# CVEs published 2021-12-16

42 CVEs were published on December 16, 2021: 0 critical, 7 high. Days are UTC.

- [CVE-2021-3179](https://cve.now/CVE-2021-3179.md): GGLocker iOS application, contains an insecure data storage of the password hash value which results in an authentication bypass. (no CVSS)
- [CVE-2020-35215](https://cve.now/CVE-2020-35215.md): An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primiti (no CVSS, io.atomix:atomix)
- [CVE-2020-35216](https://cve.now/CVE-2020-35216.md): An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages. (no CVSS, io.atomix:atomix)
- [CVE-2020-35214](https://cve.now/CVE-2020-35214.md): An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations. (no CVSS, io.atomix:atomix)
- [CVE-2020-35213](https://cve.now/CVE-2020-35213.md): An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node. (no CVSS, io.atomix:atomix)
- [CVE-2020-35211](https://cve.now/CVE-2020-35211.md): An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable term (no CVSS, io.atomix:atomix)
- [CVE-2020-35210](https://cve.now/CVE-2020-35210.md): A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessi (no CVSS, io.atomix:atomix)
- [CVE-2020-35209](https://cve.now/CVE-2020-35209.md): An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information. (no CVSS, io.atomix:atomix)
- [CVE-2021-26800](https://cve.now/CVE-2021-26800.md): Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1 (no CVSS)
- [CVE-2021-43837](https://cve.now/CVE-2021-43837.md): Template injection in vault-cli (CVSS 8.4, peopledoc vault-cli · vault-cli)
- [CVE-2021-44317](https://cve.now/CVE-2021-44317.md): In Bus Pass Management System v1.0, parameters 'pagedes' and \`About Us\` are affected with a Stored Cross-site scripting vulnerability. (no CVSS)
- [CVE-2021-44315](https://cve.now/CVE-2021-44315.md): In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive f (no CVSS)
- [CVE-2021-43812](https://cve.now/CVE-2021-43812.md): Open redirect in nextjs-auth0 (CVSS 6.4, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2021-38244](https://cve.now/CVE-2021-38244.md): A regular expression denial of service (ReDoS) vulnerability exits in cbioportal 3.6.21 and older via a POST request to /ProteinArraySignifi (no CVSS)
- [CVE-2021-41028](https://cve.now/CVE-2021-41028.md): A combination of a use of hard-coded cryptographic key vulnerability \[CWE-321\] in FortiClientEMS 7.0.1 and below, 6.4.6 and below and an imp (CVSS 8.2, Fortinet FortiClientEMS, FortiClientWindows, FortiClientLin…)
- [CVE-2021-41261](https://cve.now/CVE-2021-41261.md): Stored Cross-site Scripting in Galette (CVSS 8.1, galette)
- [CVE-2021-41262](https://cve.now/CVE-2021-41262.md): SQL Injection in Galette (CVSS 8.8, galette)
- [CVE-2021-41260](https://cve.now/CVE-2021-41260.md): Missing CSRF checks in Galette (CVSS 8.2, galette)
- [CVE-2021-37262](https://cve.now/CVE-2021-37262.md): JFinal\_cms 5.1.0 is vulnerable to regex injection that may lead to Denial of Service. (no CVSS)
- [CVE-2021-41962](https://cve.now/CVE-2021-41962.md): Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Owner fullname parameter in (no CVSS)
- [CVE-2021-42912](https://cve.now/CVE-2021-42912.md): FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. (no CVSS)
- [CVE-2021-3960](https://cve.now/CVE-2021-3960.md): Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-10146) (CVSS 7.1, Bitdefender GravityZone)
- [CVE-2021-3959](https://cve.now/CVE-2021-3959.md): Server-Side Request Forgery in Bitdefender GravityZone Update Server in Relay Mode (VA-10145) (CVSS 6.8, Bitdefender GravityZone)
- [CVE-2021-4124](https://cve.now/CVE-2021-4124.md): Cross-site Scripting (XSS) - Stored in meetecho/janus-gateway (CVSS 8.1, meetecho/janus-gateway)
- [CVE-2021-40835](https://cve.now/CVE-2021-40835.md): URL Address Bar Spoofing in F-Secure SAFE Browser for iOS (CVSS 4.6, F-Secure Mobile Security)
- [CVE-2021-4123](https://cve.now/CVE-2021-4123.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 6.5, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-4121](https://cve.now/CVE-2021-4121.md): Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm (CVSS 6.4, yetiforcecompany/yetiforcecrm · yetiforce/yetiforce-crm)
- [CVE-2021-45102](https://cve.now/CVE-2021-45102.md): An issue was discovered in HTCondor 9.0.x before 9.0.4 and 9.1.x before 9.1.2. (no CVSS)
- [CVE-2021-45101](https://cve.now/CVE-2021-45101.md): An issue was discovered in HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. (no CVSS)
- [CVE-2021-45100](https://cve.now/CVE-2021-45100.md): The ksmbd server through 3.4.2, as used in the Linux kernel through 5.15.8, sometimes communicates in cleartext even though encryption has b (no CVSS)
- [CVE-2021-45099](https://cve.now/CVE-2021-45099.md): The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requ (no CVSS)
- [CVE-2021-45098](https://cve.now/CVE-2021-45098.md): An issue was discovered in Suricata before 6.0.4. (no CVSS)
- [CVE-2021-45095](https://cve.now/CVE-2021-45095.md): pep\_sock\_accept in net/phonet/pep.c in the Linux kernel through 5.15.8 has a refcount leak. (no CVSS)
- [CVE-2021-45092](https://cve.now/CVE-2021-45092.md): Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath paramete (no CVSS)
- [CVE-2021-44023](https://cve.now/CVE-2021-44023.md): A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attack (no CVSS, Trend Micro Security)
- [CVE-2021-45086](https://cve.now/CVE-2021-45086.md): XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested\_filename is used as the pdf\_name val (no CVSS)
- [CVE-2021-45087](https://cve.now/CVE-2021-45087.md): XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by (no CVSS)
- [CVE-2021-45088](https://cve.now/CVE-2021-45088.md): XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. (no CVSS)
- [CVE-2021-45085](https://cve.now/CVE-2021-45085.md): XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a (no CVSS)
- [CVE-2021-42550](https://cve.now/CVE-2021-42550.md): RCE from attacker with configuration edit priviledges through JNDI lookup (CVSS 6.6, QOS.ch logback · ch.qos.logback:logback-core)
- [CVE-2021-45096](https://cve.now/CVE-2021-45096.md): KNIME Analytics Platform before 4.5.0 is vulnerable to XXE (external XML entity injection) via a crafted workflow file (.knwf), aka AP-17730 (CVSS 4.7)
- [CVE-2021-45097](https://cve.now/CVE-2021-45097.md): KNIME Server before 4.12.6 and 4.13.x before 4.13.4 (when installed in unattended mode) keeps the administrator's password in a file without (CVSS 2.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.