CVEs published December 7, 2021
135 CVEs were published on December 7, 2021: 0 critical, 5 high. 1 is now in CISA KEV.
- Published
- 135
- Critical
- 0
- High
- 5
- Medium
- 5
- Low
- 3
- Unrated
- 122
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Huawei HarmonyOS
- 42
- Ivanti Avalanche
- 9
- Huawei EMUI · Huawei Magic UI
- 7
- Esri ArcGIS Server
- 4
- Adobe Bridge
- 3
- GOautodial API
- 2
- admidio
- 1
- Citrix ADC, Citrix Gateway
- 1
- Citrix ADC, Citrix Gateway, Citrix SDWAN
- 1
- devise_masquerade
- 1
High 5
- CVE-2021-43810Cross-site Scripting (XSS) when redirect an urladmidio
- CVE-2021-43798Grafana path traversalgrafana · github.com/grafana/grafana
- CVE-2021-43805ReDos vulnerability on guest checkout email validationsolidusio solidus · solidus_core
- CVE-2021-43789Blind SQLi using Search filters in PrestaShopPrestaShop · prestashop/prestashop
- CVE-2021-29114SQL injection vulnerability in ArcGIS ServerEsri ArcGIS Server
Medium, low and unrated 130
- CVE-2021-44420In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream adjango
- CVE-2021-43808Blade `@parent` Exploitation Leading To Possible XSS in Laravellaravel framework · laravel/framework +1
- CVE-2021-40578Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free S
- CVE-2021-42567Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.org.apereo.cas:cas-server-core-web
- CVE-2021-42717ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.
- CVE-2021-43963An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2.
- CVE-2021-44148GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an S
- CVE-2021-44149An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0.
- CVE-2021-38759Raspberry Pi OS through 5.10 has the raspberry default password for the pi account.
- CVE-2021-36760In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the
- CVE-2021-36133The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass becau
- CVE-2021-34544An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013.
- CVE-2021-34543The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain
- CVE-2021-28680The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown.devise_masquerade
- CVE-2020-27356The debug-meta-data plugin 1.1.2 for WordPress allows XSS.
- CVE-2021-42688An Integer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200.
- CVE-2021-42687A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200.
- CVE-2021-42686An Integer Overflow exists in Accops HyWorks Windows Client prior to v 3.2.8.200.
- CVE-2021-42685An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .
- CVE-2021-42683A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200.
- CVE-2021-42682An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .The IOCTL Handler 0x22001B allows local attackers
- CVE-2021-42681A Buffer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105.
- CVE-2021-43638Amazon Amazon WorkSpaces agent is affected by Integer Overflow.
- CVE-2021-43637Amazon WorkSpaces agent is affected by Buffer Overflow.
- CVE-2021-43006AmZetta Amzetta zPortal DVM Tools is affected by Integer Overflow.
- CVE-2021-43003Amzetta zPortal Windows zClient is affected by Integer Overflow.
- CVE-2021-43002Amzetta zPortal DVM Tools is affected by Buffer Overflow.
- CVE-2021-43000Amzetta zPortal Windows zClient is affected by Buffer Overflow.
- CVE-2021-42996Donglify is affected by Integer Overflow.
- CVE-2021-42994Donglify is affected by Buffer Overflow.
- CVE-2021-42993FlexiHub For Windows is affected by Integer Overflow.
- CVE-2021-42990FlexiHub For Windows is affected by Buffer Overflow.
- CVE-2021-42988Eltima USB Network Gate is affected by Buffer Overflow.
- CVE-2021-42987Eltima USB Network Gate is affected by Integer Overflow.
- CVE-2021-42986NoMachine Enterprise Client is affected by Integer Overflow.
- CVE-2021-42983NoMachine Enterprise Client is affected by Buffer Overflow.
- CVE-2021-42980NoMachine Cloud Server is affected by Buffer Overflow.
- CVE-2021-42979NoMachine Cloud Server is affected by Integer Overflow.
- CVE-2021-42977NoMachine Enterprise Desktop is affected by Integer Overflow.
- CVE-2021-42976NoMachine Enterprise Desktop is affected by Buffer Overflow.
- CVE-2021-42973NoMachine Server is affected by Integer Overflow.
- CVE-2021-42972NoMachine Server is affected by Buffer Overflow.
- CVE-2021-40288A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before V1_211014, allows a remote unauthenticated
- CVE-2021-24041A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could haFacebook WhatsApp Business for Android · Facebook WhatsApp…
- CVE-2021-37940An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github EnterpriElastic Enterprisesearch
- CVE-2021-40859Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management app
- CVE-2021-41716Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixati
- CVE-2020-12140A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code
- CVE-2021-43176The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extenGOautodial API
- CVE-2021-43175The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action thGOautodial API
- CVE-2021-37100There is a Improper Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to account authHuawei HarmonyOS
- CVE-2021-37099There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete any file.Huawei HarmonyOS
- CVE-2021-37096There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to user privaHuawei EMUI · Huawei HarmonyOS
- CVE-2021-37095There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remotHuawei HarmonyOS
- CVE-2021-37094There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system denHuawei HarmonyOS
- CVE-2021-37091There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lHuawei HarmonyOS
- CVE-2021-37090There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash.Huawei HarmonyOS
- CVE-2021-37089There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel restart.Huawei HarmonyOS
- CVE-2021-37088There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write aHuawei HarmonyOS
- CVE-2021-37087There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can create Huawei HarmonyOS
- CVE-2021-37086There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead toHuawei HarmonyOS
- CVE-2021-37085There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service.Huawei HarmonyOS
- CVE-2021-37084There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious Huawei HarmonyOS
- CVE-2021-37083There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Denial of SHuawei HarmonyOS
- CVE-2021-37082There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to motionhub crash.Huawei HarmonyOS
- CVE-2021-37081There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to nearby craHuawei HarmonyOS
- CVE-2021-37080There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affeHuawei HarmonyOS
- CVE-2021-37079There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arbHuawei HarmonyOS
- CVE-2021-37078There is a Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote Denial of Huawei HarmonyOS
- CVE-2021-37077There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel crasHuawei HarmonyOS
- CVE-2021-37076There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affeHuawei HarmonyOS
- CVE-2021-37073There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the detection result Huawei HarmonyOS
- CVE-2021-37072There is a Incorrect Calculation of Buffer Size vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead toHuawei HarmonyOS
- CVE-2021-37071There is a Business Logic Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to persistent dosHuawei HarmonyOS
- CVE-2021-37070There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash.Huawei HarmonyOS
- CVE-2021-37068There is a Resource Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial ofHuawei HarmonyOS
- CVE-2021-37067There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vulHuawei HarmonyOS
- CVE-2021-37066There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash.Huawei HarmonyOS
- CVE-2021-37065There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to ConfiHuawei HarmonyOS
- CVE-2021-37064There is a Improper Limitation of a Pathname to a Restricted Directory vulnerability in Huawei Smartphone.Successful exploitation of this vuHuawei HarmonyOS
- CVE-2021-37063There is a Cryptographic Issues vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to read and deleteHuawei HarmonyOS
- CVE-2021-37062There is a Improper Validation of Array Index vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to mHuawei HarmonyOS
- CVE-2021-37061There is a Uncontrolled Resource Consumption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to ScHuawei HarmonyOS
- CVE-2021-37060There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to SAMGR HeapHuawei HarmonyOS
- CVE-2021-37059There is a Weaknesses Introduced During DesignHuawei HarmonyOS
- CVE-2021-37058There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lHuawei HarmonyOS
- CVE-2021-37057There is a Improper Validation of Array Index vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to rHuawei HarmonyOS
- CVE-2021-37048There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitHuawei HarmonyOS
- CVE-2021-37043There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to maliciouHuawei HarmonyOS
- CVE-2021-37021There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bHuawei HarmonyOS
- CVE-2021-37020There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bHuawei HarmonyOS
- CVE-2021-37014There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device cHuawei HarmonyOS
- CVE-2021-37011There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bHuawei HarmonyOS
- CVE-2020-19611Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via th
- CVE-2021-37056There is an Improper permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts Huawei EMUI · Huawei Magic UI
- CVE-2021-37055There is a Logic bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to obtain certaiHuawei EMUI · Huawei Magic UI
- CVE-2021-37047There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause some services to rHuawei EMUI · Huawei Magic UI
- CVE-2021-37046There is a Memory leak vulnerability with the codec detection module in Huawei Smartphone.Successful exploitation of this vulnerability may Huawei EMUI · Huawei Magic UI
- CVE-2021-37042There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds rHuawei EMUI · Huawei Magic UI
- CVE-2021-37041There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds rHuawei EMUI · Huawei Magic UI
- CVE-2021-37038There is an Improper access control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confHuawei EMUI · Huawei Magic UI
- CVE-2020-27413An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password wh
- CVE-2021-44185Adobe Bridge RGB File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-44186Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-44187Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-42133An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service tIvanti Avalanche
- CVE-2021-42132A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform Ivanti Avalanche
- CVE-2021-42131A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform priviIvanti Avalanche
- CVE-2021-42130A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail SerIvanti Avalanche
- CVE-2021-42129A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform Ivanti Avalanche
- CVE-2021-42128An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via EIvanti Avalanche
- CVE-2021-42127A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execuIvanti Avalanche
- CVE-2021-42126An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail ServiIvanti Avalanche
- CVE-2021-42125An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to Ivanti Avalance
- CVE-2021-42124An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to pIvanti Avalanche
- CVE-2021-22956An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that could allow an attackerCitrix ADC, Citrix Gateway, Citrix SDWAN
- CVE-2021-22955A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when configured as a VPN (GatCitrix ADC, Citrix Gateway
- CVE-2021-44527A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the netUniFi Switches
- CVE-2021-40096A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject a
- CVE-2021-40095An issue was discovered in SquaredUp for SCOM 5.2.1.6654.
- CVE-2021-40094A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654.
- CVE-2021-40093A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject a
- CVE-2021-40092A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web sc
- CVE-2021-29116BUG-000142180 Hosted feature services vulnerable to stored XSSEsri ArcGIS Server
- CVE-2021-29115An information disclosure vulnerabilityEsri ArcGIS Server
- CVE-2021-29113Remote file inclusion vulnerability in ArcGIS Server help documentationEsri ArcGIS Server
- CVE-2021-4049Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-44513Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling
- CVE-2021-44512World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity
- CVE-2021-28703grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of meXen Project Xen