# CVEs published 2021-12-03 31 CVEs were published on December 3, 2021: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2021-43415](https://cve.now/CVE-2021-43415.md): HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job (no CVSS, github.com/hashicorp/nomad) - [CVE-2021-35415](https://cve.now/CVE-2021-35415.md): A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the cou (no CVSS) - [CVE-2021-35414](https://cve.now/CVE-2021-35414.md): Chamilo LMS v1.11.x was discovered to contain a SQL injection via the doc parameter in main/plagiarism/compilatio/upload.php. (no CVSS) - [CVE-2021-35413](https://cve.now/CVE-2021-35413.md): A remote code execution (RCE) vulnerability in course\_intro\_pdf\_import.php of Chamilo LMS v1.11.x allows authenticated attackers to execute (no CVSS) - [CVE-2021-23758](https://cve.now/CVE-2021-23758.md): Deserialization of Untrusted Data (CVSS 8.1, KEV, AjaxPro.2 · AjaxNetProfessional) - [CVE-2021-23562](https://cve.now/CVE-2021-23562.md): Arbitrary File Upload (CVSS 4.2, plupload) - [CVE-2021-35346](https://cve.now/CVE-2021-35346.md): tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function HevcSpsUnit::short\_term\_ref\_pic\_set(int) in hevc.cpp (no CVSS) - [CVE-2021-35344](https://cve.now/CVE-2021-35344.md): tsMuxer v2.6.16 was discovered to contain a heap-based buffer overflow via the function BitStreamReader::getCurVal in bitStream.h. (no CVSS) - [CVE-2021-44349](https://cve.now/CVE-2021-44349.md): SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameter in App\\Manage\\Controller\\DownloadController.class.php. (no CVSS) - [CVE-2021-44348](https://cve.now/CVE-2021-44348.md): SQL Injection vulnerability exists in TuziCMS v2.0.6 via the id parameer in App\\Manage\\Controller\\AdvertController.class.php. (no CVSS) - [CVE-2021-44347](https://cve.now/CVE-2021-44347.md): SQL Injection vulnerability exists in TuziCMS v2.0.6 in App\\Manage\\Controller\\GuestbookController.class.php. (no CVSS) - [CVE-2021-44352](https://cve.now/CVE-2021-44352.md): A Stack-based Buffer Overflow vulnerability exists in the Tenda AC15 V15.03.05.18\_multi device via the list parameter in a post request in g (no CVSS) - [CVE-2021-38909](https://cve.now/CVE-2021-38909.md): IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cognos Analytics) - [CVE-2021-29867](https://cve.now/CVE-2021-29867.md): IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should not have access to. (CVSS 5.4, IBM Cognos Analytics) - [CVE-2021-29756](https://cve.now/CVE-2021-29756.md): IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site request forgery (CSRF) in the My Inbox page which could allow an attacker (CVSS 4.3, IBM Cognos Analytics) - [CVE-2021-29719](https://cve.now/CVE-2021-29719.md): IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifying an incorrect conte (CVSS 5.3, IBM Cognos Analytics) - [CVE-2021-29716](https://cve.now/CVE-2021-29716.md): IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user should only be allowed t (CVSS 2.7, IBM Cognos Analytics) - [CVE-2021-20493](https://cve.now/CVE-2021-20493.md): IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. (CVSS 6.1, IBM Cognos Analytics) - [CVE-2021-20470](https://cve.now/CVE-2021-20470.md): IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes it easier for attack (CVSS 5.9, IBM Cognos Analytics) - [CVE-2021-3980](https://cve.now/CVE-2021-3980.md): Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg (CVSS 5.3, elgg/elgg) - [CVE-2021-43991](https://cve.now/CVE-2021-43991.md): Persistent XSS via Avatar Upload in Kentico Xperience CMS (CVSS 6.8, Kentico Xperience XMS) - [CVE-2021-43676](https://cve.now/CVE-2021-43676.md): matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. (no CVSS, matyhtf/framework) - [CVE-2021-44278](https://cve.now/CVE-2021-44278.md): Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php. (no CVSS, librenms/librenms) - [CVE-2021-43674](https://cve.now/CVE-2021-43674.md): ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. (no CVSS) - [CVE-2021-43673](https://cve.now/CVE-2021-43673.md): dzzoffice 2.02.1\_SC\_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. (no CVSS) - [CVE-2021-44022](https://cve.now/CVE-2021-44022.md): A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected installations, leading (no CVSS, Trend Micro Apex One) - [CVE-2021-44020](https://cve.now/CVE-2021-44020.md): An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile (no CVSS, Trend Micro Worry-Free Business Security) - [CVE-2021-44021](https://cve.now/CVE-2021-44021.md): An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile (no CVSS, Trend Micro Worry-Free Business Security) - [CVE-2021-44019](https://cve.now/CVE-2021-44019.md): An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker to escalate privile (no CVSS, Trend Micro Worry-Free Business Security) - [CVE-2021-43772](https://cve.now/CVE-2021-43772.md): Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be modified without any (no CVSS, Trend Micro Security) - [CVE-2021-4000](https://cve.now/CVE-2021-4000.md): Open Redirect in star7th/showdoc (CVSS 6.5, star7th/showdoc · showdoc/showdoc) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-12-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.