# CVEs published 2021-11-09

71 CVEs were published on November 9, 2021: 1 critical, 8 high. Days are UTC.

- [CVE-2021-37157](https://cve.now/CVE-2021-37157.md): An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. (no CVSS)
- [CVE-2021-37158](https://cve.now/CVE-2021-37158.md): An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. (no CVSS)
- [CVE-2021-43575](https://cve.now/CVE-2021-43575.md): KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project i (no CVSS)
- [CVE-2021-35488](https://cve.now/CVE-2021-35488.md): Thruk 2.40-2 allows /thruk/#cgi-bin/status.cgi?style=combined&title={TITLE\] Reflected XSS via the host or title parameter. (no CVSS)
- [CVE-2021-35489](https://cve.now/CVE-2021-35489.md): Thruk 2.40-2 allows /thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME\]&service={SERVICENAME\]&backend={BACKEND\] Reflected XSS via the host or (no CVSS)
- [CVE-2021-43568](https://cve.now/CVE-2021-43568.md): The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non-zero, which allows (no CVSS)
- [CVE-2021-43570](https://cve.now/CVE-2021-43570.md): The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows atta (no CVSS, com.starkbank.ellipticcurve:starkbank-ecdsa)
- [CVE-2021-43571](https://cve.now/CVE-2021-43571.md): The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows a (no CVSS, starkbank-ecdsa)
- [CVE-2021-43572](https://cve.now/CVE-2021-43572.md): The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signa (no CVSS, starkbank-ecdsa)
- [CVE-2021-43569](https://cve.now/CVE-2021-43569.md): The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows at (no CVSS, starkbank-ecdsa)
- [CVE-2021-20119](https://cve.now/CVE-2021-20119.md): The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the adm (no CVSS, Arris SurfBoard SB8200)
- [CVE-2020-28419](https://cve.now/CVE-2020-28419.md): During installation with certain driver software or application packages an arbitrary code execution could occur. (no CVSS, HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide P…)
- [CVE-2021-43174](https://cve.now/CVE-2021-43174.md): gzip transfer encoding caused out-of-memory crash (no CVSS, NLnet Labs Routinator · routinator)
- [CVE-2021-43173](https://cve.now/CVE-2021-43173.md): Hanging RRDP request (no CVSS, NLnet Labs Routinator)
- [CVE-2021-43172](https://cve.now/CVE-2021-43172.md): Infinite length chain of RRDP repositories (no CVSS, NLnet Labs Routinator · routinator)
- [CVE-2021-43180](https://cve.now/CVE-2021-43180.md): In JetBrains Hub before 2021.1.13690, information disclosure via avatar metadata is possible. (no CVSS)
- [CVE-2021-43182](https://cve.now/CVE-2021-43182.md): In JetBrains Hub before 2021.1.13415, a DoS via user information is possible. (no CVSS)
- [CVE-2021-43181](https://cve.now/CVE-2021-43181.md): In JetBrains Hub before 2021.1.13690, stored XSS is possible. (no CVSS)
- [CVE-2019-18912](https://cve.now/CVE-2019-18912.md): A potential security vulnerability has been identified for certain HP printers and MFPs with Troy solutions. (no CVSS, HP LaserJet Enterprise Printers)
- [CVE-2021-43183](https://cve.now/CVE-2021-43183.md): In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed. (no CVSS)
- [CVE-2021-43203](https://cve.now/CVE-2021-43203.md): In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly. (no CVSS)
- [CVE-2021-43194](https://cve.now/CVE-2021-43194.md): In JetBrains TeamCity before 2021.1.2, user enumeration was possible. (no CVSS)
- [CVE-2021-43193](https://cve.now/CVE-2021-43193.md): In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible. (no CVSS)
- [CVE-2021-43196](https://cve.now/CVE-2021-43196.md): In JetBrains TeamCity before 2021.1, information disclosure via the Docker Registry connection dialog is possible. (no CVSS)
- [CVE-2021-43195](https://cve.now/CVE-2021-43195.md): In JetBrains TeamCity before 2021.1.2, some HTTP security headers were missing. (no CVSS)
- [CVE-2021-43197](https://cve.now/CVE-2021-43197.md): In JetBrains TeamCity before 2021.1.2, email notifications could include unescaped HTML for XSS. (no CVSS)
- [CVE-2021-43199](https://cve.now/CVE-2021-43199.md): In JetBrains TeamCity before 2021.1.2, permission checks in the Create Patch functionality are insufficient. (no CVSS)
- [CVE-2021-43198](https://cve.now/CVE-2021-43198.md): In JetBrains TeamCity before 2021.1.2, stored XSS is possible. (no CVSS)
- [CVE-2021-43200](https://cve.now/CVE-2021-43200.md): In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient. (no CVSS)
- [CVE-2021-43201](https://cve.now/CVE-2021-43201.md): In JetBrains TeamCity before 2021.1.3, a newly created project could take settings from an already deleted project. (no CVSS)
- [CVE-2021-43187](https://cve.now/CVE-2021-43187.md): In JetBrains YouTrack Mobile before 2021.2, the client-side cache on iOS could contain sensitive information. (no CVSS)
- [CVE-2021-43188](https://cve.now/CVE-2021-43188.md): In JetBrains YouTrack Mobile before 2021.2, access token protection on iOS is incomplete. (no CVSS)
- [CVE-2021-43189](https://cve.now/CVE-2021-43189.md): In JetBrains YouTrack Mobile before 2021.2, access token protection on Android is incomplete. (no CVSS)
- [CVE-2019-16240](https://cve.now/CVE-2019-16240.md): A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWide Managed Printers an (no CVSS)
- [CVE-2021-43190](https://cve.now/CVE-2021-43190.md): In JetBrains YouTrack Mobile before 2021.2, task hijacking on Android is possible. (no CVSS)
- [CVE-2021-43192](https://cve.now/CVE-2021-43192.md): In JetBrains YouTrack Mobile before 2021.2, iOS URL scheme hijacking is possible. (no CVSS)
- [CVE-2021-43191](https://cve.now/CVE-2021-43191.md): JetBrains YouTrack Mobile before 2021.2, is missing the security screen on Android and iOS. (no CVSS)
- [CVE-2021-43184](https://cve.now/CVE-2021-43184.md): In JetBrains YouTrack before 2021.3.21051, stored XSS is possible. (no CVSS)
- [CVE-2021-43185](https://cve.now/CVE-2021-43185.md): JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection. (no CVSS)
- [CVE-2021-43186](https://cve.now/CVE-2021-43186.md): JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS. (no CVSS)
- [CVE-2019-18914](https://cve.now/CVE-2019-18914.md): A potential security vulnerability has been identified for certain HP printers and MFPs that would allow redirection page Cross-Site Scripti (no CVSS, HP Color LaserJet Managed Printers, HP Color LaserJet Enter…)
- [CVE-2021-3641](https://cve.now/CVE-2021-3641.md): Improper Link Resolution Before File Access in Bitdefender GravityZone (VA-9921) (CVSS 6.1, Bitdefender GravityZone)
- [CVE-2019-18916](https://cve.now/CVE-2019-18916.md): A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead t (no CVSS, HP Color LaserJet Pro MFP M277 printers)
- [CVE-2021-43519](https://cve.now/CVE-2021-43519.md): Stack overflow in lua\_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script fi (no CVSS)
- [CVE-2021-42026](https://cve.now/CVE-2021-42026.md): A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions \< V8.18.13), Mendix Applications using Mendix 9 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2021-42025](https://cve.now/CVE-2021-42025.md): A vulnerability has been identified in Mendix Applications using Mendix 8 (All versions \< V8.18.13), Mendix Applications using Mendix 9 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2021-42021](https://cve.now/CVE-2021-42021.md): A vulnerability has been identified in Siveillance Video DLNA Server (2019 R1), Siveillance Video DLNA Server (2019 R2), Siveillance Video D (no CVSS, Siemens Siveillance Video DLNA Server)
- [CVE-2021-42015](https://cve.now/CVE-2021-42015.md): A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions \< V7.23.26), Mendix Applications using Mendix 8 (All (no CVSS, Siemens Mendix Applications using Mendix)
- [CVE-2021-40366](https://cve.now/CVE-2021-40366.md): A vulnerability has been identified in Climatix POL909 (AWB module) (All versions \< V11.42), Climatix POL909 (AWM module) (All versions \< V1 (no CVSS, Siemens Climatix POL909)
- [CVE-2021-40364](https://cve.now/CVE-2021-40364.md): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions \< V9.0 SP3 UC04), SIMATIC PCS 7 V (CVSS 5.5, Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC V15 and ea… +1)
- [CVE-2021-40359](https://cve.now/CVE-2021-40359.md): A vulnerability has been identified in OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions \< V9.0 Upd4), OpenPCS 7 V9.1 (All version (CVSS 7.7, Siemens OpenPCS 7 · Siemens SIMATIC BATCH +5)
- [CVE-2021-40358](https://cve.now/CVE-2021-40358.md): A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions \< V9.0 SP3 UC04), SIMATIC PCS 7 V (CVSS 9.9, Siemens SIMATIC PCS 7 · Siemens SIMATIC WinCC V15 and ea… +1)
- [CVE-2021-37207](https://cve.now/CVE-2021-37207.md): A vulnerability has been identified in SENTRON powermanager V3 (All versions). (no CVSS, Siemens SENTRON powermanager)
- [CVE-2021-31890](https://cve.now/CVE-2021-31890.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 7.5, Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2)
- [CVE-2021-31889](https://cve.now/CVE-2021-31889.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 7.5, Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2)
- [CVE-2021-31887](https://cve.now/CVE-2021-31887.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (no CVSS, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20)
- [CVE-2021-31888](https://cve.now/CVE-2021-31888.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (no CVSS, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20)
- [CVE-2021-31886](https://cve.now/CVE-2021-31886.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (no CVSS, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +20)
- [CVE-2021-31885](https://cve.now/CVE-2021-31885.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (no CVSS, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +21)
- [CVE-2021-31884](https://cve.now/CVE-2021-31884.md): A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC ( (no CVSS, Siemens APOGEE MBC (PPC) · Siemens APOGEE MEC (PPC) +21)
- [CVE-2021-31883](https://cve.now/CVE-2021-31883.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 7.1, Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…)
- [CVE-2021-31882](https://cve.now/CVE-2021-31882.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 6.5, Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…)
- [CVE-2021-31881](https://cve.now/CVE-2021-31881.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 7.1, Siemens Capital Embedded AR Classic 431-422 · Siemens Capit…)
- [CVE-2021-31346](https://cve.now/CVE-2021-31346.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 8.2, Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2)
- [CVE-2021-31345](https://cve.now/CVE-2021-31345.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 7.5, Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +1)
- [CVE-2021-31344](https://cve.now/CVE-2021-31344.md): A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions (CVSS 5.3, Siemens Capital Embedded AR Classic 431-422 · Siemens Ca… +2)
- [CVE-2020-10054](https://cve.now/CVE-2020-10054.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.12). (no CVSS, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2020-10053](https://cve.now/CVE-2020-10053.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.12). (no CVSS, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2020-10052](https://cve.now/CVE-2020-10052.md): A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions \< V2.12). (no CVSS, Siemens SIMATIC RTLS Locating Manager)
- [CVE-2021-43114](https://cve.now/CVE-2021-43114.md): FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. (CVSS 7.5)
- [CVE-2021-43466](https://cve.now/CVE-2021-43466.md): In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code executio (no CVSS, org.thymeleaf:thymeleaf-spring5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.