# CVEs published 2021-12-01

73 CVEs were published on December 1, 2021: 0 critical, 14 high. Days are UTC.

- [CVE-2020-35037](https://cve.now/CVE-2020-35037.md): Events Manager \< 5.9.8 - Cross-Site Scripting (XSS) (no CVSS, Events Manager)
- [CVE-2020-35012](https://cve.now/CVE-2020-35012.md): Events Manager \< 5.9.8 - Admin+ SQL Injection (no CVSS, Events Manager)
- [CVE-2021-42711](https://cve.now/CVE-2021-42711.md): Barracuda Network Access Client before 5.2.2 creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2021-33265](https://cve.now/CVE-2021-33265.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33266](https://cve.now/CVE-2021-33266.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33267](https://cve.now/CVE-2021-33267.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33268](https://cve.now/CVE-2021-33268.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33269](https://cve.now/CVE-2021-33269.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33270](https://cve.now/CVE-2021-33270.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33271](https://cve.now/CVE-2021-33271.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-33274](https://cve.now/CVE-2021-33274.md): D-Link DIR-809 devices with firmware through DIR-809Ax\_FW1.12WWB03\_20190410 were discovered to contain a stack buffer overflow vulnerability (no CVSS)
- [CVE-2021-43793](https://cve.now/CVE-2021-43793.md): Bypass of Poll voting limits in Discourse (CVSS 4.3, discourse)
- [CVE-2021-43794](https://cve.now/CVE-2021-43794.md): Anonymous user cache poisoning via development-mode header in Discourse (CVSS 5.3, discourse)
- [CVE-2021-43792](https://cve.now/CVE-2021-43792.md): Notifications leak in Discourse (CVSS 4.3, discourse)
- [CVE-2021-43137](https://cve.now/CVE-2021-43137.md): Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in m (no CVSS)
- [CVE-2021-43451](https://cve.now/CVE-2021-43451.md): SQL Injection vulnerability exists in PHPGURUKUL Employee Record Management System 1.2 via the Email POST parameter in /forgetpassword.php. (no CVSS)
- [CVE-2021-29863](https://cve.now/CVE-2021-29863.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2021-29849](https://cve.now/CVE-2021-29849.md): IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. (CVSS 5.4, IBM QRadar SIEM)
- [CVE-2021-29779](https://cve.now/CVE-2021-29779.md): IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exchange without entity (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2021-20400](https://cve.now/CVE-2021-20400.md): IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info (CVSS 5.9, IBM QRadar SIEM)
- [CVE-2021-42776](https://cve.now/CVE-2021-42776.md): CloverDX Server before 5.11.2 and and 5.12.x before 5.12.1 allows XXE during configuration import. (no CVSS)
- [CVE-2021-43687](https://cve.now/CVE-2021-43687.md): chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a messag (no CVSS)
- [CVE-2021-26334](https://cve.now/CVE-2021-26334.md): AMD Chipset Driver Information Disclosure Vulnerability (no CVSS, AMD μProf Tool)
- [CVE-2021-20611](https://cve.now/CVE-2021-20611.md): Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, (CVSS 7.5, Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67)
- [CVE-2021-20610](https://cve.now/CVE-2021-20610.md): Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series (CVSS 7.5, Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67)
- [CVE-2021-20609](https://cve.now/CVE-2021-20609.md): Uncontrolled Resource Consumption vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120( (CVSS 7.5, Mitsubishi Electric MELSEC iQ-R Series R00CPU · Mitsubi… +67)
- [CVE-2020-10627](https://cve.now/CVE-2020-10627.md): Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Ins (CVSS 7.3, Insulet Omnipod Insulin Management System)
- [CVE-2021-44480](https://cve.now/CVE-2021-44480.md): Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers (who know the SIM phone number and password) to listen to a device's surro (no CVSS)
- [CVE-2021-43685](https://cve.now/CVE-2021-43685.md): libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/Show (no CVSS)
- [CVE-2021-44479](https://cve.now/CVE-2021-44479.md): NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Progra (CVSS 6.1)
- [CVE-2021-40154](https://cve.now/CVE-2021-40154.md): NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration request during use of U (CVSS 6.1)
- [CVE-2021-43689](https://cve.now/CVE-2021-43689.md): manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.c (no CVSS)
- [CVE-2021-25967](https://cve.now/CVE-2021-25967.md): CKAN - Stored Cross-Site Scripting (XSS) via SVG File Upload (CVSS 5.4, ckan)
- [CVE-2021-44277](https://cve.now/CVE-2021-44277.md): Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php. (no CVSS, librenms/librenms)
- [CVE-2021-44279](https://cve.now/CVE-2021-44279.md): Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php. (no CVSS, librenms/librenms)
- [CVE-2021-44280](https://cve.now/CVE-2021-44280.md): attendance management system 1.0 is affected by a SQL injection vulnerability in admin/incFunctions.php through the makeSafe function. (no CVSS)
- [CVE-2021-43690](https://cve.now/CVE-2021-43690.md): YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. (no CVSS)
- [CVE-2021-32592](https://cve.now/CVE-2021-32592.md): An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6. (CVSS 7.8, Fortinet FortiClientWindows, FortiClientEMS)
- [CVE-2021-3964](https://cve.now/CVE-2021-3964.md): Authorization Bypass Through User-Controlled Key in elgg/elgg (CVSS 4.3, elgg/elgg)
- [CVE-2021-3983](https://cve.now/CVE-2021-3983.md): Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2 (CVSS 6.3, kevinpapst/kimai2)
- [CVE-2021-3985](https://cve.now/CVE-2021-3985.md): Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2 (CVSS 8.0, kevinpapst/kimai2)
- [CVE-2021-3989](https://cve.now/CVE-2021-3989.md): Open Redirect in star7th/showdoc (CVSS 6.5, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-3990](https://cve.now/CVE-2021-3990.md): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc (CVSS 6.5, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-3992](https://cve.now/CVE-2021-3992.md): Improper Access Control in kevinpapst/kimai2 (CVSS 6.5, kevinpapst/kimai2)
- [CVE-2021-3994](https://cve.now/CVE-2021-3994.md): Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk (CVSS 8.8, django-helpdesk/django-helpdesk · django-helpdesk)
- [CVE-2021-3993](https://cve.now/CVE-2021-3993.md): Cross-Site Request Forgery (CSRF) in star7th/showdoc (CVSS 4.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-4015](https://cve.now/CVE-2021-4015.md): Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii (CVSS 4.3, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2021-4017](https://cve.now/CVE-2021-4017.md): Cross-Site Request Forgery (CSRF) in star7th/showdoc (CVSS 7.3, star7th/showdoc · showdoc/showdoc)
- [CVE-2021-4018](https://cve.now/CVE-2021-4018.md): Cross-site Scripting (XSS) - Stored in snipe/snipe-it (CVSS 6.3, snipe/snipe-it)
- [CVE-2021-34599](https://cve.now/CVE-2021-34599.md): Improper Certificate Validation in CODESYS Git (CVSS 7.4, CODESYS Git)
- [CVE-2021-20864](https://cve.now/CVE-2021-20864.md): Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC- (no CVSS, ELECOM CO. ELECOM routers)
- [CVE-2021-20863](https://cve.now/CVE-2021-20863.md): OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-116 (no CVSS, ELECOM CO. ELECOM routers)
- [CVE-2021-20862](https://cve.now/CVE-2021-20862.md): Improper access control vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC- (no CVSS, ELECOM CO. ELECOM routers)
- [CVE-2021-20861](https://cve.now/CVE-2021-20861.md): Improper access control vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20860](https://cve.now/CVE-2021-20860.md): Cross-site request forgery (CSRF) vulnerability in ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 a (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20859](https://cve.now/CVE-2021-20859.md): ELECOM LAN routers (WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, W (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20858](https://cve.now/CVE-2021-20858.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to in (no CVSS, ELECOM CO. ELECOM LAN router)
- [CVE-2021-20857](https://cve.now/CVE-2021-20857.md): Cross-site scripting vulnerability in ELECOM LAN router WRC-2533GHBK-I firmware v1.20 and prior allows a remote authenticated attacker to in (no CVSS, ELECOM CO. ELECOM LAN router)
- [CVE-2021-20856](https://cve.now/CVE-2021-20856.md): Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) a (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20855](https://cve.now/CVE-2021-20855.md): Cross-site scripting vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) a (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20854](https://cve.now/CVE-2021-20854.md): ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20853](https://cve.now/CVE-2021-20853.md): ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows a network-adjacent attacker with (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20852](https://cve.now/CVE-2021-20852.md): Buffer overflow vulnerability in ELECOM LAN routers (WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior) allows (no CVSS, ELECOM CO. ELECOM LAN routers)
- [CVE-2021-20851](https://cve.now/CVE-2021-20851.md): Cross-site request forgery (CSRF) vulnerability in Browser and Operating System Finder versions prior to 1.2 allows a remote unauthenticated (no CVSS, Aftab Muni Browser and Operating System Finder)
- [CVE-2021-20847](https://cve.now/CVE-2021-20847.md): Cross-site scripting vulnerability in Wi-Fi STATION SH-52A (38JP\_1\_11G, 38JP\_1\_11J, 38JP\_1\_11K, 38JP\_1\_11L, 38JP\_1\_26F, 38JP\_1\_26G, 38JP\_1\_2 (no CVSS, NTT DOCOMO Wi-Fi STATION SH-52A)
- [CVE-2021-43360](https://cve.now/CVE-2021-43360.md): Sunnet eHRD - Insecure Deserialization (CVSS 8.8, Sunnet eHRD)
- [CVE-2021-43359](https://cve.now/CVE-2021-43359.md): Sunnet eHRD - Broken Access Control (CVSS 8.8, Sunnet eHRD)
- [CVE-2021-43358](https://cve.now/CVE-2021-43358.md): Sunnet eHRD - Path Traversal (CVSS 7.5, Sunnet eHRD)
- [CVE-2021-40809](https://cve.now/CVE-2021-40809.md): An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. (no CVSS)
- [CVE-2021-38575](https://cve.now/CVE-2021-38575.md): NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. (no CVSS, TianoCore EDK II)
- [CVE-2021-3984](https://cve.now/CVE-2021-3984.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2021-4019](https://cve.now/CVE-2021-4019.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.1, vim/vim)
- [CVE-2021-41039](https://cve.now/CVE-2021-41039.md): In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause exc (no CVSS, The Eclipse Foundation Eclipse Mosquitto)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.