# CVEs published 2021-11-03

77 CVEs were published on November 3, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2021-41562](https://cve.now/CVE-2021-41562.md): Deletion of arbitrary files vulnerability in Snow Agent for Windows (CVSS 6.1, Snow Agent for Windows)
- [CVE-2021-43032](https://cve.now/CVE-2021-43032.md): In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and sav (no CVSS)
- [CVE-2021-43339](https://cve.now/CVE-2021-43339.md): In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file\_name in the export (no CVSS)
- [CVE-2021-22960](https://cve.now/CVE-2021-22960.md): The parse function in llhttp \< 2.1.4 and \< 6.0.6. (no CVSS, NodeJS Node)
- [CVE-2021-42772](https://cve.now/CVE-2021-42772.md): Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly Local Management mo (no CVSS)
- [CVE-2021-41492](https://cve.now/CVE-2021-41492.md): Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page i (no CVSS)
- [CVE-2021-35053](https://cve.now/CVE-2021-35053.md): Possible system denial of service in case of arbitrary changing Firefox browser parameters. (no CVSS, Kaspersky Endpoint Security for Windows)
- [CVE-2021-33800](https://cve.now/CVE-2021-33800.md): In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. (no CVSS, Druid)
- [CVE-2020-6931](https://cve.now/CVE-2020-6931.md): HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege. (no CVSS, HP Print and Scan Doctor)
- [CVE-2021-38488](https://cve.now/CVE-2021-38488.md): Delta Electronics DIALink (CVSS 5.5, Delta Electronics DIALink)
- [CVE-2021-38416](https://cve.now/CVE-2021-38416.md): Delta Electronics DIALink (CVSS 7.8, Delta Electronics DIALink)
- [CVE-2021-38428](https://cve.now/CVE-2021-38428.md): Delta Electronics DIALink (CVSS 5.5, Delta Electronics DIALink)
- [CVE-2021-38420](https://cve.now/CVE-2021-38420.md): Delta Electronics DIALink (CVSS 7.8, Delta Electronics DIALink)
- [CVE-2021-38407](https://cve.now/CVE-2021-38407.md): Delta Electronics DIALink (CVSS 5.5, Delta Electronics DIALink)
- [CVE-2021-38424](https://cve.now/CVE-2021-38424.md): Delta Electronics DIALink (CVSS 5.9, Delta Electronics DIALink)
- [CVE-2021-38403](https://cve.now/CVE-2021-38403.md): Delta Electronics DIALink (CVSS 5.5, Delta Electronics DIALink)
- [CVE-2021-38422](https://cve.now/CVE-2021-38422.md): Delta Electronics DIALink (CVSS 7.8, Delta Electronics DIALink)
- [CVE-2021-38418](https://cve.now/CVE-2021-38418.md): Delta Electronics DIALink (CVSS 8.8, Delta Electronics DIALink)
- [CVE-2021-38411](https://cve.now/CVE-2021-38411.md): Delta Electronics DIALink (CVSS 5.5, Delta Electronics DIALink)
- [CVE-2020-28416](https://cve.now/CVE-2020-28416.md): HP has identified a security vulnerability with the I.R.I.S. (no CVSS, HP OfficeJet Printer; HP PageWide Printer)
- [CVE-2021-43141](https://cve.now/CVE-2021-43141.md): Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan\_application. (no CVSS)
- [CVE-2021-43140](https://cve.now/CVE-2021-43140.md): SQL Injection vulnerability exists in Sourcecodester. (no CVSS)
- [CVE-2021-41174](https://cve.now/CVE-2021-41174.md): XSS vulnerability allowing arbitrary JavaScript execution (CVSS 6.9, grafana · @grafana/data)
- [CVE-2020-18263](https://cve.now/CVE-2020-18263.md): PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. (no CVSS)
- [CVE-2020-18261](https://cve.now/CVE-2020-18261.md): An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. (no CVSS)
- [CVE-2020-18262](https://cve.now/CVE-2020-18262.md): ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter. (no CVSS)
- [CVE-2020-18259](https://cve.now/CVE-2020-18259.md): ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. (no CVSS)
- [CVE-2021-41134](https://cve.now/CVE-2021-41134.md): Stored XSS in Jupyter nbdime (CVSS 8.7, jupyter nbdime · nbdime +1)
- [CVE-2021-23472](https://cve.now/CVE-2021-23472.md): Cross-site Scripting (XSS) (CVSS 3.1, bootstrap-table)
- [CVE-2021-23784](https://cve.now/CVE-2021-23784.md): Cross-site Scripting (XSS) (CVSS 5.4, tempura)
- [CVE-2021-23509](https://cve.now/CVE-2021-23509.md): Prototype Pollution (CVSS 5.6, json-ptr)
- [CVE-2021-23807](https://cve.now/CVE-2021-23807.md): Prototype Pollution (CVSS 5.6, jsonpointer · org.webjars.npm:json-pointer)
- [CVE-2021-23624](https://cve.now/CVE-2021-23624.md): Prototype Pollution (CVSS 5.6, dotty)
- [CVE-2021-23820](https://cve.now/CVE-2021-23820.md): Prototype Pollution (CVSS 5.6, json-pointer)
- [CVE-2020-23680](https://cve.now/CVE-2020-23680.md): An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial of service or possib (no CVSS)
- [CVE-2020-23679](https://cve.now/CVE-2020-23679.md): Buffer overflow vulnerability in Renleilei1992 Linux\_Network\_Project 1.0, allows attackers to execute arbitrary code, via the password field (no CVSS)
- [CVE-2021-40985](https://cve.now/CVE-2021-40985.md): A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image\_loa (no CVSS)
- [CVE-2020-24000](https://cve.now/CVE-2020-24000.md): SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the ti (no CVSS)
- [CVE-2021-27836](https://cve.now/CVE-2021-27836.md): An issue was discoverered in in function xls\_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial of service, via a cra (no CVSS)
- [CVE-2020-24743](https://cve.now/CVE-2020-24743.md): An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via (no CVSS)
- [CVE-2020-20982](https://cve.now/CVE-2020-20982.md): Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, (no CVSS)
- [CVE-2021-26786](https://cve.now/CVE-2021-26786.md): An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbitrary code via the pu (no CVSS)
- [CVE-2020-23109](https://cve.now/CVE-2020-23109.md): Buffer overflow vulnerability in function convert\_colorspace in heif\_colorconversion.cc in libheif v1.6.2, allows attackers to cause a denia (no CVSS)
- [CVE-2020-23126](https://cve.now/CVE-2020-23126.md): Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/herself and social ne (no CVSS)
- [CVE-2021-43082](https://cve.now/CVE-2021-43082.md): heap-buffer-overflow with stats-over-http plugin (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-41585](https://cve.now/CVE-2021-41585.md): ATS stops accepting connections on FreeBSD (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-38161](https://cve.now/CVE-2021-38161.md): Not validating origin TLS certificate (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-37149](https://cve.now/CVE-2021-37149.md): Request Smuggling - multiple attacks (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-37148](https://cve.now/CVE-2021-37148.md): Request Smuggling - transfer encoding validation (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-37147](https://cve.now/CVE-2021-37147.md): Request Smuggling - LF line ending (no CVSS, Apache Software Foundation Apache Traffic Server)
- [CVE-2021-43130](https://cve.now/CVE-2021-43130.md): An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in cust (no CVSS)
- [CVE-2021-43324](https://cve.now/CVE-2021-43324.md): LibreNMS through 21.10.2 allows XSS via a widget title. (no CVSS, librenms/librenms)
- [CVE-2021-36697](https://cve.now/CVE-2021-36697.md): With an admin account, the .htaccess file in Artica Pandora FMS \<=755 can be overwritten with the File Manager component. (no CVSS)
- [CVE-2021-36698](https://cve.now/CVE-2021-36698.md): Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name. (no CVSS)
- [CVE-2021-36192](https://cve.now/CVE-2021-36192.md): An exposure of sensitive information to an unauthorized actor \[CWE-200\] vulnerability in FortiManager 7.0.1 and below, 6.4.6 and below, 6.2. (CVSS 5.2, Fortinet FortiManager)
- [CVE-2021-40849](https://cve.now/CVE-2021-40849.md): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited a (no CVSS)
- [CVE-2021-40848](https://cve.now/CVE-2021-40848.md): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interp (no CVSS)
- [CVE-2021-33209](https://cve.now/CVE-2021-33209.md): An issue was discovered in Fimer Aurora Vision before 2.97.10. (no CVSS)
- [CVE-2021-33210](https://cve.now/CVE-2021-33210.md): An issue was discovered in Fimer Aurora Vision before 2.97.10. (no CVSS)
- [CVE-2021-41312](https://cve.now/CVE-2021-41312.md): Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service Manage (CVSS 7.5, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2020-5955](https://cve.now/CVE-2020-5955.md): An issue was discovered in Int15MicrocodeSmm in Insyde InsydeH2O before 2021-10-14 on Intel client chipsets. (no CVSS)
- [CVE-2021-39237](https://cve.now/CVE-2021-39237.md): Certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers may be vulnerable to potential information disclosur (no CVSS, HP LaserJet; HP LaserJet Managed; HP PageWide; HP PageWide…)
- [CVE-2021-39238](https://cve.now/CVE-2021-39238.md): Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buf (no CVSS, HP Enterprise LaserJet; HP LaserJet Managed; HP Enterprise…)
- [CVE-2021-29991](https://cve.now/CVE-2021-29991.md): Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-29993](https://cve.now/CVE-2021-29993.md): Firefox for Android allowed navigations through the \`intent://\` protocol, which could be used to cause crashes and UI spoofs. (no CVSS, Mozilla Firefox)
- [CVE-2021-38491](https://cve.now/CVE-2021-38491.md): Mixed-content checks were unable to analyze opaque origins which led to some mixed content being loaded. (no CVSS, Mozilla Firefox)
- [CVE-2021-38492](https://cve.now/CVE-2021-38492.md): When delegating navigations to the operating system, Firefox would accept the \`mk\` scheme which might allow attackers to launch pages and ex (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-38493](https://cve.now/CVE-2021-38493.md): Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2021-38494](https://cve.now/CVE-2021-38494.md): Mozilla developers reported memory safety bugs present in Firefox 91. (no CVSS, Mozilla Firefox)
- [CVE-2021-38495](https://cve.now/CVE-2021-38495.md): Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR)
- [CVE-2021-38496](https://cve.now/CVE-2021-38496.md): During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potential (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-38497](https://cve.now/CVE-2021-38497.md): Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to po (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-38498](https://cve.now/CVE-2021-38498.md): During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a pot (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-38499](https://cve.now/CVE-2021-38499.md): Mozilla developers reported memory safety bugs present in Firefox 92. (no CVSS, Mozilla Firefox)
- [CVE-2021-38500](https://cve.now/CVE-2021-38500.md): Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. (no CVSS, Mozilla Thunderbird · Mozilla Firefox ESR +1)
- [CVE-2021-38501](https://cve.now/CVE-2021-38501.md): Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2021-38502](https://cve.now/CVE-2021-38502.md): Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. (no CVSS, Mozilla Thunderbird)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.