# CVEs published 2021-11-13

14 CVEs were published on November 13, 2021: 2 critical, 3 high. Days are UTC.

- [CVE-2021-41653](https://cve.now/CVE-2021-41653.md): The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)\_V5\_171211 is vulnerable to remote code execution (no CVSS)
- [CVE-2021-3683](https://cve.now/CVE-2021-3683.md): Cross-Site Request Forgery (CSRF) in star7th/showdoc (CVSS 5.4, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-3775](https://cve.now/CVE-2021-3775.md): Cross-Site Request Forgery (CSRF) in star7th/showdoc (CVSS 4.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-3776](https://cve.now/CVE-2021-3776.md): Cross-Site Request Forgery (CSRF) in star7th/showdoc (CVSS 4.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-3915](https://cve.now/CVE-2021-3915.md): Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack (CVSS 7.6, bookstackapp/bookstack · ssddanbrown/bookstack)
- [CVE-2021-3921](https://cve.now/CVE-2021-3921.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 5.4, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-3931](https://cve.now/CVE-2021-3931.md): Cross-Site Request Forgery (CSRF) in snipe/snipe-it (CVSS 4.3, snipe/snipe-it)
- [CVE-2021-3932](https://cve.now/CVE-2021-3932.md): Cross-Site Request Forgery (CSRF) in area17/twill (CVSS 6.3, area17/twill)
- [CVE-2021-3938](https://cve.now/CVE-2021-3938.md): Cross-site Scripting (XSS) - Generic in snipe/snipe-it (CVSS 3.9, snipe/snipe-it)
- [CVE-2021-3945](https://cve.now/CVE-2021-3945.md): Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk (CVSS 8.8, django-helpdesk/django-helpdesk · django-helpdesk)
- [CVE-2021-38684](https://cve.now/CVE-2021-38684.md): Buffer Overflow Vulnerability in Multimedia Console (CVSS 8.1, QNAP Systems Multimedia Console)
- [CVE-2021-34357](https://cve.now/CVE-2021-34357.md): Reflected XSS Vulnerability in QmailAgent (CVSS 6.9, QNAP Systems QmailAgent)
- [CVE-2021-3918](https://cve.now/CVE-2021-3918.md): Prototype Pollution in kriszyp/json-schema (CVSS 9.8, kriszyp/json-schema · json-schema)
- [CVE-2021-43616](https://cve.now/CVE-2021-43616.md): The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differ (CVSS 9.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-11-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.