CVEs published December 16, 2021
42 CVEs were published on December 16, 2021: 0 critical, 7 high.
- Published
- 42
- Critical
- 0
- High
- 7
- Medium
- 7
- Low
- 1
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- io.atomix:atomix
- 7
- galette
- 3
- Bitdefender GravityZone
- 2
- F-Secure Mobile Security
- 1
- Fortinet FortiClientEMS, FortiClientWindows, FortiClientLin…
- 1
- livehelperchat/livehelperchat · remdex/livehelperchat
- 1
- meetecho/janus-gateway
- 1
- nextjs-auth0 · @auth0/nextjs-auth0
- 1
- peopledoc vault-cli · vault-cli
- 1
- QOS.ch logback · ch.qos.logback:logback-core
- 1
High 7
- CVE-2021-43837Template injection in vault-clipeopledoc vault-cli · vault-cli
- CVE-2021-41028A combination of a use of hard-coded cryptographic key vulnerability [CWE-321] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an impFortinet FortiClientEMS, FortiClientWindows, FortiClientLin…
- CVE-2021-41261Stored Cross-site Scripting in Galettegalette
- CVE-2021-41262SQL Injection in Galettegalette
- CVE-2021-41260Missing CSRF checks in Galettegalette
- CVE-2021-3960Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146)Bitdefender GravityZone
- CVE-2021-4124Cross-site Scripting (XSS) - Stored in meetecho/janus-gatewaymeetecho/janus-gateway
Medium, low and unrated 35
- CVE-2021-3179GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass.
- CVE-2020-35215An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitiio.atomix:atomix
- CVE-2020-35216An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.io.atomix:atomix
- CVE-2020-35214An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.io.atomix:atomix
- CVE-2020-35213An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.io.atomix:atomix
- CVE-2020-35211An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable termio.atomix:atomix
- CVE-2020-35210A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessiio.atomix:atomix
- CVE-2020-35209An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.io.atomix:atomix
- CVE-2021-26800Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1
- CVE-2021-44317In Bus Pass Management System v1.0, parameters 'pagedes' and `About Us` are affected with a Stored Cross-site scripting vulnerability.
- CVE-2021-44315In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive f
- CVE-2021-43812Open redirect in nextjs-auth0nextjs-auth0 · @auth0/nextjs-auth0
- CVE-2021-38244A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignifi
- CVE-2021-37262JFinal_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service.
- CVE-2021-41962Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in
- CVE-2021-42912FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability.
- CVE-2021-3959Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145)Bitdefender GravityZone
- CVE-2021-40835URL Address Bar Spoofing in F-Secure SAFE Browser for iOSF-Secure Mobile Security
- CVE-2021-4123Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-4121Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrmyetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm
- CVE-2021-45102An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2.
- CVE-2021-45101An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2.
- CVE-2021-45100The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has b
- CVE-2021-45099The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requ
- CVE-2021-45098An issue was discovered in Suricata before 6.0.4.
- CVE-2021-45095pep_sock_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak.
- CVE-2021-45092Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete
- CVE-2021-44023A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attackTrend Micro Security
- CVE-2021-45086XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name val
- CVE-2021-45087XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by
- CVE-2021-45088XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
- CVE-2021-45085XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a
- CVE-2021-42550RCE from attacker with configuration edit priviledges through JNDI lookupQOS.ch logback · ch.qos.logback:logback-core
- CVE-2021-45096KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730
- CVE-2021-45097KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without