CVEs published December 2, 2021
38 CVEs were published on December 2, 2021: 1 critical, 3 high.
- Published
- 38
- Critical
- 1
- High
- 3
- Medium
- 7
- Low
- 1
- Unrated
- 26
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Crafter Software Crafter CMS
- 6
- ClickBank Affiliate Ads
- 2
- Hitachi Energy FOX61x · Hitachi Energy XCM20
- 2
- bookstackapp/bookstack · ssddanbrown/bookstack
- 1
- CA Network Flow Analysis
- 1
- Crafter Software Crafter CMS · org.craftercms:crafter-search
- 1
- line armeria · com.linecorp.armeria:armeria
- 1
- mailman
- 1
- zulip
- 1
Critical 1
High 3
- CVE-2021-40334SSH activation problem in the proprietary management protocol (port TCP 5558)Hitachi Energy FOX61x · Hitachi Energy XCM20
- CVE-2021-43795Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armerialine armeria · com.linecorp.armeria:armeria
- CVE-2021-23264Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter SearchCrafter Software Crafter CMS · org.craftercms:crafter-search
Medium, low and unrated 34
- CVE-2021-25785Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column.
- CVE-2021-25784Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.
- CVE-2021-25783Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.
- CVE-2020-29177Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.
- CVE-2020-29176An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file.
- CVE-2021-28237LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.
- CVE-2021-28236LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.
- CVE-2021-43327An issue was discovered on Renesas RX65 and RX65N devices.
- CVE-2021-44050CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient inpuCA Network Flow Analysis
- CVE-2015-20106ClickBank Affiliate Ads <= 1.20 - Admin+ Stored Cross-Site ScriptingClickBank Affiliate Ads
- CVE-2015-20105ClickBank Affiliate Ads <= 1.20 - CSRF to Stored Cross-Site ScriptingClickBank Affiliate Ads
- CVE-2021-44518An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android.
- CVE-2021-3944Cross-Site Request Forgery (CSRF) in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-23263Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter EngineCrafter Software Crafter CMS
- CVE-2021-23262Snakeyaml deserialization vulnerability bypassCrafter Software Crafter CMS
- CVE-2021-23261Overriding the system configuration file causes a denial of serviceCrafter Software Crafter CMS
- CVE-2021-23260Stored XSS Vulnerability in File Name of the File Upload functionCrafter Software Crafter CMS
- CVE-2021-23259Groovy Sandbox BypassCrafter Software Crafter CMS
- CVE-2021-23258Spring SPEL Expression Language InjectionCrafter Software Crafter CMS
- CVE-2021-43679ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.
- CVE-2021-43682thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php.
- CVE-2021-43681SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php.
- CVE-2021-43683pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php.
- CVE-2021-43686nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php.
- CVE-2021-26777Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare versi
- CVE-2020-27414Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters.
- CVE-2021-44227In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admmailman
- CVE-2021-43791Ineffective expiration validation for invitation links in Zulipzulip
- CVE-2020-36129AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.
- CVE-2020-36130AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.
- CVE-2020-36131AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.
- CVE-2020-36133AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.
- CVE-2020-36134AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.
- CVE-2020-36135AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.