# CVEs published 2021-12-02 38 CVEs were published on December 2, 2021: 1 critical, 3 high. Days are UTC. - [CVE-2021-25785](https://cve.now/CVE-2021-25785.md): Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management column. (no CVSS) - [CVE-2021-25784](https://cve.now/CVE-2021-25784.md): Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article. (no CVSS) - [CVE-2021-25783](https://cve.now/CVE-2021-25783.md): Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search. (no CVSS) - [CVE-2020-29177](https://cve.now/CVE-2020-29177.md): Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \\app\_del.php. (no CVSS) - [CVE-2020-29176](https://cve.now/CVE-2020-29176.md): An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted JPG file. (no CVSS) - [CVE-2021-28237](https://cve.now/CVE-2021-28237.md): LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode\_preR13. (no CVSS) - [CVE-2021-28236](https://cve.now/CVE-2021-28236.md): LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out\_dxfb.c. (no CVSS) - [CVE-2021-43327](https://cve.now/CVE-2021-43327.md): An issue was discovered on Renesas RX65 and RX65N devices. (no CVSS) - [CVE-2021-40333](https://cve.now/CVE-2021-40333.md): Weak default credential associated with TCP port 26 (CVSS 9.0, Hitachi Energy FOX61x · Hitachi Energy XCM20) - [CVE-2021-40334](https://cve.now/CVE-2021-40334.md): SSH activation problem in the proprietary management protocol (port TCP 5558) (CVSS 8.6, Hitachi Energy FOX61x · Hitachi Energy XCM20) - [CVE-2021-44050](https://cve.now/CVE-2021-44050.md): CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due to insufficient inpu (no CVSS, CA Network Flow Analysis) - [CVE-2021-43795](https://cve.now/CVE-2021-43795.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in com.linecorp.armeria:armeria (CVSS 7.5, line armeria · com.linecorp.armeria:armeria) - [CVE-2015-20106](https://cve.now/CVE-2015-20106.md): ClickBank Affiliate Ads \<= 1.20 - Admin+ Stored Cross-Site Scripting (no CVSS, ClickBank Affiliate Ads) - [CVE-2015-20105](https://cve.now/CVE-2015-20105.md): ClickBank Affiliate Ads \<= 1.20 - CSRF to Stored Cross-Site Scripting (no CVSS, ClickBank Affiliate Ads) - [CVE-2021-44518](https://cve.now/CVE-2021-44518.md): An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. (no CVSS) - [CVE-2021-3944](https://cve.now/CVE-2021-3944.md): Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack (CVSS 3.1, bookstackapp/bookstack · ssddanbrown/bookstack) - [CVE-2021-23264](https://cve.now/CVE-2021-23264.md): Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter Search (CVSS 8.1, Crafter Software Crafter CMS · org.craftercms:crafter-search) - [CVE-2021-23263](https://cve.now/CVE-2021-23263.md): Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine (CVSS 5.9, Crafter Software Crafter CMS) - [CVE-2021-23262](https://cve.now/CVE-2021-23262.md): Snakeyaml deserialization vulnerability bypass (CVSS 4.2, Crafter Software Crafter CMS) - [CVE-2021-23261](https://cve.now/CVE-2021-23261.md): Overriding the system configuration file causes a denial of service (CVSS 4.5, Crafter Software Crafter CMS) - [CVE-2021-23260](https://cve.now/CVE-2021-23260.md): Stored XSS Vulnerability in File Name of the File Upload function (CVSS 6.5, Crafter Software Crafter CMS) - [CVE-2021-23259](https://cve.now/CVE-2021-23259.md): Groovy Sandbox Bypass (CVSS 4.2, Crafter Software Crafter CMS) - [CVE-2021-23258](https://cve.now/CVE-2021-23258.md): Spring SPEL Expression Language Injection (CVSS 4.2, Crafter Software Crafter CMS) - [CVE-2021-43679](https://cve.now/CVE-2021-43679.md): ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\\ecshop\\upload\\api\\client\\api.php. (no CVSS) - [CVE-2021-43682](https://cve.now/CVE-2021-43682.md): thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. (no CVSS) - [CVE-2021-43681](https://cve.now/CVE-2021-43681.md): SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. (no CVSS) - [CVE-2021-43683](https://cve.now/CVE-2021-43683.md): pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. (no CVSS) - [CVE-2021-43686](https://cve.now/CVE-2021-43686.md): nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. (no CVSS) - [CVE-2021-26777](https://cve.now/CVE-2021-26777.md): Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concentrator Firwmare versi (no CVSS) - [CVE-2020-27414](https://cve.now/CVE-2020-27414.md): Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. (no CVSS) - [CVE-2021-44227](https://cve.now/CVE-2021-44227.md): In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new adm (no CVSS, mailman) - [CVE-2021-43791](https://cve.now/CVE-2021-43791.md): Ineffective expiration validation for invitation links in Zulip (CVSS 6.5, zulip) - [CVE-2020-36129](https://cve.now/CVE-2020-36129.md): AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom\_image.c. (no CVSS) - [CVE-2020-36130](https://cve.now/CVE-2020-36130.md): AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1\_dx\_iface.c. (no CVSS) - [CVE-2020-36131](https://cve.now/CVE-2020-36131.md): AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate\_hist.c. (no CVSS) - [CVE-2020-36133](https://cve.now/CVE-2020-36133.md): AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition\_search.h. (no CVSS) - [CVE-2020-36134](https://cve.now/CVE-2020-36134.md): AOM v2.0.1 was discovered to contain a segmentation violation via the component aom\_dsp/x86/obmc\_sad\_avx2.c. (no CVSS) - [CVE-2020-36135](https://cve.now/CVE-2020-36135.md): AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate\_hist.c. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-12-02 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.