CVEs published December 6 to December 12, 2021
417 CVEs were published Dec 6 to Dec 12, 2021, 20 of them critical. CISA added 13 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 417
- Critical
- 20
- Added to CISA KEV
- 13
- Busiest day
- Wed, Dec 8 (137)
- Quietest day
- Sat, Dec 11 (2)
- December 6, 202155 CVEs · 8 critical
- December 7, 2021135 CVEs
- December 8, 2021137 CVEs · 6 critical
- December 9, 202153 CVEs · 3 critical
- December 10, 202132 CVEs · 2 critical
- December 11, 20212 CVEs
- December 12, 20213 CVEs · 1 critical
Added to CISA KEV 13
- CVE-2010-1871JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for
- CVE-2017-12149In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnRed Hat jbossas
- CVE-2017-17562Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked.
- CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in whiApache Solr · org.apache.solr:solr-core
- CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method.mongo-express
- CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre
- CVE-2019-7238Sonatype Nexus Repository Manager before 3.15.0 has Incorrect Access Control.
- CVE-2020-17463FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.
- CVE-2020-8816Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
- CVE-2021-35394Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary.
- CVE-2021-44168A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local Fortinet FortiOS
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsApache Software Foundation Apache Log4j2 · org.apache.lo… +4
- CVE-2021-44515Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in th