CVEs published November 3, 2021
77 CVEs were published on November 3, 2021: 0 critical, 6 high.
- Published
- 77
- Critical
- 0
- High
- 6
- Medium
- 14
- Low
- 1
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- Delta Electronics DIALink
- 10
- Apache Software Foundation Apache Traffic Server
- 6
- Mozilla Firefox · Mozilla Thunderbird
- 5
- Mozilla Firefox
- 4
- Mozilla Thunderbird · Mozilla Firefox ESR +1
- 2
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- bootstrap-table
- 1
- dotty
- 1
- Druid
- 1
- Fortinet FortiManager
- 1
High 6
- CVE-2021-38416Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38420Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38422Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38418Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-41134Stored XSS in Jupyter nbdimejupyter nbdime · nbdime +1
- CVE-2021-41312Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service ManageAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 71
- CVE-2021-41562Deletion of arbitrary files vulnerability in Snow Agent for WindowsSnow Agent for Windows
- CVE-2021-43032In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and sav
- CVE-2021-43339In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export
- CVE-2021-22960The parse function in llhttp < 2.1.4 and < 6.0.6.NodeJS Node
- CVE-2021-42772Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo
- CVE-2021-41492Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page i
- CVE-2021-35053Possible system denial of service in case of arbitrary changing Firefox browser parameters.Kaspersky Endpoint Security for Windows
- CVE-2021-33800In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.Druid
- CVE-2020-6931HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege.HP Print and Scan Doctor
- CVE-2021-38488Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38428Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38407Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38424Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38403Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2021-38411Delta Electronics DIALinkDelta Electronics DIALink
- CVE-2020-28416HP has identified a security vulnerability with the I.R.I.S.HP OfficeJet Printer; HP PageWide Printer
- CVE-2021-43141Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application.
- CVE-2021-43140SQL Injection vulnerability exists in Sourcecodester.
- CVE-2021-41174XSS vulnerability allowing arbitrary JavaScript executiongrafana · @grafana/data
- CVE-2020-18263PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter.
- CVE-2020-18261An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands.
- CVE-2020-18262ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.
- CVE-2020-18259ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php.
- CVE-2021-23472Cross-site Scripting (XSS)bootstrap-table
- CVE-2021-23784Cross-site Scripting (XSS)tempura
- CVE-2021-23509Prototype Pollutionjson-ptr
- CVE-2021-23807Prototype Pollutionjsonpointer · org.webjars.npm:json-pointer
- CVE-2021-23624Prototype Pollutiondotty
- CVE-2021-23820Prototype Pollutionjson-pointer
- CVE-2020-23680An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possib
- CVE-2020-23679Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field
- CVE-2021-40985A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_loa
- CVE-2020-24000SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the ti
- CVE-2021-27836An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a cra
- CVE-2020-24743An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via
- CVE-2020-20982Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges,
- CVE-2021-26786An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the pu
- CVE-2020-23109Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denia
- CVE-2020-23126Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social ne
- CVE-2021-43082heap-buffer-overflow with stats-over-http pluginApache Software Foundation Apache Traffic Server
- CVE-2021-41585ATS stops accepting connections on FreeBSDApache Software Foundation Apache Traffic Server
- CVE-2021-38161Not validating origin TLS certificateApache Software Foundation Apache Traffic Server
- CVE-2021-37149Request Smuggling - multiple attacksApache Software Foundation Apache Traffic Server
- CVE-2021-37148Request Smuggling - transfer encoding validationApache Software Foundation Apache Traffic Server
- CVE-2021-37147Request Smuggling - LF line endingApache Software Foundation Apache Traffic Server
- CVE-2021-43130An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in cust
- CVE-2021-43324LibreNMS through 21.10.2 allows XSS via a widget title.librenms/librenms
- CVE-2021-36697With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component.
- CVE-2021-36698Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.
- CVE-2021-36192An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2.Fortinet FortiManager
- CVE-2021-40849In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited a
- CVE-2021-40848In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interp
- CVE-2021-33209An issue was discovered in Fimer Aurora Vision before 2.97.10.
- CVE-2021-33210An issue was discovered in Fimer Aurora Vision before 2.97.10.
- CVE-2020-5955An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets.
- CVE-2021-39237Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosurHP LaserJet; HP LaserJet Managed; HP PageWide; HP PageWide…
- CVE-2021-39238Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential bufHP Enterprise LaserJet; HP LaserJet Managed; HP Enterprise…
- CVE-2021-29991Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers.Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-29993Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs.Mozilla Firefox
- CVE-2021-38491Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded.Mozilla Firefox
- CVE-2021-38492When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and exMozilla Firefox · Mozilla Thunderbird
- CVE-2021-38493Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13.Mozilla Firefox ESR · Mozilla Thunderbird +1
- CVE-2021-38494Mozilla developers reported memory safety bugs present in Firefox 91.Mozilla Firefox
- CVE-2021-38495Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0.Mozilla Thunderbird · Mozilla Firefox ESR
- CVE-2021-38496During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentialMozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-38497Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to poMozilla Firefox · Mozilla Thunderbird
- CVE-2021-38498During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potMozilla Firefox · Mozilla Thunderbird
- CVE-2021-38499Mozilla developers reported memory safety bugs present in Firefox 92.Mozilla Firefox
- CVE-2021-38500Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.Mozilla Thunderbird · Mozilla Firefox ESR +1
- CVE-2021-38501Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1.Mozilla Firefox · Mozilla Thunderbird
- CVE-2021-38502Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection.Mozilla Thunderbird