CVEs published December 13, 2021
108 CVEs were published on December 13, 2021: 2 critical, 9 high. 1 is now in CISA KEV.
- Published
- 108
- Critical
- 2
- High
- 9
- Medium
- 31
- Low
- 7
- Unrated
- 59
- Now in CISA KEV
- 1
- Fix available
- 52
Most affected products
- GitLab
- 19
- IBM Spectrum Copy Data Management
- 7
- Delicious Brains Advanced Custom Fields and Advanced Custom…
- 3
- IBM Spectrum Protect Plus
- 3
- Get Custom Field Values
- 2
- IBM i2 Analyst's Notebook
- 2
- Modern Events Calendar Lite
- 2
- Pixel Cat – Conversion Pixel Manager
- 2
- User Registration, Login Form, User Profile & Membership –…
- 2
- ABB RobotWare
- 1
Critical 2
High 9
- CVE-2021-41272SHL, SHR, and SAR operations trigger native exception at key values in besuhyperledger besu
- CVE-2021-43822SQL injection in jackalope/jackalope-doctrine-dbaljackalope-doctrine-dbal · jackalope/jackalope-doctrine-dbal
- CVE-2021-43817Reflected Cross-Site-Scripting vulnerability in Collabora OnlineCollaboraOnline online
- CVE-2021-43814Heap-based OOB write when parsing dwarf DIE info in Rizinrizinorg rizin
- CVE-2021-43801Uncaught Exception in mercuriusmercurius-js mercurius · mercurius
- CVE-2021-43818HTML Cleaner allows crafted and SVG embedded scripts to pass throughlxml
- CVE-2021-39065IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by imIBM Spectrum Copy Data Management
- CVE-2021-43983WECON LeviStudioUWECON LeviStudioU
- CVE-2021-39944An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 beforeGitLab
Medium, low and unrated 97
- CVE-2020-19042Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
- CVE-2021-24045A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0.Facebook Hermes
- CVE-2021-43823Side-channel attack in Sourcegraphsourcegraph
- CVE-2021-39063IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out priIBM Spectrum Protect Plus
- CVE-2021-39057IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x is vulnerable to server-side request forgery (SSRF).IBM Spectrum Protect Plus
- CVE-2021-39050IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM i2 Analyst's Notebook
- CVE-2021-39049IBM i2 Analyst's Notebook 9.2.0, 9.2.1, and 9.2.2 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking.IBM i2 Analyst's Notebook
- CVE-2021-39048IBM Spectrum Protect Client 7.1 and 8.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking.IBM Spectrum Protect
- CVE-2021-38901IBM Spectrum Protect Operations Center 7.1, under special configurations, could allow a local user to obtain highly sensitive information.IBM Spectrum Protect Operations Center
- CVE-2020-4496The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a manIBM Spectrum Protect Plus
- CVE-2021-39064IBM Spectrum Copy Data Management 2.2.13 and earlier has weak authentication and password rules and incorrectly handles default credentials IBM Spectrum Copy Data Management
- CVE-2021-39058IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrIBM Spectrum Copy Data Management
- CVE-2021-39054IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to hijack the clicking action of the victim.IBM Spectrum Copy Data Management
- CVE-2021-39053IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to obtain sensitive information, caused by the improper hIBM Spectrum Copy Data Management
- CVE-2021-39052IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console without authorization.IBM Spectrum Copy Data Management
- CVE-2021-38947IBM Spectrum Copy Data Management 2.2.13 and earlier uses weaker than expected cryptographic algorithms that could allow an attacker to decrIBM Spectrum Copy Data Management
- CVE-2020-16156CPAN 2.28 allows Signature Verification Bypass.
- CVE-2020-16155The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data.
- CVE-2020-16154The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
- CVE-2021-40008There is a memory leak vulnerability in CloudEngine 12800 V200R019C00SPC800, CloudEngine 5800 V200R019C00SPC800, CloudEngine 6800 V200R019C0CloudEngine 12800;CloudEngine 5800;CloudEngine 6800;CloudEn…
- CVE-2021-40007There is an information leak vulnerability in eCNS280_TD V100R005C10SPC650.eCNS280_TD
- CVE-2021-39930Missing authorization in GitLab EE versions between 12.4 and 14.3.6, between 14.4.0 and 14.4.4, and between 14.5.0 and 14.5.2 allowed an attGitLab
- CVE-2021-39939An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions stGitLab Runner
- CVE-2021-39941An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project membGitLab
- CVE-2021-39935An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39917An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39932An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39934Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before GitLab
- CVE-2021-39916Lack of an access control check in the External Status Check feature allowed any authenticated user to retrieve the configuration of any ExtGitLab
- CVE-2021-39919In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting frGitLab
- CVE-2021-39915Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting frGitLab
- CVE-2021-39933An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 beforGitLab
- CVE-2021-39938A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, allGitLab
- CVE-2021-39937A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all veGitLab
- CVE-2021-39931An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39936Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4GitLab
- CVE-2021-39945Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 befoGitLab
- CVE-2021-39940An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39910An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 beforeGitLab
- CVE-2021-39918Incorrect Authorization in GitLab EE affecting all versions starting from 11.1 before 14.3.6, all versions starting from 14.4 before 14.4.4,GitLab
- CVE-2021-44965Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retri
- CVE-2021-44966SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php.
- CVE-2021-36169A Hidden Functionality in Fortinet FortiOS 7.x before 7.0.1, FortiOS 6.4.x before 6.4.7 allows attacker to Execute unauthorized code or commFortinet FortiOS
- CVE-2021-43117fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
- CVE-2021-42548reflected XSS in search functionality of WP Cloud Plugins - Share-one-DriveWP Cloud Plugins Share-one-Drive
- CVE-2021-42549reflected XSS in search functionality of WP Cloud Plugins - Lets-BoxWP Cloud Plugins Lets-Box
- CVE-2021-42547reflected XSS in search functionality of WP Cloud Plugins - Out-of-the-BoxWP Cloud Plugins Out-of-the-Box
- CVE-2021-42546Reflected XSS in search functionality of WP Cloud Plugins - Use-Your-DriveWP Cloud Plugins Use-Your-Drive
- CVE-2021-24972Pixel Cat Lite < 2.6.3 - Admin+ Stored Cross-Site ScriptingPixel Cat – Conversion Pixel Manager
- CVE-2021-24970All-In-One-Gallery < 2.5.0 - Admin+ Local File InclusionAll-in-One Video Gallery
- CVE-2021-24955ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingUser Registration, Login Form, User Profile & Membership –…
- CVE-2021-24954ProfilePress < 3.2.3 - Reflected Cross-Site ScriptingUser Registration, Login Form, User Profile & Membership –…
- CVE-2021-24951LearnPress < 4.1.4 - Admin+ SQL InjectionLearnPress – WordPress LMS Plugin
- CVE-2021-24946Modern Events Calendar < 6.1.5 - Unauthenticated Blind SQL InjectionModern Events Calendar Lite
- CVE-2021-24945Like Button Rating < 2.6.38 - Unauthorised Vote Export to Email & IP Addresses DisclosureLike Button Rating ♥ LikeBtn
- CVE-2021-24932Auto Featured Image < 3.9.3 - Reflected Cross-Site ScriptingAuto Featured Image
- CVE-2021-24925Modern Events Calendar Lite < 6.1.5 - Reflected Cross-Site ScriptingModern Events Calendar Lite
- CVE-2021-24922Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site ScriptingPixel Cat – Conversion Pixel Manager
- CVE-2021-24896Caldera forms < 1.9.5 - Admin+ Stored Cross-Site ScriptingCaldera Forms – More Than Contact Forms
- CVE-2021-24872Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata AccessGet Custom Field Values
- CVE-2021-24871Get Custom Field Values < 4.0.1 - Contributor+ Stored Cross-Site ScriptingGet Custom Field Values
- CVE-2021-24863StopBadBots < 6.67 - Unauthenticated SQL InjectionWP Block and Stop Bad Bots Crawlers and Spiders and Anti Sp…
- CVE-2021-24861Quotes Collection <= 2.5.2 - Admin+ SQL InjectionQuotes Collection
- CVE-2021-24859User Meta Shortcodes <= 0.5 - Contributor+ Unauthorized Arbitrary User Metadata AccessUser meta shortcodes
- CVE-2021-24857ToTop Link <= 1.7.1 - Unauthenticated PHP Object InjectionToTop Link
- CVE-2021-24855Display Post Metadata < 1.5.0 - Contributor+ Stored Cross-Site ScriptingDisplay Post Metadata
- CVE-2021-24848Mediamatic < 2.8.1 - Subscriber+ SQL InjectionMediamatic – Media Library Folders
- CVE-2021-24845Improved Include Page <= 1.2 - Contributor+ Arbitrary Posts/Pages AccessImproved Include Page
- CVE-2021-24836Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings UpdateTemporary Login Without Password
- CVE-2021-24819Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages AccessPage/Post Content Shortcode
- CVE-2021-24818WP Limits <= 1.0 - Plugin's Settings Update via CSRFWp Limits
- CVE-2021-24817Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site ScriptingUltimate Nofollow
- CVE-2021-24795Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRFFilter Portfolio Gallery
- CVE-2021-24792Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site ScriptingShiny Buttons – CSS3 Button Generator for WordPress
- CVE-2021-24790Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX CallsContact Form Advanced Database
- CVE-2021-24784WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRFWP Admin Logo Changer
- CVE-2021-24782Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-ScriptingFlex Local Fonts
- CVE-2021-24780Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRFSingle Post Exporter
- CVE-2021-24771Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site ScriptingInspirational Quote Rotator
- CVE-2021-24756WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site ScriptingWP System Log
- CVE-2021-24747SEO Booster < 3.8 - Admin+ SQL InjectionSEO Booster
- CVE-2021-24705NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRFNEX-Forms
- CVE-2021-20867Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerabDelicious Brains Advanced Custom Fields and Advanced Custom…
- CVE-2021-20866Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerabDelicious Brains Advanced Custom Fields and Advanced Custom…
- CVE-2021-20865Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing authorization vulnerabDelicious Brains Advanced Custom Fields and Advanced Custom…
- CVE-2021-44154An issue was discovered in Reprise RLM 14.2.
- CVE-2021-44153An issue was discovered in Reprise RLM 14.2.
- CVE-2021-40858Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure.
- CVE-2021-40857Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.
- CVE-2021-40856Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.
- CVE-2021-44848In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication requests depending on whet
- CVE-2018-25021The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows a remote attacker t
- CVE-2021-44847A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an imp
- CVE-2018-25022The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a ta
- CVE-2021-44151An issue was discovered in Reprise RLM 14.2.
- CVE-2021-44152An issue was discovered in Reprise RLM 14.2.
- CVE-2021-44155An issue was discovered in /goform/login_process in Reprise RLM 14.2.