CVEs published December 1, 2021
73 CVEs were published on December 1, 2021: 0 critical, 14 high.
- Published
- 73
- Critical
- 0
- High
- 14
- Medium
- 18
- Low
- 0
- Unrated
- 41
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- ELECOM CO. ELECOM LAN routers
- 8
- IBM QRadar SIEM
- 4
- star7th/showdoc · showdoc/showdoc
- 4
- discourse
- 3
- ELECOM CO. ELECOM routers
- 3
- kevinpapst/kimai2
- 3
- Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67
- 3
- Sunnet eHRD
- 3
- ELECOM CO. ELECOM LAN router
- 2
- Events Manager
- 2
High 14
- CVE-2021-20611Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67
- CVE-2021-20610Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R SeriesMitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67
- CVE-2021-20609Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67
- CVE-2020-10627Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an InsInsulet Omnipod Insulin Management System
- CVE-2021-32592An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.Fortinet FortiClientWindows, FortiClientEMS
- CVE-2021-3985Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-3994Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdeskdjango-helpdesk/django-helpdesk · django-helpdesk
- CVE-2021-4017Cross-Site Request Forgery (CSRF) in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-34599Improper Certificate Validation in CODESYS GitCODESYS Git
- CVE-2021-43360Sunnet eHRD - Insecure DeserializationSunnet eHRD
- CVE-2021-43359Sunnet eHRD - Broken Access ControlSunnet eHRD
- CVE-2021-43358Sunnet eHRD - Path TraversalSunnet eHRD
- CVE-2021-3984Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2021-4019Heap-based Buffer Overflow in vim/vimvim/vim
Medium, low and unrated 59
- CVE-2020-35037Events Manager < 5.9.8 - Cross-Site Scripting (XSS)Events Manager
- CVE-2020-35012Events Manager < 5.9.8 - Admin+ SQL InjectionEvents Manager
- CVE-2021-42711Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2021-33265D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33266D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33267D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33268D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33269D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33270D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33271D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-33274D-Link DIR-809 devices with firmware through DIR-809Ax_FW1.12WWB03_20190410 were discovered to contain a stack buffer overflow vulnerability
- CVE-2021-43793Bypass of Poll voting limits in Discoursediscourse
- CVE-2021-43794Anonymous user cache poisoning via development-mode header in Discoursediscourse
- CVE-2021-43792Notifications leak in Discoursediscourse
- CVE-2021-43137Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in m
- CVE-2021-43451SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php.
- CVE-2021-29863IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF).IBM QRadar SIEM
- CVE-2021-29849IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting.IBM QRadar SIEM
- CVE-2021-29779IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exchange without entityIBM QRadar SIEM
- CVE-2021-20400IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive infoIBM QRadar SIEM
- CVE-2021-42776CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import.
- CVE-2021-43687chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a messag
- CVE-2021-26334AMD Chipset Driver Information Disclosure VulnerabilityAMD μProf Tool
- CVE-2021-44480Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surro
- CVE-2021-43685libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/Show
- CVE-2021-44479NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Progra
- CVE-2021-40154NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of U
- CVE-2021-43689manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.c
- CVE-2021-25967CKAN - Stored Cross-Site Scripting (XSS) via SVG File Uploadckan
- CVE-2021-44277Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.librenms/librenms
- CVE-2021-44279Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.librenms/librenms
- CVE-2021-44280attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function.
- CVE-2021-43690YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php.
- CVE-2021-3964Authorization Bypass Through User-Controlled Key in elgg/elggelgg/elgg
- CVE-2021-3983Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-3989Open Redirect in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-3990Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-3992Improper Access Control in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-3993Cross-Site Request Forgery (CSRF) in star7th/showdocstar7th/showdoc · showdoc/showdoc
- CVE-2021-4015Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2021-4018Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2021-20864Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-ELECOM CO. ELECOM routers
- CVE-2021-20863OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-116ELECOM CO. ELECOM routers
- CVE-2021-20862Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-ELECOM CO. ELECOM routers
- CVE-2021-20861Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, ELECOM CO. ELECOM LAN routers
- CVE-2021-20860Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 aELECOM CO. ELECOM LAN routers
- CVE-2021-20859ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WELECOM CO. ELECOM LAN routers
- CVE-2021-20858Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inELECOM CO. ELECOM LAN router
- CVE-2021-20857Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to inELECOM CO. ELECOM LAN router
- CVE-2021-20856Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) aELECOM CO. ELECOM LAN routers
- CVE-2021-20855Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) aELECOM CO. ELECOM LAN routers
- CVE-2021-20854ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker withELECOM CO. ELECOM LAN routers
- CVE-2021-20853ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker withELECOM CO. ELECOM LAN routers
- CVE-2021-20852Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allowsELECOM CO. ELECOM LAN routers
- CVE-2021-20851Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticatedAftab Muni Browser and Operating System Finder
- CVE-2021-20847Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP_1_11G, 38JP_1_11J, 38JP_1_11K, 38JP_1_11L, 38JP_1_26F, 38JP_1_26G, 38JP_1_2NTT DOCOMO Wi-Fi STATION SH-52A
- CVE-2021-40809An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921.
- CVE-2021-38575NetworkPkg/IScsiDxe has remotely exploitable buffer overflows.TianoCore EDK II
- CVE-2021-41039In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excThe Eclipse Foundation Eclipse Mosquitto