CVEs published December 3, 2021
31 CVEs were published on December 3, 2021: 0 critical, 1 high. 1 is now in CISA KEV.
- Published
- 31
- Critical
- 0
- High
- 1
- Medium
- 10
- Low
- 1
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 7
Most affected products
- IBM Cognos Analytics
- 7
- Trend Micro Worry-Free Business Security
- 3
- AjaxPro.2 · AjaxNetProfessional
- 1
- elgg/elgg
- 1
- github.com/hashicorp/nomad
- 1
- Kentico Xperience XMS
- 1
- librenms/librenms
- 1
- matyhtf/framework
- 1
- plupload
- 1
- star7th/showdoc · showdoc/showdoc
- 1
High 1
Medium, low and unrated 30
- CVE-2021-43415HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with jobgithub.com/hashicorp/nomad
- CVE-2021-35415A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the cou
- CVE-2021-35414Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php.
- CVE-2021-35413A remote code execution (RCE) vulnerability in course_intro_pdf_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute
- CVE-2021-23562Arbitrary File Uploadplupload
- CVE-2021-35346tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short_term_ref_pic_set(int) in hevc.cpp
- CVE-2021-35344tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h.
- CVE-2021-44349SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\Manage\Controller\DownloadController.class.php.
- CVE-2021-44348SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\Manage\Controller\AdvertController.class.php.
- CVE-2021-44347SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\Manage\Controller\GuestbookController.class.php.
- CVE-2021-44352A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18_multi device via the list parameter in a post request in g
- CVE-2021-38909IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2021-29867IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to.IBM Cognos Analytics
- CVE-2021-29756IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attackerIBM Cognos Analytics
- CVE-2021-29719IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect conteIBM Cognos Analytics
- CVE-2021-29716IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed tIBM Cognos Analytics
- CVE-2021-20493IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting.IBM Cognos Analytics
- CVE-2021-20470IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attackIBM Cognos Analytics
- CVE-2021-3980Exposure of Private Personal Information to an Unauthorized Actor in elgg/elggelgg/elgg
- CVE-2021-43991Persistent XSS via Avatar Upload in Kentico Xperience CMSKentico Xperience XMS
- CVE-2021-43676matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.matyhtf/framework
- CVE-2021-44278Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.librenms/librenms
- CVE-2021-43674ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php.
- CVE-2021-43673dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php.
- CVE-2021-44022A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading Trend Micro Apex One
- CVE-2021-44020An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileTrend Micro Worry-Free Business Security
- CVE-2021-44021An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileTrend Micro Worry-Free Business Security
- CVE-2021-44019An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privileTrend Micro Worry-Free Business Security
- CVE-2021-43772Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without anyTrend Micro Security
- CVE-2021-4000Open Redirect in star7th/showdocstar7th/showdoc · showdoc/showdoc