# CVEs published 2021-12-10

32 CVEs were published on December 10, 2021: 2 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41242](https://cve.now/CVE-2021-41242.md): Path Traversal in some REST methods leading to file upload to arbitrary places (CVSS 8.1, OpenOLAT)
- [CVE-2020-12890](https://cve.now/CVE-2020-12890.md): Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or adminis (no CVSS, AMD Processors)
- [CVE-2021-26340](https://cve.now/CVE-2021-26340.md): A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to flush the Translation (no CVSS, AMD EPYC™)
- [CVE-2021-43815](https://cve.now/CVE-2021-43815.md): Grafana directory traversal for \`.cvs\` files (CVSS 4.3, grafana · github.com/grafana/grafana)
- [CVE-2021-23663](https://cve.now/CVE-2021-23663.md): Prototype Pollution (CVSS 6.5, sey)
- [CVE-2021-23700](https://cve.now/CVE-2021-23700.md): Prototype Pollution (CVSS 6.5, merge-deep2)
- [CVE-2021-23639](https://cve.now/CVE-2021-23639.md): Remote Code Execution (RCE) (CVSS 9.8, md-to-pdf)
- [CVE-2021-23561](https://cve.now/CVE-2021-23561.md): Prototype Pollution (CVSS 6.5, comb)
- [CVE-2021-23463](https://cve.now/CVE-2021-23463.md): XML External Entity (XXE) Injection (CVSS 8.1, com.h2database:h2)
- [CVE-2021-4089](https://cve.now/CVE-2021-4089.md): Improper Access Control in snipe/snipe-it (CVSS 4.3, snipe/snipe-it)
- [CVE-2021-27984](https://cve.now/CVE-2021-27984.md): In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. (no CVSS)
- [CVE-2021-27983](https://cve.now/CVE-2021-27983.md): Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page. (no CVSS)
- [CVE-2021-31747](https://cve.now/CVE-2021-31747.md): Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update\_applet.php, which could lead to man-in-the-middle attacks. (no CVSS)
- [CVE-2021-38937](https://cve.now/CVE-2021-38937.md): IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a specially crafted IBM (CVSS 6.3, IBM PowerVM Hypervisor)
- [CVE-2021-38917](https://cve.now/CVE-2021-38917.md): IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary hos (CVSS 7.4, IBM PowerVM Hypervisor)
- [CVE-2021-31746](https://cve.now/CVE-2021-31746.md): Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal (no CVSS)
- [CVE-2021-31745](https://cve.now/CVE-2021-31745.md): Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. (no CVSS)
- [CVE-2021-43813](https://cve.now/CVE-2021-43813.md): Directory Traversal in Grafana (CVSS 4.3, grafana)
- [CVE-2021-36911](https://cve.now/CVE-2021-36911.md): WordPress Comment Engine Pro plugin \<= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, @rex1989 Comment Engine Pro)
- [CVE-2021-29214](https://cve.now/CVE-2021-29214.md): A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). (no CVSS, HPE StoreServ Management Console (SSMC); HPE 3PAR StoreServ…)
- [CVE-2021-37934](https://cve.now/CVE-2021-37934.md): Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterprise before 3.10.14 cou (no CVSS)
- [CVE-2021-37935](https://cve.now/CVE-2021-37935.md): An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenticated, remote user t (no CVSS)
- [CVE-2021-3829](https://cve.now/CVE-2021-3829.md): Open Redirect in openwhyd/openwhyd (CVSS 7.3, openwhyd/openwhyd)
- [CVE-2021-40834](https://cve.now/CVE-2021-40834.md): User interface Spoofing in F-Secure SAFE browser for Android (CVSS 4.3, F-Secure Mobile Security)
- [CVE-2021-37189](https://cve.now/CVE-2021-37189.md): An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. (no CVSS)
- [CVE-2021-37188](https://cve.now/CVE-2021-37188.md): An issue was discovered on Digi TransPort devices through 2021-07-21. (no CVSS)
- [CVE-2021-37187](https://cve.now/CVE-2021-37187.md): An issue was discovered on Digi TransPort devices through 2021-07-21. (no CVSS)
- [CVE-2021-35978](https://cve.now/CVE-2021-35978.md): An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. (no CVSS)
- [CVE-2021-4084](https://cve.now/CVE-2021-4084.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 7.4, pimcore/pimcore)
- [CVE-2021-4081](https://cve.now/CVE-2021-4081.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 5.5, pimcore/pimcore)
- [CVE-2021-4082](https://cve.now/CVE-2021-4082.md): Cross-Site Request Forgery (CSRF) in pimcore/pimcore (CVSS 4.3, pimcore/pimcore)
- [CVE-2021-44228](https://cve.now/CVE-2021-44228.md): Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVSS 10.0, KEV, Apache Software Foundation Apache Log4j2 · org.apache.lo… +4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.