CVEs published December 9, 2021
53 CVEs were published on December 9, 2021: 3 critical, 10 high.
- Published
- 53
- Critical
- 3
- High
- 10
- Medium
- 15
- Low
- 0
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Gryphon Tower router
- 10
- IBM DB2 for Linux, UNIX and Windows
- 5
- Anker
- 2
- Fortinet FortiClientWindows
- 2
- Fortinet FortiWeb
- 2
- Apache Software Foundation Apache Airavata Django Portal
- 1
- auth0 express-openid-connect · express-openid-connect
- 1
- Delta Electronics CNCSoft
- 1
- doctrine/dbal
- 1
- dpgaspar Flask-AppBuilder · flask-appbuilder
- 1
Critical 3
- CVE-2021-43802Admin privilege escalation and arbitrary code execution via malicious *.etherpad importsetherpad-lite
- CVE-2021-21954A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 Anker
- CVE-2021-3817SQL Injection in wbce/wbce_cmswbce/wbce_cms
High 10
- CVE-2021-43803Unexpected server crash in Next.jsvercel next.js · next
- CVE-2021-43982Delta Electronics CNCSoftDelta Electronics CNCSoft
- CVE-2021-22568Dart - Publishing to third-party package repositories may expose pub.dev credentialsGoogle Dart SDK
- CVE-2021-38951IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request.IBM WebSphere Application Server
- CVE-2021-29678IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority toIBM DB2 for Linux, UNIX and Windows
- CVE-2021-41265Improper Authentication in Flask-AppBuilderdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2021-21955An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary of Anker Eufy HomebAnker
- CVE-2021-43071A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attackerFortinet FortiWeb
- CVE-2021-43065A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, version 8.8.9 and belowFortinet FortiNAC
- CVE-2021-36194Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allow an authenticated aFortinet FortiWeb
Medium, low and unrated 40
- CVE-2021-37861Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.Mattermost
- CVE-2021-4033Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2kevinpapst/kimai2
- CVE-2021-44514OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.
- CVE-2021-43608Doctrine DBAL 3.x before 3.1.4 allows SQL Injection.doctrine/dbal
- CVE-2020-19683A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.
- CVE-2020-19682A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.
- CVE-2021-39002IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic alIBM DB2 for Linux, UNIX and Windows
- CVE-2021-38931IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of aIBM DB2 for Linux, UNIX and Windows
- CVE-2021-38926IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privilegeIBM DB2 for Linux, UNIX and Windows
- CVE-2021-20373IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstIBM DB2 for Linux, UNIX and Windows
- CVE-2021-43703An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php.
- CVE-2021-40282An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php.
- CVE-2021-40281An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary users.
- CVE-2021-40280An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.
- CVE-2021-4038NSM vulnerable to XSSMcAfee Network Security Manager
- CVE-2021-41246Session fixation in express-openid-connectauth0 express-openid-connect · express-openid-connect
- CVE-2021-40279An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.
- CVE-2021-41697A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/so
- CVE-2021-41696An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in re
- CVE-2021-41695An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php.
- CVE-2021-20139An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon TowerGryphon Tower router
- CVE-2021-20138An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/lucGryphon Tower router
- CVE-2021-20137A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower routeGryphon Tower router
- CVE-2021-20142An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon ToweGryphon Tower router
- CVE-2021-20141An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon ToweGryphon Tower router
- CVE-2021-20140An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon ToweGryphon Tower router
- CVE-2021-41694An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php.
- CVE-2021-20146An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon'Gryphon Tower router
- CVE-2021-20145Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN networGryphon Tower router
- CVE-2021-20144An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon ToweGryphon Tower router
- CVE-2021-20143An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon ToweGryphon Tower router
- CVE-2021-41449A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated atta
- CVE-2021-22565Insufficient Granularity of Access Control in GAEN Notification ServerGoogle Exposure-notifications-verification-server · github.…
- CVE-2021-43068A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authentication via a RADIUFortinet FortiAuthenticator
- CVE-2021-36167An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 and below may allow anFortinet FortiClientWindows
- CVE-2021-42759A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows attacker to execute unauFortinet Meru AP
- CVE-2021-36189A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allows attacker to informFortinet FortiClientEMS
- CVE-2021-43204A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.2.9 and below, versiFortinet FortiClientWindows
- CVE-2021-43410airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statementsApache Software Foundation Apache Airavata Django Portal
- CVE-2021-43797HTTP fails to validate against control chars in header names which may lead to HTTP request smugglingnetty · io.netty:netty-codec-http +2