# CVEs published 2021-12-07

135 CVEs were published on December 7, 2021: 0 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-44420](https://cve.now/CVE-2021-44420.md): In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream a (no CVSS, django)
- [CVE-2021-43808](https://cve.now/CVE-2021-43808.md): Blade \`@parent\` Exploitation Leading To Possible XSS in Laravel (CVSS 5.3, laravel framework · laravel/framework +1)
- [CVE-2021-43810](https://cve.now/CVE-2021-43810.md): Cross-site Scripting (XSS) when redirect an url (CVSS 8.8, admidio)
- [CVE-2021-40578](https://cve.now/CVE-2021-40578.md): Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free S (no CVSS)
- [CVE-2021-42567](https://cve.now/CVE-2021-42567.md): Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. (no CVSS, org.apereo.cas:cas-server-core-web)
- [CVE-2021-42717](https://cve.now/CVE-2021-42717.md): ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. (no CVSS)
- [CVE-2021-43963](https://cve.now/CVE-2021-43963.md): An issue was discovered in Couchbase Sync Gateway 2.7.0 through 2.8.2. (no CVSS)
- [CVE-2021-44148](https://cve.now/CVE-2021-44148.md): GL.iNet GL-AR150 2.x before 3.x devices, configured as repeaters, allow cgi-bin/router\_cgi?action=scanwifi XSS when an attacker creates an S (no CVSS)
- [CVE-2021-44149](https://cve.now/CVE-2021-44149.md): An issue was discovered in Trusted Firmware OP-TEE Trusted OS through 3.15.0. (no CVSS)
- [CVE-2021-38759](https://cve.now/CVE-2021-38759.md): Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. (no CVSS)
- [CVE-2021-36760](https://cve.now/CVE-2021-36760.md): In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the (no CVSS)
- [CVE-2021-36133](https://cve.now/CVE-2021-36133.md): The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks security access configuration for several models, resulting in TrustZone bypass becau (no CVSS)
- [CVE-2021-34544](https://cve.now/CVE-2021-34544.md): An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. (no CVSS)
- [CVE-2021-34543](https://cve.now/CVE-2021-34543.md): The web administration server in Solar-Log 500 before 2.8.2 Build 52 does not require authentication, which allows remote attackers to gain (no CVSS)
- [CVE-2021-28680](https://cve.now/CVE-2021-28680.md): The devise\_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. (no CVSS, devise\_masquerade)
- [CVE-2020-27356](https://cve.now/CVE-2020-27356.md): The debug-meta-data plugin 1.1.2 for WordPress allows XSS. (no CVSS)
- [CVE-2021-42688](https://cve.now/CVE-2021-42688.md): An Integer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. (no CVSS)
- [CVE-2021-42687](https://cve.now/CVE-2021-42687.md): A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. (no CVSS)
- [CVE-2021-42686](https://cve.now/CVE-2021-42686.md): An Integer Overflow exists in Accops HyWorks Windows Client prior to v 3.2.8.200. (no CVSS)
- [CVE-2021-42685](https://cve.now/CVE-2021-42685.md): An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 . (no CVSS)
- [CVE-2021-42683](https://cve.now/CVE-2021-42683.md): A Buffer Overflow vulnerability exists in Accops HyWorks Windows Client prior to v 3.2.8.200. (no CVSS)
- [CVE-2021-42682](https://cve.now/CVE-2021-42682.md): An Integer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105 .The IOCTL Handler 0x22001B allows local attackers (no CVSS)
- [CVE-2021-42681](https://cve.now/CVE-2021-42681.md): A Buffer Overflow vulnerability exists in Accops HyWorks DVM Tools prior to v3.3.1.105. (no CVSS)
- [CVE-2021-43638](https://cve.now/CVE-2021-43638.md): Amazon Amazon WorkSpaces agent is affected by Integer Overflow. (no CVSS)
- [CVE-2021-43637](https://cve.now/CVE-2021-43637.md): Amazon WorkSpaces agent is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-43006](https://cve.now/CVE-2021-43006.md): AmZetta Amzetta zPortal DVM Tools is affected by Integer Overflow. (no CVSS)
- [CVE-2021-43003](https://cve.now/CVE-2021-43003.md): Amzetta zPortal Windows zClient is affected by Integer Overflow. (no CVSS)
- [CVE-2021-43002](https://cve.now/CVE-2021-43002.md): Amzetta zPortal DVM Tools is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-43000](https://cve.now/CVE-2021-43000.md): Amzetta zPortal Windows zClient is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42996](https://cve.now/CVE-2021-42996.md): Donglify is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42994](https://cve.now/CVE-2021-42994.md): Donglify is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42993](https://cve.now/CVE-2021-42993.md): FlexiHub For Windows is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42990](https://cve.now/CVE-2021-42990.md): FlexiHub For Windows is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42988](https://cve.now/CVE-2021-42988.md): Eltima USB Network Gate is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42987](https://cve.now/CVE-2021-42987.md): Eltima USB Network Gate is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42986](https://cve.now/CVE-2021-42986.md): NoMachine Enterprise Client is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42983](https://cve.now/CVE-2021-42983.md): NoMachine Enterprise Client is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42980](https://cve.now/CVE-2021-42980.md): NoMachine Cloud Server is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42979](https://cve.now/CVE-2021-42979.md): NoMachine Cloud Server is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42977](https://cve.now/CVE-2021-42977.md): NoMachine Enterprise Desktop is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42976](https://cve.now/CVE-2021-42976.md): NoMachine Enterprise Desktop is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-42973](https://cve.now/CVE-2021-42973.md): NoMachine Server is affected by Integer Overflow. (no CVSS)
- [CVE-2021-42972](https://cve.now/CVE-2021-42972.md): NoMachine Server is affected by Buffer Overflow. (no CVSS)
- [CVE-2021-40288](https://cve.now/CVE-2021-40288.md): A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before V1\_211014, allows a remote unauthenticated (no CVSS)
- [CVE-2021-24041](https://cve.now/CVE-2021-24041.md): A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could ha (no CVSS, Facebook WhatsApp Business for Android · Facebook WhatsApp…)
- [CVE-2021-37940](https://cve.now/CVE-2021-37940.md): An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterpri (no CVSS, Elastic Enterprisesearch)
- [CVE-2021-40859](https://cve.now/CVE-2021-40859.md): Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management app (no CVSS)
- [CVE-2021-41716](https://cve.now/CVE-2021-41716.md): Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixati (no CVSS)
- [CVE-2021-43798](https://cve.now/CVE-2021-43798.md): Grafana path traversal (CVSS 7.5, KEV, grafana · github.com/grafana/grafana)
- [CVE-2020-12140](https://cve.now/CVE-2020-12140.md): A buffer overflow in os/net/mac/ble/ble-l2cap.c in the BLE stack in Contiki-NG 4.4 and earlier allows an attacker to execute arbitrary code (no CVSS)
- [CVE-2021-43176](https://cve.now/CVE-2021-43176.md): The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file exten (no CVSS, GOautodial API)
- [CVE-2021-43175](https://cve.now/CVE-2021-43175.md): The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action th (no CVSS, GOautodial API)
- [CVE-2021-43805](https://cve.now/CVE-2021-43805.md): ReDos vulnerability on guest checkout email validation (CVSS 7.5, solidusio solidus · solidus\_core)
- [CVE-2021-43789](https://cve.now/CVE-2021-43789.md): Blind SQLi using Search filters in PrestaShop (CVSS 7.5, PrestaShop · prestashop/prestashop)
- [CVE-2021-37100](https://cve.now/CVE-2021-37100.md): There is a Improper Authentication vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to account auth (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37099](https://cve.now/CVE-2021-37099.md): There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete any file. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37096](https://cve.now/CVE-2021-37096.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to user priva (no CVSS, Huawei EMUI · Huawei HarmonyOS)
- [CVE-2021-37095](https://cve.now/CVE-2021-37095.md): There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remot (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37094](https://cve.now/CVE-2021-37094.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to system den (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37091](https://cve.now/CVE-2021-37091.md): There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may l (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37090](https://cve.now/CVE-2021-37090.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37089](https://cve.now/CVE-2021-37089.md): There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel restart. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37088](https://cve.now/CVE-2021-37088.md): There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write a (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37087](https://cve.now/CVE-2021-37087.md): There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can create (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37086](https://cve.now/CVE-2021-37086.md): There is a Improper Preservation of Permissions vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37085](https://cve.now/CVE-2021-37085.md): There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37084](https://cve.now/CVE-2021-37084.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to malicious (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37083](https://cve.now/CVE-2021-37083.md): There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Denial of S (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37082](https://cve.now/CVE-2021-37082.md): There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to motionhub crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37081](https://cve.now/CVE-2021-37081.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to nearby cra (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37080](https://cve.now/CVE-2021-37080.md): There is a Incomplete Cleanup vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affe (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37079](https://cve.now/CVE-2021-37079.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arb (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37078](https://cve.now/CVE-2021-37078.md): There is a Uncaught Exception vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote Denial of (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37077](https://cve.now/CVE-2021-37077.md): There is a NULL Pointer Dereference vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to kernel cras (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37076](https://cve.now/CVE-2021-37076.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affe (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37073](https://cve.now/CVE-2021-37073.md): There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the detection result (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37072](https://cve.now/CVE-2021-37072.md): There is a Incorrect Calculation of Buffer Size vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37071](https://cve.now/CVE-2021-37071.md): There is a Business Logic Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to persistent dos (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37070](https://cve.now/CVE-2021-37070.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37068](https://cve.now/CVE-2021-37068.md): There is a Resource Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37067](https://cve.now/CVE-2021-37067.md): There is a Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Huawei Smartphone.Successful exploitation of this vul (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37066](https://cve.now/CVE-2021-37066.md): There is a Out-of-bounds Read vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to process crash. (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37065](https://cve.now/CVE-2021-37065.md): There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Confi (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37064](https://cve.now/CVE-2021-37064.md): There is a Improper Limitation of a Pathname to a Restricted Directory vulnerability in Huawei Smartphone.Successful exploitation of this vu (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37063](https://cve.now/CVE-2021-37063.md): There is a Cryptographic Issues vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to read and delete (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37062](https://cve.now/CVE-2021-37062.md): There is a Improper Validation of Array Index vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to m (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37061](https://cve.now/CVE-2021-37061.md): There is a Uncontrolled Resource Consumption vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Sc (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37060](https://cve.now/CVE-2021-37060.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to SAMGR Heap (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37059](https://cve.now/CVE-2021-37059.md): There is a Weaknesses Introduced During Design (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37058](https://cve.now/CVE-2021-37058.md): There is a Permissions,Privileges,and Access Controls vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may l (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37057](https://cve.now/CVE-2021-37057.md): There is a Improper Validation of Array Index vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to r (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37048](https://cve.now/CVE-2021-37048.md): There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visit (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37043](https://cve.now/CVE-2021-37043.md): There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to maliciou (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37021](https://cve.now/CVE-2021-37021.md): There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-b (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37020](https://cve.now/CVE-2021-37020.md): There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-b (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37014](https://cve.now/CVE-2021-37014.md): There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device c (no CVSS, Huawei HarmonyOS)
- [CVE-2021-37011](https://cve.now/CVE-2021-37011.md): There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-b (no CVSS, Huawei HarmonyOS)
- [CVE-2020-19611](https://cve.now/CVE-2020-19611.md): Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2021-37056](https://cve.now/CVE-2021-37056.md): There is an Improper permission control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37055](https://cve.now/CVE-2021-37055.md): There is a Logic bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may allow attempts to obtain certai (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37047](https://cve.now/CVE-2021-37047.md): There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause some services to r (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37046](https://cve.now/CVE-2021-37046.md): There is a Memory leak vulnerability with the codec detection module in Huawei Smartphone.Successful exploitation of this vulnerability may (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37042](https://cve.now/CVE-2021-37042.md): There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds r (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37041](https://cve.now/CVE-2021-37041.md): There is an Improper verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause out-of-bounds r (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2021-37038](https://cve.now/CVE-2021-37038.md): There is an Improper access control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service conf (no CVSS, Huawei EMUI · Huawei Magic UI)
- [CVE-2020-27413](https://cve.now/CVE-2020-27413.md): An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext username and password wh (no CVSS)
- [CVE-2021-44185](https://cve.now/CVE-2021-44185.md): Adobe Bridge RGB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-44186](https://cve.now/CVE-2021-44186.md): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-44187](https://cve.now/CVE-2021-44187.md): Adobe Bridge SGI File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-42133](https://cve.now/CVE-2021-42133.md): An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service t (no CVSS, Ivanti Avalanche)
- [CVE-2021-42132](https://cve.now/CVE-2021-42132.md): A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform (no CVSS, Ivanti Avalanche)
- [CVE-2021-42131](https://cve.now/CVE-2021-42131.md): A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privi (no CVSS, Ivanti Avalanche)
- [CVE-2021-42130](https://cve.now/CVE-2021-42130.md): A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Ser (no CVSS, Ivanti Avalanche)
- [CVE-2021-42129](https://cve.now/CVE-2021-42129.md): A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform (no CVSS, Ivanti Avalanche)
- [CVE-2021-42128](https://cve.now/CVE-2021-42128.md): An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 using inforail Service allows Privilege Escalation via E (no CVSS, Ivanti Avalanche)
- [CVE-2021-42127](https://cve.now/CVE-2021-42127.md): A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execu (no CVSS, Ivanti Avalanche)
- [CVE-2021-42126](https://cve.now/CVE-2021-42126.md): An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Servi (no CVSS, Ivanti Avalanche)
- [CVE-2021-42125](https://cve.now/CVE-2021-42125.md): An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to (no CVSS, Ivanti Avalance)
- [CVE-2021-42124](https://cve.now/CVE-2021-42124.md): An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to p (no CVSS, Ivanti Avalanche)
- [CVE-2021-22956](https://cve.now/CVE-2021-22956.md): An uncontrolled resource consumption vulnerability exists in Citrix ADC \<13.0-83.27, \<12.1-63.22 and 11.1-65.23 that could allow an attacker (no CVSS, Citrix ADC, Citrix Gateway, Citrix SDWAN)
- [CVE-2021-22955](https://cve.now/CVE-2021-22955.md): A unauthenticated denial of service vulnerability exists in Citrix ADC \<13.0-83.27, \<12.1-63.22 and 11.1-65.23 when configured as a VPN (Gat (no CVSS, Citrix ADC, Citrix Gateway)
- [CVE-2021-44527](https://cve.now/CVE-2021-44527.md): A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the net (no CVSS, UniFi Switches)
- [CVE-2021-40096](https://cve.now/CVE-2021-40096.md): A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject a (no CVSS)
- [CVE-2021-40095](https://cve.now/CVE-2021-40095.md): An issue was discovered in SquaredUp for SCOM 5.2.1.6654. (no CVSS)
- [CVE-2021-40094](https://cve.now/CVE-2021-40094.md): A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. (no CVSS)
- [CVE-2021-40093](https://cve.now/CVE-2021-40093.md): A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject a (no CVSS)
- [CVE-2021-40092](https://cve.now/CVE-2021-40092.md): A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web sc (no CVSS)
- [CVE-2021-29116](https://cve.now/CVE-2021-29116.md): BUG-000142180 Hosted feature services vulnerable to stored XSS (CVSS 6.1, Esri ArcGIS Server)
- [CVE-2021-29115](https://cve.now/CVE-2021-29115.md): An information disclosure vulnerability (CVSS 5.3, Esri ArcGIS Server)
- [CVE-2021-29114](https://cve.now/CVE-2021-29114.md): SQL injection vulnerability in ArcGIS Server (CVSS 7.3, Esri ArcGIS Server)
- [CVE-2021-29113](https://cve.now/CVE-2021-29113.md): Remote file inclusion vulnerability in ArcGIS Server help documentation (CVSS 4.7, Esri ArcGIS Server)
- [CVE-2021-4049](https://cve.now/CVE-2021-4049.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 4.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-44513](https://cve.now/CVE-2021-44513.md): Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling (no CVSS)
- [CVE-2021-44512](https://cve.now/CVE-2021-44512.md): World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity (no CVSS)
- [CVE-2021-28703](https://cve.now/CVE-2021-28703.md): grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of me (no CVSS, Xen Project Xen)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.