# CVEs published 2021-12-06

55 CVEs were published on December 6, 2021: 8 critical, 5 high. Days are UTC.

- [CVE-2021-44686](https://cve.now/CVE-2021-44686.md): calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html\_preprocess\_ru (no CVSS)
- [CVE-2021-44685](https://cve.now/CVE-2021-44685.md): Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. (no CVSS, git-it-electron)
- [CVE-2021-44684](https://cve.now/CVE-2021-44684.md): naholyr github-todos 3.1.0 is vulnerable to command injection. (no CVSS, github-todos)
- [CVE-2021-44677](https://cve.now/CVE-2021-44677.md): An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-44678](https://cve.now/CVE-2021-44678.md): An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-44679](https://cve.now/CVE-2021-44679.md): An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-44680](https://cve.now/CVE-2021-44680.md): An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-44681](https://cve.now/CVE-2021-44681.md): An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-44682](https://cve.now/CVE-2021-44682.md): An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. (CVSS 9.8)
- [CVE-2021-31632](https://cve.now/CVE-2021-31632.md): b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the User login section. (no CVSS)
- [CVE-2021-31631](https://cve.now/CVE-2021-31631.md): b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. (no CVSS)
- [CVE-2021-40313](https://cve.now/CVE-2021-40313.md): Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg\_token in /admin/batch\_manager\_global.php. (no CVSS)
- [CVE-2021-36564](https://cve.now/CVE-2021-36564.md): ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\\league\\flysystem-cached-adapter\\src\\Stora (no CVSS, topthink/framework)
- [CVE-2021-36567](https://cve.now/CVE-2021-36567.md): ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\\Flysystem\\Cached\\Storage\\AbstractCache. (no CVSS, topthink/framework)
- [CVE-2021-4075](https://cve.now/CVE-2021-4075.md): Server-Side Request Forgery (SSRF) in snipe/snipe-it (CVSS 2.7, snipe/snipe-it)
- [CVE-2021-40091](https://cve.now/CVE-2021-40091.md): An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654. (no CVSS)
- [CVE-2021-43800](https://cve.now/CVE-2021-43800.md): Asset directory traversal with some storage modules on Windows (CVSS 7.5, Requarks wiki)
- [CVE-2021-43781](https://cve.now/CVE-2021-43781.md): Permissions not properly checked in Invenio-Drafts-Resources (CVSS 6.4, inveniosoftware invenio-drafts-resources · invenio-rdm-r… +2)
- [CVE-2021-43931](https://cve.now/CVE-2021-43931.md): Distributed Data Systems WebHM (CVSS 9.8, Distributed Data Systems WebHMI)
- [CVE-2021-43936](https://cve.now/CVE-2021-43936.md): Distributed Data Systems WebHM (CVSS 10.0, Distributed Data Systems WebHMI)
- [CVE-2021-22170](https://cve.now/CVE-2021-22170.md): Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted content (CVSS 6.2, GitLab)
- [CVE-2021-39890](https://cve.now/CVE-2021-39890.md): It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 and above. (CVSS 3.1, GitLab)
- [CVE-2021-36198](https://cve.now/CVE-2021-36198.md): Entrapass (CVSS 8.3, Johnson Controls Entrapass)
- [CVE-2021-35242](https://cve.now/CVE-2021-35242.md): A valid CSRF token is present in response to an invalid request (CVSS 8.3, SolarWinds Serv-U Server)
- [CVE-2021-35245](https://cve.now/CVE-2021-35245.md): Broken Access Control Vulnerability for SolarWinds Serv-U (CVSS 8.4, SolarWinds Serv-U FTP)
- [CVE-2021-25041](https://cve.now/CVE-2021-25041.md): Photo Gallery by 10Web \< 1.5.68 - Reflected Cross-Site Scripting (XSS) (no CVSS, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2021-24943](https://cve.now/CVE-2021-24943.md): Registrations for the Events Calendar \< 2.7.6 - Unauthenticated SQL Injection (no CVSS, Registrations for the Events Calendar – Event Registration…)
- [CVE-2021-24939](https://cve.now/CVE-2021-24939.md): LoginWP \< 3.0.0.5 - Reflected Cross-Site Scripting (no CVSS, LoginWP)
- [CVE-2021-24938](https://cve.now/CVE-2021-24938.md): WooCommerce Currency Switcher \< 1.3.7.1 - Reflected Cross-Site Scripting (no CVSS, WOOCS – Currency Switcher for WooCommerce. Professional and…)
- [CVE-2021-24935](https://cve.now/CVE-2021-24935.md): WP Google Fonts \< 3.1.5 - Reflected Cross-Site Scripting (no CVSS, WP Google Fonts)
- [CVE-2021-24931](https://cve.now/CVE-2021-24931.md): Secure Copy Content Protection and Content Locking \< 2.8.2 - Unauthenticated SQL Injection (no CVSS, Secure Copy Content Protection and Content Locking)
- [CVE-2021-24930](https://cve.now/CVE-2021-24930.md): Bookly \< 20.3.1 - Staff Member Stored Cross-Site Scripting (no CVSS, WordPress Online Booking and Scheduling Plugin – Bookly)
- [CVE-2021-24924](https://cve.now/CVE-2021-24924.md): Email Log \< 2.4.8 - Reflected Cross-Site Scripting (no CVSS, Email Log)
- [CVE-2021-24917](https://cve.now/CVE-2021-24917.md): WPS Hide Login \< 1.9.1 - Protection Bypass with Referer-Header (no CVSS, WPS Hide Login)
- [CVE-2021-24914](https://cve.now/CVE-2021-24914.md): Tawk.to Live Chat \< 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal (no CVSS, Tawk.To Live Chat)
- [CVE-2021-24866](https://cve.now/CVE-2021-24866.md): WP Data Access \< 5.0.0 - Admin+ SQL Injection (no CVSS, WP Data Access)
- [CVE-2021-24759](https://cve.now/CVE-2021-24759.md): PDF.js Viewer \< 2.0.2 - Contributor+ Stored Cross-Site Scripting (no CVSS, PDF.js Viewer)
- [CVE-2021-24718](https://cve.now/CVE-2021-24718.md): ARForms Form Builder \< 1.5 - Admin+ Stored Cross Site Scripting (no CVSS, Contact Form, Survey & Popup Form Plugin for WordPress – A…)
- [CVE-2021-24714](https://cve.now/CVE-2021-24714.md): WP All Import \< 3.6.3 - Admin+ Stored Cross-Site Scripting (no CVSS, Import any XML or CSV File to WordPress)
- [CVE-2021-43471](https://cve.now/CVE-2021-43471.md): In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. (no CVSS)
- [CVE-2021-43469](https://cve.now/CVE-2021-43469.md): VINGA WR-N300U 77.102.1.4853 is affected by a command execution vulnerability in the goahead component. (no CVSS)
- [CVE-2021-4069](https://cve.now/CVE-2021-4069.md): Use After Free in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2021-43033](https://cve.now/CVE-2021-43033.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43034](https://cve.now/CVE-2021-43034.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43035](https://cve.now/CVE-2021-43035.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43036](https://cve.now/CVE-2021-43036.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43037](https://cve.now/CVE-2021-43037.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43038](https://cve.now/CVE-2021-43038.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43039](https://cve.now/CVE-2021-43039.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43040](https://cve.now/CVE-2021-43040.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43041](https://cve.now/CVE-2021-43041.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43042](https://cve.now/CVE-2021-43042.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43043](https://cve.now/CVE-2021-43043.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43044](https://cve.now/CVE-2021-43044.md): An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. (no CVSS)
- [CVE-2021-43784](https://cve.now/CVE-2021-43784.md): Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVSS 6.0, opencontainers runc · github.com/opencontainers/runc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.