Connections Business Directory)
- [CVE-2018-25019](https://cve.now/CVE-2018-25019.md): LearnDash \< 2.5.4 - Unauthenticated Arbitrary File Upload (no CVSS, LearnDash LMS)
- [CVE-2015-20067](https://cve.now/CVE-2015-20067.md): WP Attachment Export \< 0.2.4 - Unauthenticated Posts Download (no CVSS, WP Attachment Export)
- [CVE-2015-20019](https://cve.now/CVE-2015-20019.md): Content text slider on post \< 6.9 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Content text slider on post)
- [CVE-2015-10001](https://cve.now/CVE-2015-10001.md): WP-Stats \< 2.5.2 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, WP-Stats)
- [CVE-2021-41973](https://cve.now/CVE-2021-41973.md): Apache MINA HTTP listener DOS (no CVSS, Apache Software Foundation Apache MINA · org.apache.mina:mi…)
- [CVE-2021-40348](https://cve.now/CVE-2021-40348.md): Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. (no CVSS)
- [CVE-2021-41313](https://cve.now/CVE-2021-41313.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configurat (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-20839](https://cve.now/CVE-2021-20839.md): Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML Exte (no CVSS, Antenna House Office Server Document Converter)
- [CVE-2021-20838](https://cve.now/CVE-2021-20838.md): Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML Exte (no CVSS, Antenna House Office Server Document Converter)
- [CVE-2021-42574](https://cve.now/CVE-2021-42574.md): An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. (no CVSS)
- [CVE-2021-42694](https://cve.now/CVE-2021-42694.md): An issue was discovered in the character definitions of the Unicode Specification through 14.0. (CVSS 8.3)
- [CVE-2021-42917](https://cve.now/CVE-2021-42917.md): Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.