CVEs published December 10, 2021
32 CVEs were published on December 10, 2021: 2 critical, 5 high. 1 is now in CISA KEV.
- Published
- 32
- Critical
- 2
- High
- 5
- Medium
- 11
- Low
- 0
- Unrated
- 14
- Now in CISA KEV
- 1
- Fix available
- 11
Most affected products
- pimcore/pimcore
- 3
- IBM PowerVM Hypervisor
- 2
- @rex1989 Comment Engine Pro
- 1
- AMD EPYC™
- 1
- AMD Processors
- 1
- Apache Software Foundation Apache Log4j2 · org.apache.lo… +4
- 1
- com.h2database:h2
- 1
- comb
- 1
- F-Secure Mobile Security
- 1
- grafana
- 1
Critical 2
High 5
- CVE-2021-41242Path Traversal in some REST methods leading to file upload to arbitrary placesOpenOLAT
- CVE-2021-23463XML External Entity (XXE) Injectioncom.h2database:h2
- CVE-2021-38917IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary hosIBM PowerVM Hypervisor
- CVE-2021-3829Open Redirect in openwhyd/openwhydopenwhyd/openwhyd
- CVE-2021-4084Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
Medium, low and unrated 25
- CVE-2020-12890Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or adminisAMD Processors
- CVE-2021-26340A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation AMD EPYC™
- CVE-2021-43815Grafana directory traversal for `.cvs` filesgrafana · github.com/grafana/grafana
- CVE-2021-23663Prototype Pollutionsey
- CVE-2021-23700Prototype Pollutionmerge-deep2
- CVE-2021-23561Prototype Pollutioncomb
- CVE-2021-4089Improper Access Control in snipe/snipe-itsnipe/snipe-it
- CVE-2021-27984In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.
- CVE-2021-27983Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.
- CVE-2021-31747Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks.
- CVE-2021-38937IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBMIBM PowerVM Hypervisor
- CVE-2021-31746Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal
- CVE-2021-31745Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform.
- CVE-2021-43813Directory Traversal in Grafanagrafana
- CVE-2021-36911WordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability@rex1989 Comment Engine Pro
- CVE-2021-29214A security vulnerability has been identified in HPE StoreServ Management Console (SSMC).HPE StoreServ Management Console (SSMC); HPE 3PAR StoreServ…
- CVE-2021-37934Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 cou
- CVE-2021-37935An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user t
- CVE-2021-40834User interface Spoofing in F-Secure SAFE browser for AndroidF-Secure Mobile Security
- CVE-2021-37189An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4.
- CVE-2021-37188An issue was discovered on Digi TransPort devices through 2021-07-21.
- CVE-2021-37187An issue was discovered on Digi TransPort devices through 2021-07-21.
- CVE-2021-35978An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR.
- CVE-2021-4081Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2021-4082Cross-Site Request Forgery (CSRF) in pimcore/pimcorepimcore/pimcore