CVEs published November 4, 2021
65 CVEs were published on November 4, 2021: 4 critical, 7 high.
- Published
- 65
- Critical
- 4
- High
- 7
- Medium
- 22
- Low
- 6
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- GitLab
- 16
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 13
- Cisco Catalyst PON Series
- 3
- Cisco Small Business Smart and Managed Switches
- 2
- Cisco Webex Video Mesh
- 2
- Beckhoff Automation TwinCAT OPC UA Server
- 1
- Cisco AnyConnect Secure Mobility Client
- 1
- Cisco Common Services Platform Collector Software
- 1
- Cisco Email Security Appliance
- 1
- Cisco Policy Suite (CPS) Software
- 1
Critical 4
- CVE-2021-40119Cisco Policy Suite Static SSH Keys VulnerabilityCisco Policy Suite (CPS) Software
- CVE-2021-40113Cisco Catalyst PON Series Switches Optical Network Terminal VulnerabilitiesCisco Catalyst PON Series
- CVE-2021-40112Cisco Catalyst PON Series Switches Optical Network Terminal VulnerabilitiesCisco Catalyst PON Series
- CVE-2021-34795Cisco Catalyst PON Series Switches Optical Network Terminal VulnerabilitiesCisco Catalyst PON Series
High 7
- CVE-2021-22260A stored Cross-Site Scripting vulnerability in the DataDog integration in all versions of GitLab CE/EE starting from 13.7 before 14.0.9, allGitLab
- CVE-2021-39906Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the vicGitLab
- CVE-2021-41248XSS vulnerability in GraphiQLgraphql graphiql · graphiql
- CVE-2021-41249XSS vulnerability in GraphQL Playgroundgraphql-playground · graphql-playground-react
- CVE-2021-34739Cisco Small Business Series Switches Session Credentials Replay VulnerabilityCisco Small Business Smart and Managed Switches
- CVE-2021-34741Cisco Email Security Appliance Denial of Service VulnerabilityCisco Email Security Appliance
- CVE-2021-34597Phoenix Contact: PC Worx/-Express prone to improper input validation vulnerabilityPhoenix Contact PC Worx
Medium, low and unrated 54
- CVE-2021-39898In all versions of GitLab CE/EE since version 10.6, a project export leaks the external webhook token value which may allow access to the prGitLab
- CVE-2021-39905An information disclosure vulnerability in the GitLab CE/EE API since version 8.9.6 allows a user to see basic information on private groupsGitLab
- CVE-2021-39911An improper access control flaw in all versions of GitLab CE/EE starting from 13.9 before 14.2.6, all versions starting from 14.3 before 14.GitLab
- CVE-2021-39907A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 13.7.GitLab
- CVE-2021-39904An Improper Access Control vulnerability in the GraphQL API in all versions of GitLab CE/EE starting from 13.1 before 14.2.6, all versions sGitLab
- CVE-2021-39895In all versions of GitLab CE/EE since version 8.0, an attacker can set the pipeline schedules to be active in a project export so when an unGitLab
- CVE-2021-39901In all versions of GitLab CE/EE since version 11.10, an admin of a group can see the SCIM token of that group by visiting a specific endpoinGitLab
- CVE-2021-39913Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14GitLab
- CVE-2021-39897Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent groGitLab
- CVE-2021-39912A potential DoS vulnerability was discovered in GitLab CE/EE starting with version 13.7.GitLab
- CVE-2021-39909Lack of email address ownership verification in the CODEOWNERS feature in all versions of GitLab EE starting from 11.3 before 14.2.6, all veGitLab
- CVE-2021-39903In all versions of GitLab CE/EE since version 13.0, a privileged user, through an API call, can change the visibility level of a group or a GitLab
- CVE-2021-39902Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incidentGitLab
- CVE-2021-39914A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of rGitLab
- CVE-2021-42057Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.obsidian-dataview
- CVE-2021-43398Crypto++ (aka Cryptopp) 8.6.0 and earlier contains a timing leakage in MakePublicKey().
- CVE-2021-43396In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via
- CVE-2020-21139EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admi
- CVE-2021-43389An issue was discovered in the Linux kernel before 5.14.15.
- CVE-2021-43293Sonatype Nexus Repository Manager 3.x before 3.36.0 allows a remote authenticated attacker to potentially perform network enumeration via Se
- CVE-2021-43281MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission.
- CVE-2021-41247incomplete logout in JupyterHubjupyterhub
- CVE-2021-21698Jenkins Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller frJenkins project Jenkins Subversion Plugin · org.jenkins-ci.…
- CVE-2021-21697Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allows any agent to read and write the contents of any build directory stored in Jenkins Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21696Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the libs/ directory inside build directories whJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21695FilePath#listFiles lists files outside directories that agents are allowed to access when following symbolic links in Jenkins 2.318 and earlJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21694FilePath#toURI, FilePath#hasSymlink, FilePath#absolutize, FilePath#isDescendant, and FilePath#get*DiskSpace do not check any permissions in Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21692FilePath#renameTo and FilePath#moveAllChildrenTo in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier only check 'read' agent-to-controllerJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21691Creating symbolic links is possible without the 'symlink' agent-to-controller access control permission in Jenkins 2.318 and earlier, LTS 2.Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21690Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path in Jenkins 2.318 and Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21689FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and eJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21688The agent-to-controller security check FilePath#reading(FileVisitor) in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not reject aJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21687Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create symbolic links when unarchiving a symJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21686File path filters in the agent-to-controller security subsystem of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier do not canonicalize paJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-21685Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirsJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-1500Cisco Webex Video Mesh Arbitrary Site Redirection VulnerabilityCisco Webex Video Mesh
- CVE-2021-34701Cisco Unified Communications Products Path Traversal VulnerabilityCisco Unity Connection
- CVE-2021-34731Cisco Prime Access Registrar Stored Cross-Site Scripting VulnerabilityCisco Prime Access Registrar
- CVE-2021-34784Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting VulnerabilityCisco Prime Infrastructure
- CVE-2021-40126Cisco Umbrella Email Enumeration VulnerabilityCisco Umbrella Insights Virtual Appliance
- CVE-2021-40124Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Privilege Escalation VulnerabilityCisco AnyConnect Secure Mobility Client
- CVE-2021-40120Cisco Small Business RV Series Routers Command Injection VulnerabilityCisco Small Business RV Series Router Firmware
- CVE-2021-40115Cisco Webex Video Mesh Cross-Site Scripting VulnerabilityCisco Webex Video Mesh
- CVE-2021-34774Cisco Common Services Platform Collector Information Disclosure VulnerabilityCisco Common Services Platform Collector Software
- CVE-2021-34773Cisco Unified Communications Products Cross-Site Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2021-40128Cisco Webex Meetings Email Content Injection VulnerabilityCisco Webex Meetings
- CVE-2021-40127Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Denial of Service VulnerabilityCisco Small Business Smart and Managed Switches
- CVE-2021-42624A local buffer overflow vulnerability exists in the latest version of Miniftpd in ftpproto.c through the tmp variable, where a crafted paylo
- CVE-2020-25368A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2020-25366An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS)
- CVE-2020-25367A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05.
- CVE-2021-34594Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA ServerBeckhoff Automation TwinCAT OPC UA Server
- CVE-2021-21693When creating temporary files, agent-to-controller access to create those files is only checked after they've been created in Jenkins 2.318 Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-43400An issue was discovered in gatt-database.c in BlueZ 5.61.