13 November 2021

14 results · Feed

• Unscored —
  CVE-2021-41653 Public exploit EPSS 76%

  The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to …

  Nov 13, 2021
• Medium 5.4
  CVE-2021-3683

  Cross-Site Request Forgery (CSRF) in star7th/showdoc

  showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

  star7th star7th/showdoc showdoc/showdoc Packagist
  Nov 13, 2021
• Medium 4.3
  CVE-2021-3775

  Cross-Site Request Forgery (CSRF) in star7th/showdoc

  showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

  star7th star7th/showdoc showdoc/showdoc Packagist
  Nov 13, 2021
• Medium 4.3
  CVE-2021-3776

  Cross-Site Request Forgery (CSRF) in star7th/showdoc

  showdoc is vulnerable to Cross-Site Request Forgery (CSRF)

  star7th star7th/showdoc showdoc/showdoc Packagist
  Nov 13, 2021
• High 7.6
  CVE-2021-3915

  Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack

  bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type

  BookStackApp bookstackapp/bookstack ssddanbrown/bookstack Packagist
  Nov 13, 2021
• Medium 5.4
  CVE-2021-3921

  Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

  firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

  firefly-iii firefly-iii/firefly-iii grumpydictator/firefly-iii Packagist
  Nov 13, 2021
• Medium 4.3
  CVE-2021-3931

  Cross-Site Request Forgery (CSRF) in snipe/snipe-it

  snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

  snipe snipe/snipe-it snipe/snipe-it Packagist
  Nov 13, 2021
• Medium 6.3
  CVE-2021-3932

  Cross-Site Request Forgery (CSRF) in area17/twill

  twill is vulnerable to Cross-Site Request Forgery (CSRF)

  area17 area17/twill area17/twill Packagist
  Nov 13, 2021
• Low 3.9
  CVE-2021-3938

  Cross-site Scripting (XSS) - Generic in snipe/snipe-it

  snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  snipe snipe/snipe-it snipe/snipe-it Packagist
  Nov 13, 2021
• High 8.8
  CVE-2021-3945

  Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk

  django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  django-helpdesk django-helpdesk/django-helpdesk django-helpdesk PyPI
  Nov 13, 2021
• High 8.1
  CVE-2021-38684

  Buffer Overflow Vulnerability in Multimedia Console

  A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Multimedia Console. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Multimedi…

  QNAP Systems Multimedia Console
  Nov 13, 2021
• Medium 6.9
  CVE-2021-34357

  Reflected XSS Vulnerability in QmailAgent

  A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Qma…

  QNAP Systems QmailAgent
  Nov 13, 2021
• Critical 9.8
  CVE-2021-3918

  Prototype Pollution in kriszyp/json-schema

  json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

  kriszyp kriszyp/json-schema node-json-schema node-json-schema Debian Ubuntu npm
  Nov 13, 2021
• Critical 9.0
  CVE-2021-43616 Public exploit

  The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pac…

  npm npm npm Debian Ubuntu Alpine
  Nov 13, 2021