# CVEs published 2021-12-17

65 CVEs were published on December 17, 2021: 3 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-41500](https://cve.now/CVE-2021-41500.md): Incomplete string comparison vulnerability exits in cvxopt.org cvxop \<= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt (no CVSS, cvxopt)
- [CVE-2021-41499](https://cve.now/CVE-2021-41499.md): Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo \< 1.03 in the Server\_debug function, which allows remote attackers to cond (no CVSS, pyo)
- [CVE-2021-41498](https://cve.now/CVE-2021-41498.md): Buffer overflow in ajaxsoundstudio.com Pyo &lt and 1.03 in the Server\_jack\_init function. (no CVSS, pyo)
- [CVE-2021-41497](https://cve.now/CVE-2021-41497.md): Null pointer reference in CMS\_Conservative\_increment\_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct Den (no CVSS, bounter)
- [CVE-2021-23803](https://cve.now/CVE-2021-23803.md): Access Control Bypass (CVSS 9.8, latte/latte)
- [CVE-2021-23450](https://cve.now/CVE-2021-23450.md): Prototype Pollution (CVSS 7.5, dojo)
- [CVE-2021-23797](https://cve.now/CVE-2021-23797.md): Directory Traversal (CVSS 7.5, http-server-node)
- [CVE-2021-23814](https://cve.now/CVE-2021-23814.md): This affects versions of the package unisharp/laravel-filemanager before 2.6.2. (CVSS 6.7, unisharp/laravel-filemanager)
- [CVE-2021-41496](https://cve.now/CVE-2021-41496.md): Buffer overflow in the array\_from\_pyobj function of fortranobject.c in NumPy \< 1.19, which allows attackers to conduct a Denial of Service a (no CVSS, numpy)
- [CVE-2021-41495](https://cve.now/CVE-2021-41495.md): Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray\_DescrNew function due to missing return-val (no CVSS, numpy)
- [CVE-2021-34141](https://cve.now/CVE-2021-34141.md): An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by (no CVSS, numpy)
- [CVE-2021-33430](https://cve.now/CVE-2021-33430.md): A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray\_NewFromDescr\_int function of ctors.c when specifying arrays of large di (no CVSS, numpy)
- [CVE-2021-43838](https://cve.now/CVE-2021-43838.md): Regular Expression Denial of Service (ReDoS) in jsx-slack (CVSS 5.3, yhatt jsx-slack · jsx-slack)
- [CVE-2021-43840](https://cve.now/CVE-2021-43840.md): Path traversal in message\_bus (CVSS 4.4, discourse message\_bus · message\_bus)
- [CVE-2021-38883](https://cve.now/CVE-2021-38883.md): IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripti (CVSS 5.4, IBM Business Process Manager · IBM Business Automation Work…)
- [CVE-2020-18081](https://cve.now/CVE-2020-18081.md): The checkuser function of SEMCMS 3.8 was discovered to contain a vulnerability which allows attackers to obtain the password in plaintext th (no CVSS)
- [CVE-2020-18078](https://cve.now/CVE-2020-18078.md): A vulnerability in /include/web\_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password. (no CVSS)
- [CVE-2020-18077](https://cve.now/CVE-2020-18077.md): A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS). (no CVSS)
- [CVE-2020-8968](https://cve.now/CVE-2020-8968.md): Parallels Remote Application Server credentials management errors (CVSS 7.1, Parallels Remote Application Server)
- [CVE-2021-40853](https://cve.now/CVE-2021-40853.md): TCMAN GIM missing authorization vulnerability (CVSS 7.2, TCMAN GIM)
- [CVE-2021-40852](https://cve.now/CVE-2021-40852.md): TCMAN GIM open redirect vulnerability (CVSS 6.1, TCMAN GIM)
- [CVE-2021-40851](https://cve.now/CVE-2021-40851.md): TCMAN GIM SQL injection vulnerability (CVSS 7.5, TCMAN GIM)
- [CVE-2021-40850](https://cve.now/CVE-2021-40850.md): TCMAN GIM SQL injection vulnerability (CVSS 10.0, TCMAN GIM)
- [CVE-2021-37863](https://cve.now/CVE-2021-37863.md): Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a c (CVSS 3.5, Mattermost)
- [CVE-2021-37862](https://cve.now/CVE-2021-37862.md): Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers to trick users into (CVSS 3.7, Mattermost)
- [CVE-2021-20607](https://cve.now/CVE-2021-20607.md): Integer Underflow vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2 (no CVSS, Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT…)
- [CVE-2021-20606](https://cve.now/CVE-2021-20606.md): Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions (no CVSS, Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT…)
- [CVE-2021-20608](https://cve.now/CVE-2021-20608.md): Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote (no CVSS, GX Works2)
- [CVE-2021-22054](https://cve.now/CVE-2021-22054.md): VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5 (CVSS 7.5, KEV, VMware Workspace ONE UEM console)
- [CVE-2021-0674](https://cve.now/CVE-2021-0674.md): In alac decoder, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6570, MT6580, MT6735, MT6737, MT6739, MT6750, MT6750S, MT…)
- [CVE-2021-0673](https://cve.now/CVE-2021-0673.md): In Audio Aurisys HAL, there is a possible permission bypass due to a missing permission check. (no CVSS, MT6779, MT6781, MT6785, MT6853, MT6853T, MT6873, MT6875, MT…)
- [CVE-2021-0903](https://cve.now/CVE-2021-0903.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0902](https://cve.now/CVE-2021-0902.md): In apusys, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0901](https://cve.now/CVE-2021-0901.md): In apusys, there is a possible memory corruption due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0899](https://cve.now/CVE-2021-0899.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0900](https://cve.now/CVE-2021-0900.md): In apusys, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0898](https://cve.now/CVE-2021-0898.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0896](https://cve.now/CVE-2021-0896.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0897](https://cve.now/CVE-2021-0897.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0895](https://cve.now/CVE-2021-0895.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0894](https://cve.now/CVE-2021-0894.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0679](https://cve.now/CVE-2021-0679.md): In apusys, there is a possible memory corruption due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0893](https://cve.now/CVE-2021-0893.md): In apusys, there is a possible memory corruption due to a use after free. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0678](https://cve.now/CVE-2021-0678.md): In apusys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MT6873, MT6875, MT6877, MT6883, MT6885, MT6889, MT6891, MT6…)
- [CVE-2021-0676](https://cve.now/CVE-2021-0676.md): In geniezone driver, there is a possible out of bounds read due to an incorrect bounds check. (no CVSS, MT6762, MT6765, MT6768, MT6769, MT6771, MT6779, MT6781, MT6…)
- [CVE-2021-0677](https://cve.now/CVE-2021-0677.md): In ccu driver, there is a possible out of bounds read due to an integer overflow. (no CVSS, MT6833, MT6853, MT6873, MT6877, MT6885, MT6889, MT8771, MT8…)
- [CVE-2021-32499](https://cve.now/CVE-2021-32499.md): SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the command line arguments to pass in any value to the Emulator executable (no CVSS, SICK SOPAS ET)
- [CVE-2021-32498](https://cve.now/CVE-2021-32498.md): SICK SOPAS ET before version 4.8.0 allows attackers to manipulate the pathname of the emulator and use path traversal to run an arbitrary ex (no CVSS, SICK SOPAS ET)
- [CVE-2021-32497](https://cve.now/CVE-2021-32497.md): SICK SOPAS ET before version 4.8.0 allows attackers to wrap any executable file into an SDD and provide this to a SOPAS ET user. (no CVSS, SICK SOPAS ET)
- [CVE-2021-44035](https://cve.now/CVE-2021-44035.md): Wolters Kluwer TeamMate AM 12.4 Update 1 mishandles attachment uploads, such that an authenticated user may download and execute malicious f (CVSS 4.4)
- [CVE-2021-41451](https://cve.now/CVE-2021-41451.md): A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1\_211117 allows a remote unauthenticated attacker (no CVSS)
- [CVE-2021-45042](https://cve.now/CVE-2021-45042.md): In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage back (no CVSS)
- [CVE-2021-42584](https://cve.now/CVE-2021-42584.md): A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32. (no CVSS)
- [CVE-2021-43678](https://cve.now/CVE-2021-43678.md): Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php. (no CVSS, gaoming13/wechat-php-sdk)
- [CVE-2021-4132](https://cve.now/CVE-2021-4132.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 7.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-36780](https://cve.now/CVE-2021-36780.md): Unauthorized data access from replicas through vulnerable instance manager pods (CVSS 8.1, SUSE Longhorn)
- [CVE-2021-36779](https://cve.now/CVE-2021-36779.md): Host operations allowed in privileged Longhorn managed pods (CVSS 9.6, SUSE Longhorn)
- [CVE-2021-44145](https://cve.now/CVE-2021-44145.md): Apache NiFi information disclosure by XXE (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi:ni…)
- [CVE-2021-41843](https://cve.now/CVE-2021-41843.md): An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from al (no CVSS)
- [CVE-2021-4008](https://cve.now/CVE-2021-4008.md): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. (no CVSS, xorg-x11-server)
- [CVE-2021-4009](https://cve.now/CVE-2021-4009.md): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. (no CVSS, xorg-x11-server)
- [CVE-2021-4010](https://cve.now/CVE-2021-4010.md): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. (no CVSS, xorg-x11-server)
- [CVE-2021-4011](https://cve.now/CVE-2021-4011.md): A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. (no CVSS, xorg-x11-server)
- [CVE-2021-44857](https://cve.now/CVE-2021-44857.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (no CVSS)
- [CVE-2021-45038](https://cve.now/CVE-2021-45038.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.