CVEs published November 9, 2021
71 CVEs were published on November 9, 2021: 1 critical, 8 high.
- Published
- 71
- Critical
- 1
- High
- 8
- Medium
- 4
- Low
- 0
- Unrated
- 58
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2
- 4
- Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20
- 3
- Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…
- 3
- Siemens Mendix Applications using Mendix
- 3
- Siemens SIMATIC RTLS Locating Manager
- 3
- starkbank-ecdsa
- 3
- NLnet Labs Routinator · routinator
- 2
- Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +21
- 2
- Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC V15 and ea… +1
- 2
- Arris SurfBoard SB8200
- 1
Critical 1
High 8
- CVE-2021-40359A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd4), OpenPCS 7 V9.1 (All versionSiemens OpenPCS 7 · Siemens SIMATIC BATCH +5
- CVE-2021-31890A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2
- CVE-2021-31889A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2
- CVE-2021-31883A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…
- CVE-2021-31881A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…
- CVE-2021-31346A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2
- CVE-2021-31345A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +1
- CVE-2021-43114FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate.
Medium, low and unrated 62
- CVE-2021-37157An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14.
- CVE-2021-37158An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14.
- CVE-2021-43575KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project i
- CVE-2021-35488Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE] Reflected XSS via the host or title parameter.
- CVE-2021-35489Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME]&service={SERVICENAME]&backend={BACKEND] Reflected XSS via the host or
- CVE-2021-43568The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows
- CVE-2021-43570The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attacom.starkbank.ellipticcurve:starkbank-ecdsa
- CVE-2021-43571The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows astarkbank-ecdsa
- CVE-2021-43572The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signastarkbank-ecdsa
- CVE-2021-43569The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows atstarkbank-ecdsa
- CVE-2021-20119The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the admArris SurfBoard SB8200
- CVE-2020-28419During installation with certain driver software or application packages an arbitrary code execution could occur.HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide P…
- CVE-2021-43174gzip transfer encoding caused out-of-memory crashNLnet Labs Routinator · routinator
- CVE-2021-43173Hanging RRDP requestNLnet Labs Routinator
- CVE-2021-43172Infinite length chain of RRDP repositoriesNLnet Labs Routinator · routinator
- CVE-2021-43180In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible.
- CVE-2021-43182In JetBrains Hub before 2021.1.13415, a DoS via user information is possible.
- CVE-2021-43181In JetBrains Hub before 2021.1.13690, stored XSS is possible.
- CVE-2019-18912A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions.HP LaserJet Enterprise Printers
- CVE-2021-43183In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.
- CVE-2021-43203In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly.
- CVE-2021-43194In JetBrains TeamCity before 2021.1.2, user enumeration was possible.
- CVE-2021-43193In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.
- CVE-2021-43196In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible.
- CVE-2021-43195In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing.
- CVE-2021-43197In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS.
- CVE-2021-43199In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient.
- CVE-2021-43198In JetBrains TeamCity before 2021.1.2, stored XSS is possible.
- CVE-2021-43200In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.
- CVE-2021-43201In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project.
- CVE-2021-43187In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information.
- CVE-2021-43188In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete.
- CVE-2021-43189In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete.
- CVE-2019-16240A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWide Managed Printers an
- CVE-2021-43190In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible.
- CVE-2021-43192In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible.
- CVE-2021-43191JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS.
- CVE-2021-43184In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
- CVE-2021-43185JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.
- CVE-2021-43186JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
- CVE-2019-18914A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site ScriptiHP Color LaserJet Managed Printers, HP Color LaserJet Enter…
- CVE-2021-3641Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921)Bitdefender GravityZone
- CVE-2019-18916A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead tHP Color LaserJet Pro MFP M277 printers
- CVE-2021-43519Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script fi
- CVE-2021-42026A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (AllSiemens Mendix Applications using Mendix
- CVE-2021-42025A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions < V8.18.13), Mendix Applications using Mendix 9 (AllSiemens Mendix Applications using Mendix
- CVE-2021-42021A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video DSiemens Siveillance Video DLNA Server
- CVE-2021-42015A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (AllSiemens Mendix Applications using Mendix
- CVE-2021-40366A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42), Climatix POL909 (AWM module) (All versions < V1Siemens Climatix POL909
- CVE-2021-40364A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 VSiemens SIMATIC PCS 7 · Siemens SIMATIC WinCC V15 and ea… +1
- CVE-2021-37207A vulnerability has been identified in SENTRON powermanager V3 (All versions).Siemens SENTRON powermanager
- CVE-2021-31887A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20
- CVE-2021-31888A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20
- CVE-2021-31886A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20
- CVE-2021-31885A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +21
- CVE-2021-31884A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +21
- CVE-2021-31882A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…
- CVE-2021-31344A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2
- CVE-2020-10054A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12).Siemens SIMATIC RTLS Locating Manager
- CVE-2020-10053A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12).Siemens SIMATIC RTLS Locating Manager
- CVE-2020-10052A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12).Siemens SIMATIC RTLS Locating Manager
- CVE-2021-43466In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code executioorg.thymeleaf:thymeleaf-spring5