CVEs published December 6, 2021
55 CVEs were published on December 6, 2021: 8 critical, 5 high.
- Published
- 55
- Critical
- 8
- High
- 5
- Medium
- 3
- Low
- 2
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Distributed Data Systems WebHMI
- 2
- GitLab
- 2
- topthink/framework
- 2
- Contact Form, Survey & Popup Form Plugin for WordPress – A…
- 1
- Email Log
- 1
- git-it-electron
- 1
- github-todos
- 1
- Import any XML or CSV File to WordPress
- 1
- inveniosoftware invenio-drafts-resources · invenio-rdm-r… +2
- 1
- Johnson Controls Entrapass
- 1
Critical 8
- CVE-2021-44677An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-44678An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-44679An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-44680An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-44681An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-44682An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2.
- CVE-2021-43931Distributed Data Systems WebHMDistributed Data Systems WebHMI
- CVE-2021-43936Distributed Data Systems WebHMDistributed Data Systems WebHMI
High 5
- CVE-2021-43800Asset directory traversal with some storage modules on WindowsRequarks wiki
- CVE-2021-36198EntrapassJohnson Controls Entrapass
- CVE-2021-35242A valid CSRF token is present in response to an invalid requestSolarWinds Serv-U Server
- CVE-2021-35245Broken Access Control Vulnerability for SolarWinds Serv-USolarWinds Serv-U FTP
- CVE-2021-4069Use After Free in vim/vimvim/vim
Medium, low and unrated 42
- CVE-2021-44686calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_ru
- CVE-2021-44685Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step.git-it-electron
- CVE-2021-44684naholyr github-todos 3.1.0 is vulnerable to command injection.github-todos
- CVE-2021-31632b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section.
- CVE-2021-31631b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page.
- CVE-2021-40313Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager_global.php.
- CVE-2021-36564ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storatopthink/framework
- CVE-2021-36567ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.topthink/framework
- CVE-2021-4075Server-Side Request Forgery (SSRF) in snipe/snipe-itsnipe/snipe-it
- CVE-2021-40091An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.
- CVE-2021-43781Permissions not properly checked in Invenio-Drafts-Resourcesinveniosoftware invenio-drafts-resources · invenio-rdm-r… +2
- CVE-2021-22170Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted contentGitLab
- CVE-2021-39890It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above.GitLab
- CVE-2021-25041Photo Gallery by 10Web < 1.5.68 - Reflected Cross-Site Scripting (XSS)Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2021-24943Registrations for the Events Calendar < 2.7.6 - Unauthenticated SQL InjectionRegistrations for the Events Calendar – Event Registration…
- CVE-2021-24939LoginWP < 3.0.0.5 - Reflected Cross-Site ScriptingLoginWP
- CVE-2021-24938WooCommerce Currency Switcher < 1.3.7.1 - Reflected Cross-Site ScriptingWOOCS – Currency Switcher for WooCommerce. Professional and…
- CVE-2021-24935WP Google Fonts < 3.1.5 - Reflected Cross-Site ScriptingWP Google Fonts
- CVE-2021-24931Secure Copy Content Protection and Content Locking < 2.8.2 - Unauthenticated SQL InjectionSecure Copy Content Protection and Content Locking
- CVE-2021-24930Bookly < 20.3.1 - Staff Member Stored Cross-Site ScriptingWordPress Online Booking and Scheduling Plugin – Bookly
- CVE-2021-24924Email Log < 2.4.8 - Reflected Cross-Site ScriptingEmail Log
- CVE-2021-24917WPS Hide Login < 1.9.1 - Protection Bypass with Referer-HeaderWPS Hide Login
- CVE-2021-24914Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat RemovalTawk.To Live Chat
- CVE-2021-24866WP Data Access < 5.0.0 - Admin+ SQL InjectionWP Data Access
- CVE-2021-24759PDF.js Viewer < 2.0.2 - Contributor+ Stored Cross-Site ScriptingPDF.js Viewer
- CVE-2021-24718ARForms Form Builder < 1.5 - Admin+ Stored Cross Site ScriptingContact Form, Survey & Popup Form Plugin for WordPress – A…
- CVE-2021-24714WP All Import < 3.6.3 - Admin+ Stored Cross-Site ScriptingImport any XML or CSV File to WordPress
- CVE-2021-43471In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN.
- CVE-2021-43469VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component.
- CVE-2021-43033An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43034An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43035An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43036An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43037An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43038An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43039An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43040An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43041An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43042An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43043An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43044An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5.
- CVE-2021-43784Overflow in netlink bytemsg length field allows attacker to override netlink-based container configurationopencontainers runc · github.com/opencontainers/runc