# CVEs published 2021-12-15

254 CVEs were published on December 15, 2021: 12 critical, 59 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2021-43834](https://cve.now/CVE-2021-43834.md): Incorrect Authentication in elabftw (CVSS 9.1, elabftw)
- [CVE-2021-43833](https://cve.now/CVE-2021-43833.md): Account takeover in eLabFTW (CVSS 8.1, elabftw)
- [CVE-2021-45018](https://cve.now/CVE-2021-45018.md): Cross Site Scripting (XSS) vulnerability exists in Catfish \<=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.html (no CVSS)
- [CVE-2021-45017](https://cve.now/CVE-2021-45017.md): Cross Site Request Forgery (CSRF) vulnerability exits in Catfish \<=6.1.\* when you upload an html file containing CSRF on the website that us (no CVSS)
- [CVE-2020-18985](https://cve.now/CVE-2020-18985.md): An issue in /domain/service/.ewell-known/caldav of Zimbra Collaboration 8.8.12 allows attackers to redirect users to any arbitrary website o (no CVSS)
- [CVE-2020-18984](https://cve.now/CVE-2020-18984.md): A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 al (no CVSS)
- [CVE-2021-44350](https://cve.now/CVE-2021-44350.md): SQL Injection vulnerability exists in ThinkPHP5 5.0.x \<=5.1.22 via the parseOrder function in Builder.php. (no CVSS, topthink/framework)
- [CVE-2021-44116](https://cve.now/CVE-2021-44116.md): Cross Site Scripting (XSS) vulnerability exits in Anchor CMS \<=0.12.7 in posts.php. (no CVSS, anchorcms/anchor-cms)
- [CVE-2021-43836](https://cve.now/CVE-2021-43836.md): PHP file inclusion in the Sulu admin panel (CVSS 8.5, sulu · sulu/sulu)
- [CVE-2021-43835](https://cve.now/CVE-2021-43835.md): Privilege escalation in the Sulu Admin panel (CVSS 7.2, sulu · sulu/sulu)
- [CVE-2021-43831](https://cve.now/CVE-2021-43831.md): Files on the host computer can be accessed from the Gradio interface (CVSS 7.7, gradio-app gradio · gradio)
- [CVE-2021-35490](https://cve.now/CVE-2021-35490.md): Thruk before 2.44 allows XSS for a quick command. (no CVSS)
- [CVE-2021-43806](https://cve.now/CVE-2021-43806.md): SQL injection in Tuleap (CVSS 8.8, Enalean tuleap)
- [CVE-2021-45078](https://cve.now/CVE-2021-45078.md): stab\_xcoff\_builtin\_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) o (no CVSS)
- [CVE-2021-41276](https://cve.now/CVE-2021-41276.md): Indirect LDAP injection in Tuleap (CVSS 6.7, Enalean tuleap)
- [CVE-2021-43782](https://cve.now/CVE-2021-43782.md): Indirect LDAP injection in Tuleap (CVSS 6.7, Enalean tuleap)
- [CVE-2021-36888](https://cve.now/CVE-2021-36888.md): WordPress Image Hover Effects Ultimate plugin \<= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise (CVSS 9.8, Oxilab Image Hover Effects Ultimate)
- [CVE-2021-1038](https://cve.now/CVE-2021-1038.md): In UserDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-1039](https://cve.now/CVE-2021-1039.md): In NotificationAccessActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-1040](https://cve.now/CVE-2021-1040.md): In onCreate of BluetoothPairingSelectionFragment.java, there is a possible EoP due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-39646](https://cve.now/CVE-2021-39646.md): Product: AndroidVersions: Android kernelAndroid ID: A-201537251References: N/A (no CVSS, Android)
- [CVE-2021-39644](https://cve.now/CVE-2021-39644.md): Product: AndroidVersions: Android kernelAndroid ID: A-199809304References: N/A (no CVSS, Android)
- [CVE-2021-0976](https://cve.now/CVE-2021-0976.md): In toBARK of floor0.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39645](https://cve.now/CVE-2021-39645.md): Product: AndroidVersions: Android kernelAndroid ID: A-199805112References: N/A (no CVSS, Android)
- [CVE-2021-39647](https://cve.now/CVE-2021-39647.md): In mon\_smc\_load\_sp of gs101-sc/plat/samsung/exynos/soc/exynos9845/smc\_booting.S, there is a possible reinitialization of TEE due to improper (no CVSS, Android)
- [CVE-2021-39639](https://cve.now/CVE-2021-39639.md): In TBD of fvp.c, there is a possible way to glitch CPU behavior due to a missing permission check. (no CVSS, Android)
- [CVE-2021-1047](https://cve.now/CVE-2021-1047.md): In valid\_ipc\_dram\_addr of cm\_access\_control.c, there is a possible out of bounds read due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0995](https://cve.now/CVE-2021-0995.md): In registerSuggestionConnectionStatusListener of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, wit (no CVSS, Android)
- [CVE-2021-1004](https://cve.now/CVE-2021-1004.md): In getConfiguredNetworks of WifiServiceImpl.java, there is a possible way to determine whether an app is installed, without query permission (no CVSS, Android)
- [CVE-2021-0973](https://cve.now/CVE-2021-0973.md): In isFileUri of UriUtil.java, there is a possible way to bypass ignoring file://URI attachment due to improper handling of case sensitivity. (no CVSS, Android)
- [CVE-2021-1008](https://cve.now/CVE-2021-1008.md): In addSubInfo of SubscriptionController.java, there is a possible way to force the user to make a factory reset due to a logic error in the (no CVSS, Android)
- [CVE-2021-0999](https://cve.now/CVE-2021-0999.md): In the broadcast definition in AndroidManifest.xml, there is a possible way to set the A2DP bluetooth device connection state due to a missi (no CVSS, Android)
- [CVE-2021-1023](https://cve.now/CVE-2021-1023.md): In onCreate of RequestIgnoreBatteryOptimizations.java, there is a possible way to determine whether an app is installed, without query permi (no CVSS, Android)
- [CVE-2021-39642](https://cve.now/CVE-2021-39642.md): In synchronous\_process\_io\_entries of lwis\_ioctl.c, there is a possible out of bounds write due to a race condition. (no CVSS, Android)
- [CVE-2021-1046](https://cve.now/CVE-2021-1046.md): In lwis\_dpm\_update\_clock of lwis\_device\_dpm.c, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39638](https://cve.now/CVE-2021-39638.md): In periodic\_io\_work\_func of lwis\_periodic\_io.c, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-39643](https://cve.now/CVE-2021-39643.md): In ic\_startRetrieveEntryValue of acropora/app/identity/ic.c, there is a possible bypass of defense-in-depth due to missing validation of the (no CVSS, Android)
- [CVE-2021-1012](https://cve.now/CVE-2021-1012.md): In onResume of NotificationAccessDetails.java, there is a possible way to determine whether an app is installed, without query permissions, (no CVSS, Android)
- [CVE-2021-1020](https://cve.now/CVE-2021-1020.md): In snoozeNotification of NotificationListenerService.java, there is a possible way to disable notification for an arbitrary user due to impr (no CVSS, Android)
- [CVE-2021-1021](https://cve.now/CVE-2021-1021.md): In snoozeNotificationInt of NotificationManagerService.java, there is a possible way to disable notification for an arbitrary user due to im (no CVSS, Android)
- [CVE-2021-1019](https://cve.now/CVE-2021-1019.md): In snoozeNotification of NotificationListenerService.java, there is a possible permission confusion due to a misleading user consent dialog. (no CVSS, Android)
- [CVE-2021-1026](https://cve.now/CVE-2021-1026.md): In startRanging of RttServiceImpl.java, there is a possible way to determine whether an app is installed, without query permissions, due to (no CVSS, Android)
- [CVE-2021-1031](https://cve.now/CVE-2021-1031.md): In cancelNotificationsFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, wit (no CVSS, Android)
- [CVE-2021-1030](https://cve.now/CVE-2021-1030.md): In setNotificationsShownFromListener of NotificationManagerService.java, there is a possible way to determine whether an app is installed, w (no CVSS, Android)
- [CVE-2021-39657](https://cve.now/CVE-2021-39657.md): In ufshcd\_eh\_device\_reset\_handler of ufshcd.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-1002](https://cve.now/CVE-2021-1002.md): In WT\_Interpolate of eas\_wtengine.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39652](https://cve.now/CVE-2021-39652.md): In sec\_ts\_parsing\_cmds of (TBD), there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0989](https://cve.now/CVE-2021-0989.md): In hasManageOngoingCallsPermission of TelecomServiceImpl.java, there is a possible way to determine whether an app is installed, without que (no CVSS, Android)
- [CVE-2021-1018](https://cve.now/CVE-2021-1018.md): In adjustStreamVolume of AudioService.java, there is a possible way to determine whether an app is installed, without query permissions, due (no CVSS, Android)
- [CVE-2021-0993](https://cve.now/CVE-2021-0993.md): In getOffsetBeforeAfter of TextLine.java, there is a possible denial of service due to resource exhaustion. (no CVSS, Android)
- [CVE-2021-0994](https://cve.now/CVE-2021-0994.md): In requestRouteToHostAddress of ConnectivityService.java, there is a possible way to determine whether an app is installed, without query pe (no CVSS, Android)
- [CVE-2021-1025](https://cve.now/CVE-2021-1025.md): In hasNamedWallpaper of WallpaperManagerService.java, there is a possible way to determine whether an app is installed, without query permis (no CVSS, Android)
- [CVE-2021-39637](https://cve.now/CVE-2021-39637.md): In CreateDeviceInfo of trusty\_remote\_provisioning\_context.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-39653](https://cve.now/CVE-2021-39653.md): In (TBD) of (TBD), there is a possible way to boot with a hidden debug policy due to a missing warning to the user. (no CVSS, Android)
- [CVE-2021-0998](https://cve.now/CVE-2021-0998.md): In 'ih264e\_find\_bskip\_params()' of ih264e\_me.c, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-1034](https://cve.now/CVE-2021-1034.md): In getLine1NumberForDisplay of PhoneInterfaceManager.java, there is apossible way to determine whether an app is installed, without queryper (no CVSS, Android)
- [CVE-2021-1028](https://cve.now/CVE-2021-1028.md): In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-39651](https://cve.now/CVE-2021-39651.md): In TBD of TBD, there is a possible way to access PIN protected settings bypassing PIN confirmation due to a missing permission check. (no CVSS, Android)
- [CVE-2021-1029](https://cve.now/CVE-2021-1029.md): In setClientStateLocked of SurfaceFlinger.cpp, there is a possible out of bounds write due to a use after free. (no CVSS, Android)
- [CVE-2021-1027](https://cve.now/CVE-2021-1027.md): In setTransactionState of SurfaceFlinger, there is possible arbitrary code execution in a privileged process due to improper casting. (no CVSS, Android)
- [CVE-2021-39655](https://cve.now/CVE-2021-39655.md): Product: AndroidVersions: Android kernelAndroid ID: A-192641593References: N/A (no CVSS, Android)
- [CVE-2021-0978](https://cve.now/CVE-2021-0978.md): In getSerialForPackage of DeviceIdentifiersPolicyService.java, there is a possible way to determine whether an app is installed, without que (no CVSS, Android)
- [CVE-2021-0984](https://cve.now/CVE-2021-0984.md): In onNullBinding of ManagedServices.java, there is a possible permission bypass due to an incorrectly unbound service. (no CVSS, Android)
- [CVE-2021-0982](https://cve.now/CVE-2021-0982.md): In getOrganizationNameForUser of DevicePolicyManagerService.java, there is a possible organization name disclosure due to a missing permissi (no CVSS, Android)
- [CVE-2021-0986](https://cve.now/CVE-2021-0986.md): In hasGrantedPolicy of DevicePolicyManagerService.java, there is a possible information disclosure about the device owner, profile owner, or (no CVSS, Android)
- [CVE-2021-0983](https://cve.now/CVE-2021-0983.md): In createAdminSupportIntent of DevicePolicyManagerService.java, there is a possible disclosure of information about installed device/profile (no CVSS, Android)
- [CVE-2021-0981](https://cve.now/CVE-2021-0981.md): In enqueueNotificationInternal of NotificationManagerService.java, there is a possible way to run a foreground service without showing a not (no CVSS, Android)
- [CVE-2021-0988](https://cve.now/CVE-2021-0988.md): In getLaunchedFromUid and getLaunchedFromPackage of ActivityClientController.java, there is a possible way to determine whether an app is in (no CVSS, Android)
- [CVE-2021-0979](https://cve.now/CVE-2021-0979.md): In isRequestPinItemSupported of ShortcutService.java, there is a possible cross-user leak of packages in which the default launcher supports (no CVSS, Android)
- [CVE-2021-1024](https://cve.now/CVE-2021-1024.md): In onEventReceived of EventResultPersister.java, there is a possible intent redirection due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0987](https://cve.now/CVE-2021-0987.md): In getNeighboringCellInfo of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query per (no CVSS, Android)
- [CVE-2021-0997](https://cve.now/CVE-2021-0997.md): In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. (no CVSS, Android)
- [CVE-2021-1001](https://cve.now/CVE-2021-1001.md): In PVInitVideoEncoder of mp4enc\_api.cpp, there is a possible out of bounds read due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0985](https://cve.now/CVE-2021-0985.md): In onReceive of AlertReceiver.java, there is a possible way to dismiss system dialog due to a missing permission check. (no CVSS, Android)
- [CVE-2021-1009](https://cve.now/CVE-2021-1009.md): In setApplicationCategoryHint of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query (no CVSS, Android)
- [CVE-2021-1010](https://cve.now/CVE-2021-1010.md): In getSigningKeySet of PackageManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2021-1003](https://cve.now/CVE-2021-1003.md): In adjustStreamVolume of AudioService.java, there is a possible way for unprivileged app to change audio stream volume due to a confused dep (no CVSS, Android)
- [CVE-2021-1011](https://cve.now/CVE-2021-1011.md): In setPackageStoppedState of PackageManagerService.java, there is a missing permission check. (no CVSS, Android)
- [CVE-2021-1014](https://cve.now/CVE-2021-1014.md): In getNetworkTypeForSubscriber of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without quer (no CVSS, Android)
- [CVE-2021-1005](https://cve.now/CVE-2021-1005.md): In getDeviceIdWithFeature of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query per (no CVSS, Android)
- [CVE-2021-1015](https://cve.now/CVE-2021-1015.md): In getMeidForSlot of PhoneInterfaceManager.java, there is a possible way to determine whether an app is installed, without query permissions (no CVSS, Android)
- [CVE-2021-0990](https://cve.now/CVE-2021-0990.md): In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, (no CVSS, Android)
- [CVE-2021-1013](https://cve.now/CVE-2021-1013.md): In checkExistsAndEnforceCannotModifyImmutablyRestrictedPermission of PermissionManagerService.java, there is a possible way to determine whe (no CVSS, Android)
- [CVE-2021-1032](https://cve.now/CVE-2021-1032.md): In getMimeGroup of PackageManagerService.java, there is a possible way to determine whether an app is installed, without query permissions, (no CVSS, Android)
- [CVE-2021-0769](https://cve.now/CVE-2021-0769.md): In onCreate of AllowBindAppWidgetActivity.java, there is a possible bypass of user interaction requirements due to unclear UI. (no CVSS, Android)
- [CVE-2021-1006](https://cve.now/CVE-2021-1006.md): In several functions of DatabaseManager.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. (no CVSS, Android)
- [CVE-2021-1016](https://cve.now/CVE-2021-1016.md): In onCreate of UsbPermissionActivity.java, there is a possible way to grant an app access to USB without informed user consent due to a tapj (no CVSS, Android)
- [CVE-2021-0977](https://cve.now/CVE-2021-0977.md): In phNxpNHal\_DtaUpdate of phNxpNciHal\_dta.cc, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-1017](https://cve.now/CVE-2021-1017.md): In AdapterService and GattService definition of AndroidManifest.xml, there is a possible way to disable bluetooth connection due to a missin (no CVSS, Android)
- [CVE-2021-0991](https://cve.now/CVE-2021-0991.md): In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to lo (no CVSS, Android)
- [CVE-2021-0996](https://cve.now/CVE-2021-0996.md): In nfaHciCallback of HciEventManager.cpp, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-1022](https://cve.now/CVE-2021-1022.md): In btif\_in\_hf\_client\_generic\_evt of btif\_hf\_client.cc, there is a possible Bluetooth service crash due to a missing null check. (no CVSS, Android)
- [CVE-2021-0992](https://cve.now/CVE-2021-0992.md): In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overla (no CVSS, Android)
- [CVE-2021-39656](https://cve.now/CVE-2021-39656.md): In \_\_configfs\_open\_file of file.c, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2021-39649](https://cve.now/CVE-2021-39649.md): In regmap\_exit of regmap.c, there is a possible use-after-free due to improper locking. (no CVSS, Android)
- [CVE-2021-39650](https://cve.now/CVE-2021-39650.md): In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-1007](https://cve.now/CVE-2021-1007.md): In btu\_hcif\_process\_event of btu\_hcif.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39648](https://cve.now/CVE-2021-39648.md): In gadget\_dev\_desc\_UDC\_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. (no CVSS, Android)
- [CVE-2021-39640](https://cve.now/CVE-2021-39640.md): In \_\_dwc3\_gadget\_ep0\_queue of ep0.c, there is a possible out of bounds write due to improper locking. (no CVSS, Android)
- [CVE-2021-39641](https://cve.now/CVE-2021-39641.md): Product: AndroidVersions: Android kernelAndroid ID: A-126949257References: N/A (no CVSS, Android)
- [CVE-2021-39636](https://cve.now/CVE-2021-39636.md): In do\_ipt\_get\_ctl and do\_ipt\_set\_ctl of ip\_tables.c, there is a possible way to leak kernel information due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0675](https://cve.now/CVE-2021-0675.md): In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT…)
- [CVE-2021-0904](https://cve.now/CVE-2021-0904.md): In SRAMROM, there is a possible permission bypass due to an insecure permission setting. (no CVSS, MT6771, MT8183, MT8385, MT8788)
- [CVE-2021-0958](https://cve.now/CVE-2021-0958.md): In update of km\_compat.cpp, there is a possible loss of potentially sensitive data due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-0969](https://cve.now/CVE-2021-0969.md): In getTitle of AccessPoint.java, there is a possible unhandled exception due to a missing null check. (no CVSS, Android)
- [CVE-2021-0963](https://cve.now/CVE-2021-0963.md): In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tapjacking/overlay attac (no CVSS, Android)
- [CVE-2021-0967](https://cve.now/CVE-2021-0967.md): In vorbis\_book\_decodev\_set of codebook.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0966](https://cve.now/CVE-2021-0966.md): In code generated by BuildParcelFields of generate\_cpp.cpp, there is a possible way for a crafted parcelable to reveal uninitialized memory (no CVSS, Android)
- [CVE-2021-0968](https://cve.now/CVE-2021-0968.md): In osi\_malloc and osi\_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0961](https://cve.now/CVE-2021-0961.md): In quota\_proc\_write of xt\_quota2.c, there is a possible way to read kernel memory due to uninitialized data. (no CVSS, Android)
- [CVE-2021-0970](https://cve.now/CVE-2021-0970.md): In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. (no CVSS, Android)
- [CVE-2021-0952](https://cve.now/CVE-2021-0952.md): In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2021-0965](https://cve.now/CVE-2021-0965.md): In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a missing permission che (no CVSS, Android)
- [CVE-2021-0955](https://cve.now/CVE-2021-0955.md): In pf\_write\_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. (no CVSS, Android)
- [CVE-2021-0964](https://cve.now/CVE-2021-0964.md): In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. (no CVSS, Android)
- [CVE-2021-0956](https://cve.now/CVE-2021-0956.md): In NfcTag::discoverTechnologies (activation) of NfcTag.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0953](https://cve.now/CVE-2021-0953.md): In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookmarks without permissio (no CVSS, Android)
- [CVE-2021-0971](https://cve.now/CVE-2021-0971.md): In MPEG4Source::read of MPEG4Extractor.cpp, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0704](https://cve.now/CVE-2021-0704.md): In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible way to retrieve accoun (no CVSS, Android)
- [CVE-2021-0954](https://cve.now/CVE-2021-0954.md): In ResolverActivity, there is a possible user interaction bypass due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-1044](https://cve.now/CVE-2021-1044.md): In eicOpsDecryptAes128Gcm of acropora/app/identity/identity\_support.c, there is a possible out of bounds write due to a missing bounds check (no CVSS, Android)
- [CVE-2021-1045](https://cve.now/CVE-2021-1045.md): Product: AndroidVersions: Android kernelAndroid ID: A-195580473References: N/A (no CVSS, Android)
- [CVE-2021-1043](https://cve.now/CVE-2021-1043.md): In TBD of TBD, there is a possible downgrade attack due to under utilized anti-rollback protections. (no CVSS, Android)
- [CVE-2021-1042](https://cve.now/CVE-2021-1042.md): In dsi\_panel\_debugfs\_read\_cmdset of dsi\_panel.c, there is a possible disclosure of freed kernel heap memory due to a use after free. (no CVSS, Android)
- [CVE-2021-1041](https://cve.now/CVE-2021-1041.md): In (TBD) of (TBD), there is a possible out of bounds read due to memory corruption. (no CVSS, Android)
- [CVE-2021-1048](https://cve.now/CVE-2021-1048.md): In ep\_loop\_check\_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, KEV, Android)
- [CVE-2021-0799](https://cve.now/CVE-2021-0799.md): In ActivityThread.java, there is a possible way to collide the content provider's authorities. (no CVSS, Android)
- [CVE-2021-0918](https://cve.now/CVE-2021-0918.md): In gatt\_process\_notification of gatt\_cl.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0919](https://cve.now/CVE-2021-0919.md): In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. (no CVSS, Android)
- [CVE-2021-0920](https://cve.now/CVE-2021-0920.md): In unix\_scm\_to\_skb of af\_unix.c, there is a possible use after free bug due to a race condition. (CVSS 6.4, KEV, Android)
- [CVE-2021-0921](https://cve.now/CVE-2021-0921.md): In ParsingPackageImpl of ParsingPackageImpl.java, there is a possible parcel serialization/deserialization mismatch due to improper input va (no CVSS, Android)
- [CVE-2021-0922](https://cve.now/CVE-2021-0922.md): In enforceCrossUserOrProfilePermission of PackageManagerService.java, there is a possible bypass of INTERACT\_ACROSS\_PROFILES permission due (no CVSS, Android)
- [CVE-2021-0923](https://cve.now/CVE-2021-0923.md): In createOrUpdate of Permission.java, there is a possible way to gain internal permissions due to a missing permission check. (no CVSS, Android)
- [CVE-2021-0924](https://cve.now/CVE-2021-0924.md): In xhci\_vendor\_get\_ops of xhci.c, there is a possible out of bounds read due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0925](https://cve.now/CVE-2021-0925.md): In rw\_t4t\_sm\_detect\_ndef of rw\_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0649](https://cve.now/CVE-2021-0649.md): In stopVpnProfile of Vpn.java, there is a possible VPN profile reset due to a permissions bypass. (no CVSS, Android)
- [CVE-2021-0650](https://cve.now/CVE-2021-0650.md): In WT\_InterpolateNoLoop of eas\_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-0926](https://cve.now/CVE-2021-0926.md): In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a missing permission chec (no CVSS, Android)
- [CVE-2021-0927](https://cve.now/CVE-2021-0927.md): In requestChannelBrowsable of TvInputManagerService.java, there is a possible permission bypass due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-0928](https://cve.now/CVE-2021-0928.md): In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input val (no CVSS, Android)
- [CVE-2021-0929](https://cve.now/CVE-2021-0929.md): In ion\_dma\_buf\_end\_cpu\_access and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. (no CVSS, Android)
- [CVE-2021-0930](https://cve.now/CVE-2021-0930.md): In phNxpNciHal\_process\_ext\_rsp of phNxpNciHal\_ext.cc, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-0931](https://cve.now/CVE-2021-0931.md): In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing data filtering. (no CVSS, Android)
- [CVE-2021-0889](https://cve.now/CVE-2021-0889.md): In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. (no CVSS, Android)
- [CVE-2021-0653](https://cve.now/CVE-2021-0653.md): In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier due to a missing perm (no CVSS, Android)
- [CVE-2021-0932](https://cve.now/CVE-2021-0932.md): In showNotification of NavigationModeController.java, there is a possible confused deputy due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-0933](https://cve.now/CVE-2021-0933.md): In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to interfere with a consent (no CVSS, Android)
- [CVE-2021-0434](https://cve.now/CVE-2021-0434.md): In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth device to acquire permis (no CVSS, Android)
- [CVE-2021-43935](https://cve.now/CVE-2021-43935.md): ICSMA-21-343-01 Hillrom Welch Allyn Cardio Products (CVSS 8.1, Hillrom Welch Allyn Q-Stress Cardiac Stress Testing Syst… +5)
- [CVE-2021-42216](https://cve.now/CVE-2021-42216.md): A Broken or Risky Cryptographic Algorithm exists in AnonAddy 0.8.5 via VerificationController.php. (no CVSS)
- [CVE-2021-4119](https://cve.now/CVE-2021-4119.md): Improper Access Control in bookstackapp/bookstack (CVSS 5.3, bookstackapp/bookstack · ssddanbrown/bookstack)
- [CVE-2021-29847](https://cve.now/CVE-2021-29847.md): BMC firmware (IBM Power System S821LC Server (8001-12C) OP825.50) configuration changed to allow an authenticated user to open an insecure c (CVSS 5.3, IBM Power System S821LC Server)
- [CVE-2021-27859](https://cve.now/CVE-2021-27859.md): Missing authorization vulnerability in FatPipe software (CVSS 8.8, FatPipe WARP · FatPipe IPVPN +1)
- [CVE-2021-27858](https://cve.now/CVE-2021-27858.md): Missing authorization vulnerability in FatPipe software (CVSS 5.3, FatPipe WARP · FatPipe IPVPN +1)
- [CVE-2021-27857](https://cve.now/CVE-2021-27857.md): FatPipe software allows unauthenticated configuration download (CVSS 7.5, FatPipe WARP · FatPipe IPVPN +1)
- [CVE-2021-27856](https://cve.now/CVE-2021-27856.md): FatPipe software administrative account with no password (CVSS 9.8, FatPipe WARP · FatPipe IPVPN +1)
- [CVE-2021-27855](https://cve.now/CVE-2021-27855.md): FatPipe software allows privilege escalation (CVSS 8.8, FatPipe WARP · FatPipe IPVPN +1)
- [CVE-2021-44655](https://cve.now/CVE-2021-44655.md): Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. (no CVSS)
- [CVE-2021-44653](https://cve.now/CVE-2021-44653.md): Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. (no CVSS)
- [CVE-2021-43675](https://cve.now/CVE-2021-43675.md): Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. (no CVSS)
- [CVE-2021-4117](https://cve.now/CVE-2021-4117.md): Business Logic Errors in yetiforcecompany/yetiforcecrm (CVSS 7.7, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-43518](https://cve.now/CVE-2021-43518.md): Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2021-44657](https://cve.now/CVE-2021-44657.md): In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands (no CVSS)
- [CVE-2021-43907](https://cve.now/CVE-2021-43907.md): Visual Studio Code WSL Extension Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Visual Studio Code WSL Extension)
- [CVE-2021-43908](https://cve.now/CVE-2021-43908.md): Visual Studio Code Spoofing Vulnerability (CVSS 4.3, Microsoft Visual Studio Code)
- [CVE-2021-43905](https://cve.now/CVE-2021-43905.md): Microsoft Office app Remote Code Execution Vulnerability (CVSS 9.6, Microsoft Office app)
- [CVE-2021-43899](https://cve.now/CVE-2021-43899.md): Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability (CVSS 9.8, Microsoft 4K Wireless Display Adapter)
- [CVE-2021-43896](https://cve.now/CVE-2021-43896.md): Microsoft PowerShell Spoofing Vulnerability (CVSS 5.5, Microsoft CBL Mariner 2.0 x64 · Microsoft CBL Mariner 2.… +3)
- [CVE-2021-43892](https://cve.now/CVE-2021-43892.md): Microsoft BizTalk ESB Toolkit Spoofing Vulnerability (CVSS 7.4, Microsoft BizTalk ESB Toolkit)
- [CVE-2021-43893](https://cve.now/CVE-2021-43893.md): Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-43891](https://cve.now/CVE-2021-43891.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2021-43889](https://cve.now/CVE-2021-43889.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Defender for IoT)
- [CVE-2021-43890](https://cve.now/CVE-2021-43890.md): Windows AppX Installer Spoofing Vulnerability (CVSS 7.1, KEV, Microsoft App Installer)
- [CVE-2021-43888](https://cve.now/CVE-2021-43888.md): Microsoft Defender for IoT Information Disclosure Vulnerability (CVSS 7.5, Microsoft Defender for IoT)
- [CVE-2021-43883](https://cve.now/CVE-2021-43883.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43880](https://cve.now/CVE-2021-43880.md): Windows Mobile Device Management Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-43882](https://cve.now/CVE-2021-43882.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Defender for IoT)
- [CVE-2021-43877](https://cve.now/CVE-2021-43877.md): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Visual Studio · Microsoft ASP.NET Core)
- [CVE-2021-43875](https://cve.now/CVE-2021-43875.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2021-43256](https://cve.now/CVE-2021-43256.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office Online Server · Microsoft Office +2)
- [CVE-2021-43248](https://cve.now/CVE-2021-43248.md): Windows Digital Media Receiver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43255](https://cve.now/CVE-2021-43255.md): Microsoft Office Trust Center Spoofing Vulnerability (CVSS 5.5, Microsoft Office LTSC · Microsoft Office +1)
- [CVE-2021-43247](https://cve.now/CVE-2021-43247.md): Windows TCP/IP Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43246](https://cve.now/CVE-2021-43246.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.6, Microsoft Windows)
- [CVE-2021-43244](https://cve.now/CVE-2021-43244.md): Windows Kernel Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-43245](https://cve.now/CVE-2021-43245.md): Windows Digital TV Tuner Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43243](https://cve.now/CVE-2021-43243.md): VP9 Video Extensions Information Disclosure Vulnerability (CVSS 5.5, Microsoft VP9 Video Extensions)
- [CVE-2021-43242](https://cve.now/CVE-2021-43242.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.6, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-43239](https://cve.now/CVE-2021-43239.md): Windows Recovery Environment Agent Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2021-43240](https://cve.now/CVE-2021-43240.md): NTFS Set Short Name Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43238](https://cve.now/CVE-2021-43238.md): Windows Remote Access Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43237](https://cve.now/CVE-2021-43237.md): Windows Setup Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43235](https://cve.now/CVE-2021-43235.md): Storage Spaces Controller Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-43236](https://cve.now/CVE-2021-43236.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-43234](https://cve.now/CVE-2021-43234.md): Windows Fax Service Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43233](https://cve.now/CVE-2021-43233.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-43231](https://cve.now/CVE-2021-43231.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43232](https://cve.now/CVE-2021-43232.md): Windows Event Tracing Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43230](https://cve.now/CVE-2021-43230.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43229](https://cve.now/CVE-2021-43229.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43228](https://cve.now/CVE-2021-43228.md): SymCrypt Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-43226](https://cve.now/CVE-2021-43226.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2021-43227](https://cve.now/CVE-2021-43227.md): Storage Spaces Controller Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-43225](https://cve.now/CVE-2021-43225.md): Bot Framework SDK Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Bot Framework SDK for .NET Framework)
- [CVE-2021-43224](https://cve.now/CVE-2021-43224.md): Windows Common Log File System Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2021-43222](https://cve.now/CVE-2021-43222.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2021-43223](https://cve.now/CVE-2021-43223.md): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-43219](https://cve.now/CVE-2021-43219.md): DirectX Graphics Kernel File Denial of Service Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2021-43217](https://cve.now/CVE-2021-43217.md): Windows Encrypting File System (EFS) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2021-43216](https://cve.now/CVE-2021-43216.md): Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2021-43215](https://cve.now/CVE-2021-43215.md): iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution (CVSS 9.8, Microsoft Windows)
- [CVE-2021-43214](https://cve.now/CVE-2021-43214.md): Web Media Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension)
- [CVE-2021-43207](https://cve.now/CVE-2021-43207.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-42320](https://cve.now/CVE-2021-42320.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.0, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2021-42315](https://cve.now/CVE-2021-42315.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for IoT)
- [CVE-2021-42314](https://cve.now/CVE-2021-42314.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for IoT)
- [CVE-2021-42313](https://cve.now/CVE-2021-42313.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Defender for IoT)
- [CVE-2021-42312](https://cve.now/CVE-2021-42312.md): Microsoft Defender for IoT Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Defender for IoT)
- [CVE-2021-42310](https://cve.now/CVE-2021-42310.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Defender for IoT)
- [CVE-2021-42311](https://cve.now/CVE-2021-42311.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Defender for IoT)
- [CVE-2021-42309](https://cve.now/CVE-2021-42309.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-42295](https://cve.now/CVE-2021-42295.md): Visual Basic for Applications Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2021-42293](https://cve.now/CVE-2021-42293.md): Microsoft Jet Red Database Engine and Access Connectivity Engine Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Office LTSC · Microsoft Office +1)
- [CVE-2021-42294](https://cve.now/CVE-2021-42294.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2021-41365](https://cve.now/CVE-2021-41365.md): Microsoft Defender for IoT Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Defender for IoT)
- [CVE-2021-41360](https://cve.now/CVE-2021-41360.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-40453](https://cve.now/CVE-2021-40453.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-41333](https://cve.now/CVE-2021-41333.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-40452](https://cve.now/CVE-2021-40452.md): HEVC Video Extensions Remote Code Execution Vulnerability (CVSS 7.8, Microsoft HEVC Video Extensions)
- [CVE-2021-40441](https://cve.now/CVE-2021-40441.md): Windows Media Center Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2021-4116](https://cve.now/CVE-2021-4116.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 6.6, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-20330](https://cve.now/CVE-2021-20330.md): Specific replication command with malformed oplog entries can crash secondaries (CVSS 6.5, MongoDB Server)
- [CVE-2021-4111](https://cve.now/CVE-2021-4111.md): Business Logic Errors in yetiforcecompany/yetiforcecrm (CVSS 7.3, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-45043](https://cve.now/CVE-2021-45043.md): HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s\_Language parameter. (no CVSS)
- [CVE-2019-19138](https://cve.now/CVE-2019-19138.md): Ivanti Workspace Control before 10.4.50.0 allows attackers to degrade integrity. (no CVSS)
- [CVE-2020-23545](https://cve.now/CVE-2020-23545.md): IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ReadXPM\_W+0x0000000000000531. (no CVSS)
- [CVE-2021-26787](https://cve.now/CVE-2021-26787.md): A cross site scripting (XSS) vulnerability in Genesys Workforce Management 8.5.214.20 can occur (during record deletion) via the Time-off pa (no CVSS)
- [CVE-2021-36450](https://cve.now/CVE-2021-36450.md): Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my\_notifications NEWUINAV parameter. (no CVSS)
- [CVE-2021-38701](https://cve.now/CVE-2021-38701.md): Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. (no CVSS)
- [CVE-2021-40170](https://cve.now/CVE-2021-40170.md): An RF replay attack vulnerability in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG\_U-ITR-F1-BD\_BL.A30.20181117, allows an (no CVSS)
- [CVE-2021-40171](https://cve.now/CVE-2021-40171.md): The absence of notifications regarding an ongoing RF jamming attack in the SecuritasHome home alarm system, version HPGW-G 0.0.2.23F BG\_U-IT (no CVSS)
- [CVE-2021-40826](https://cve.now/CVE-2021-40826.md): Clementine Music Player through 1.3.1 is vulnerable to a User Mode Write Access Violation, affecting the MP3 file parsing functionality at c (no CVSS)
- [CVE-2021-40827](https://cve.now/CVE-2021-40827.md): Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move, affecting (no CVSS)
- [CVE-2021-41560](https://cve.now/CVE-2021-41560.md): OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php. (no CVSS)
- [CVE-2021-42220](https://cve.now/CVE-2021-42220.md): A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. (no CVSS, dolibarr/dolibarr)
- [CVE-2021-42945](https://cve.now/CVE-2021-42945.md): A SQL Injection vulnerability exists in ZZCMS 2021 via the askbigclassid parameter in /admin/ask.php. (no CVSS)
- [CVE-2021-43326](https://cve.now/CVE-2021-43326.md): Automox Agent before 32 on Windows incorrectly sets permissions on a temporary directory. (no CVSS)
- [CVE-2021-43325](https://cve.now/CVE-2021-43325.md): Automox Agent 33 on Windows incorrectly sets permissions on a temporary directory. (no CVSS)
- [CVE-2021-41557](https://cve.now/CVE-2021-41557.md): Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). (no CVSS)
- [CVE-2021-41844](https://cve.now/CVE-2021-41844.md): Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data. (no CVSS)
- [CVE-2021-41871](https://cve.now/CVE-2021-41871.md): An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. (no CVSS)
- [CVE-2021-41870](https://cve.now/CVE-2021-41870.md): An issue was discovered in the firmware update form in Socomec REMOTE VIEW PRO 2.0.41.4. (no CVSS)
- [CVE-2021-4110](https://cve.now/CVE-2021-4110.md): NULL Pointer Dereference in mruby/mruby (CVSS 9.1, mruby/mruby)
- [CVE-2021-43113](https://cve.now/CVE-2021-43113.md): iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs ( (CVSS 9.8, com.itextpdf:itext7-core · com.itextpdf:itextpdf)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.