CVEs published December 14, 2021
114 CVEs were published on December 14, 2021: 4 critical, 14 high. 1 is now in CISA KEV.
- Published
- 114
- Critical
- 4
- High
- 14
- Medium
- 18
- Low
- 0
- Unrated
- 78
- Now in CISA KEV
- 1
- Fix available
- 28
Most affected products
- Siemens JT Utilities · Siemens JTTK
- 21
- Siemens JT2Go · Siemens Teamcenter Visualization
- 14
- SAP SE SAP 3D Visual Enterprise Viewer
- 3
- Siemens SiPass integrated · Siemens Siveillance Identity
- 3
- PatrowlManager
- 2
- Siemens JT Open · Siemens JT Utilities +1
- 2
- .htaccess Redirect
- 1
- Apache Software Foundation Apache Log4j · org.apache.log… +1
- 1
- Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- 1
- Apache Software Foundation Apache Sling Commons Messaging M…
- 1
Critical 4
- CVE-2021-43821Files Accessible to External Parties in Opencastopencast · org.opencastproject:opencast-ingest-service-impl
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2021-4073RegistrationMagic <= 5.0.1.7 Authentication BypassRegistrationMagic
- CVE-2021-3836Improper Restriction of XML External Entity Reference in dbeaver/dbeaverdbeaver/dbeaver
High 14
- CVE-2021-39183Unsafe inline XSS Owncastowncast · github.com/owncast/owncast
- CVE-2021-43829Unrestricted Upload of Files in PatrowlPatrowlManager
- CVE-2021-43830SQL injection in OpenProjectopf openproject
- CVE-2021-43828Improper Privilege Management in PatrowlPatrowlManager
- CVE-2021-43051TIBCO Spotfire Server API Authorization VulnerabilityTIBCO Software TIBCO Spotfire Server
- CVE-2021-43820Permissions check bypass in Seafilehaiwen seafile-server
- CVE-2021-43807HTTP Method Spoofing in Opencastopencast · org.opencastproject:opencast-common
- CVE-2021-38950IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to effective.IBM MQ for HPE NonStop
- CVE-2021-39312True Ranker <= 2.2.2 Directory Traversal/Arbitrary File ReadTrue Ranker
- CVE-2021-4007Rapid7 Insight Agent Privilege EscalationRapid7 Insight Agent
- CVE-2021-44014A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versionsSiemens JT Open · Siemens JT Utilities +1
- CVE-2021-44002A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versionsSiemens JT Open · Siemens JT Utilities +1
- CVE-2021-3831Cross-site Scripting (XSS) - Reflected in gnuboard/gnuboard5gnuboard/gnuboard5
- CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
Medium, low and unrated 96
- CVE-2021-43827Inline footnotes wrapped in <a> tags can cause errors in discourse-footnotesdiscourse-footnote
- CVE-2021-4108Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2021-44942glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.ph
- CVE-2021-34426Arbitrary command execution in Keybase Client for WindowsZoom Video Communications Keybase Client for Windows
- CVE-2021-34425Server Side Request Forgery in Zoom Client for Meetings chatZoom Video Communications Zoom Client for Meetings for A… +3
- CVE-2021-4044Invalid handling of X509_verify_cert() internal errors in libsslOpenSSL · openssl-src
- CVE-2018-10228Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to in
- CVE-2021-40883A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.
- CVE-2021-43388Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup.
- CVE-2021-40882A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.
- CVE-2021-44043An issue was discovered in UiPath App Studio 21.4.4.
- CVE-2021-44041UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget argument of the URI h
- CVE-2021-44042An issue was discovered in UiPath Assistant 21.4.4.
- CVE-2021-39313Simple Image Gallery <= 1.0.6 Reflected Cross-Site ScriptingSimple Image Gallery
- CVE-2021-39310Real WYSIWYG <= 0.0.2 Reflected Cross-Site ScriptingReal WYSIWYG
- CVE-2021-39308WooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site ScriptingWooCommerce myghpay Payment Gateway
- CVE-2021-38361.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting.htaccess Redirect
- CVE-2021-39311link-list-manager <= 1.0 Reflected Cross-Site Scriptinglink-list-manager
- CVE-2021-39309Parsian Bank Gateway for Woocommerce <= 1.0 Reflected Cross-Site ScriptingParsian Bank Gateway for Woocommerce
- CVE-2021-39314WooCommerce EnvioPack <= 1.2 Reflected Cross-Site ScriptingWooCommerce EnvioPack
- CVE-2021-39318H5P CSS Editor <= 1.0 Reflected Cross-Site ScriptingH5P CSS Editor
- CVE-2021-41836Fathom Analytics <= 3.0.4 Authenticated Stored Cross-Site ScriptingFathom Analytics
- CVE-2021-42367Variation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site ScriptingVariation Swatches for WooCommerce
- CVE-2021-39319duoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site ScriptingduoFAQ - Responsive, Flat, Simple FAQ
- CVE-2021-39315Magic Post Voice <= 1.2 Reflected Cross-Site ScriptingMagic Post Voice
- CVE-2021-42061SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, reSAP SE SAP BusinessObjects Business Intelligence Platform
- CVE-2021-42068When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9.0, the applicSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-42064If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP CSAP SE SAP Commerce
- CVE-2021-42070When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - version 9SAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-38182Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can compleSAP SE Kyma
- CVE-2021-42069When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - versSAP SE SAP 3D Visual Enterprise Viewer
- CVE-2021-42063A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50.SAP SE SAP Knowledge Warehouse
- CVE-2021-42066SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypteSAP SE SAP Business One
- CVE-2021-44232SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided by normal user, leadiSAP SE SAF-T Framework
- CVE-2021-44235Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756SAP SE SAP NetWeaver AS ABAP
- CVE-2021-44231Internally used text extraction reports allow an attacker to inject code that can be executed by the application.SAP SE SAP ABAP Server & ABAP Platform
- CVE-2021-44233SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for an authenticated userSAP SE SAP GRC Access Control
- CVE-2021-41065An issue was discovered in Listary through 6.
- CVE-2021-41066An issue was discovered in Listary through 6.
- CVE-2021-41067An issue was discovered in Listary through 6.
- CVE-2021-44549SMTPS server hostname not checked when making TLS connection to SMTPS serverApache Software Foundation Apache Sling Commons Messaging M…
- CVE-2021-4107Cross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2021-42051An issue was discovered in AbanteCart before 1.3.2.
- CVE-2021-44949glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.
- CVE-2021-42050An issue was discovered in AbanteCart before 1.3.2.
- CVE-2021-36721Sysaid - Sysaid API User EnumerationSysAid API
- CVE-2021-45015taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.
- CVE-2021-45014There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26
- CVE-2021-44538The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow.
- CVE-2021-3376An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privileges via a crafted P
- CVE-2021-44937glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php.
- CVE-2021-44524A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.Siemens SiPass integrated · Siemens Siveillance Identity
- CVE-2021-44523A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.Siemens SiPass integrated · Siemens Siveillance Identity
- CVE-2021-44522A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), SiPass integrated V2.Siemens SiPass integrated · Siemens Siveillance Identity
- CVE-2021-44449A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44450A vulnerability has been identified in JT Utilities (All versions < V12.8.1.1), JTTK (All versions < V10.8.1.1).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44448A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44447A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44445A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44446A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0), JTTK (All versions < V11.0.3.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44444A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44443A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44442A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44441A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44440A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44438A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44439A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44437A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44436A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44434A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44435A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44433A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44432A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44430A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44431A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0), JTTK (All versions < V11.1.1.0).Siemens JT Utilities · Siemens JTTK
- CVE-2021-44165A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41), POWER METER SICAM Q100 (All versions < V2.41), POWER MSiemens POWER METER SICAM Q100
- CVE-2021-44017A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44015A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44013A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44012A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44011A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44009A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44010A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44008A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44007A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44005A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44006A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44004A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44003A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-44001A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5).Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2021-42027A vulnerability has been identified in SINUMERIK Edge (All versions < V3.2).Siemens SINUMERIK Edge
- CVE-2021-42024A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < 2021.3.1).Siemens Simcenter STAR-CCM+ Viewer
- CVE-2021-42022A vulnerability has been identified in SIMATIC eaSie PCS 7 Skill Package (All versions < V21.00 SP3).Siemens SIMATIC eaSie PCS 7 Skill Package
- CVE-2021-41547A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versSiemens Teamcenter Active Workspace
- CVE-2021-44935glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php.
- CVE-2021-42023A vulnerability has been identified in ModelSim Simulation (All versions), Questa Simulation (All versions).Siemens ModelSim Simulation · Siemens Questa Simulation