CVEs published December 20, 2021
70 CVEs were published on December 20, 2021: 3 critical, 25 high.
- Published
- 70
- Critical
- 3
- High
- 25
- Medium
- 14
- Low
- 8
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Adobe Premiere Rush
- 14
- Adobe Dimension
- 6
- Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- 6
- Adobe Audition
- 3
- Chain Sea Information Integration Co. ai chatbot system
- 3
- Adobe Premiere
- 2
- Apache Software Foundation Apache HTTP Server
- 2
- tarteaucitron.js – Cookies legislation & GDPR
- 2
- Thales Sentinel Protection Installer
- 2
- 4MOSAn GCB Doctor
- 1
Critical 3
- CVE-2020-8105Command Execution due to unsanitized inputAbode iota All-In-One Security Kit
- CVE-2021-44164Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File UploadChain Sea Information Integration Co. ai chatbot system
- CVE-2021-441594MOSAn GCB Doctor - Unrestricted Upload of File4MOSAn GCB Doctor
High 25
- CVE-2021-43844Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirectrcmaehl MSEdgeRedirect
- CVE-2021-42138A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or allThales CPL Safenet Authentication Service
- CVE-2021-38419Fuji Electric Tellus Lite V-Simulator out of bounds writeFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-38413Fuji Electric Tellus Lite V-Simulator stack based buffer overflowFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-38415Fuji Electric Tellus Lite V-Simulator heap based buffer overflowFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-38421Fuji Electric Tellus Lite V-Simulator out of bounds readFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-38401Fuji Electric Tellus Lite V-Simulator untrusted pointer dereferenceFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-38409Fuji Electric Tellus Lite V-Simulator uninitialized pointerFuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…
- CVE-2021-44181Adobe Dimension GIF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2021-44180Adobe Dimension PCX File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2021-44179Adobe Dimension GIF File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2021-43023Adobe Premiere Rush EPS/TIFF File Memory Corruption Remote Code ExecutionAdobe Premiere
- CVE-2021-43025Adobe Premiere Rush SVG File Memory Corruption Remote Code ExecutionAdobe Premiere
- CVE-2021-40784Adobe Premiere Rush WAV File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43024Adobe Premiere Rush WAV File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43022Adobe Premiere Rush PNG File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43747Adobe Premiere Rush WAV File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43021Adobe Premiere Rush EXR File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43029Adobe Premiere Rush M4A File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43028Adobe Premiere Rush M4A File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-40783Adobe Premiere Rush WAV File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-43026Adobe Premiere Rush MXF File Memory Corruption Remote Code ExecutionAdobe Premiere Rush
- CVE-2021-35234Exposed Dangerous Functions - Privileged EscalationSolarWinds Orion Core
- CVE-2021-44162Chain Sea Information Integration Co., Ltd ai chatbot system - Path TraversalChain Sea Information Integration Co. ai chatbot system
- CVE-2021-3860JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user JFrog Artifactory
Medium, low and unrated 42
- CVE-2021-43842Stored XSS via SVG file upload in Wiki.jsRequarks wiki
- CVE-2021-43847Authorization Bypass in Space Invite in HumHubhumhub
- CVE-2021-43846CSRF forgery protection bypass for Spree::OrdersController#populatesolidusio solidus · solidus_frontend
- CVE-2021-43843Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1yhatt jsx-slack · jsx-slack
- CVE-2021-42808The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions.Thales Sentinel Protection Installer
- CVE-2021-42809The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link LibraryThales Sentinel Protection Installer
- CVE-2021-44697Adobe Audition MOV File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Audition
- CVE-2021-44698Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Audition
- CVE-2021-44699Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Audition
- CVE-2021-44183Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2021-44182Adobe Dimension SVG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2021-43763Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2021-43746Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Premiere Rush
- CVE-2021-43750Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-ServiceAdobe Premiere Rush
- CVE-2021-43030Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Premiere Rush
- CVE-2021-43749Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-ServiceAdobe Premiere Rush
- CVE-2021-43748Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-ServiceAdobe Premiere Rush
- CVE-2021-22056VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability.VMware Workspace ONE Access and Identity Manager
- CVE-2021-22057VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability.VMware Workspace ONE Access
- CVE-2021-35244Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6SolarWinds Orion Platform
- CVE-2021-35248Unrestricted access to Orion.UserSettings SWIS entity for low-privilege usersSolarWinds Orion
- CVE-2021-36887WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS)tarteaucitron.js – Cookies legislation & GDPR
- CVE-2021-36889WordPress tarteaucitron.js – Cookies legislation & GDPR plugin <= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilitiestarteaucitron.js – Cookies legislation & GDPR
- CVE-2020-19316OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.laravel/framework
- CVE-2021-43437In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and ca
- CVE-2021-43438Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field
- CVE-2021-43439RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely
- CVE-2021-43441An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup form
- CVE-2021-43440Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code via signup form in the
- CVE-2021-44525Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which
- CVE-2021-44675Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass
- CVE-2021-44676Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few
- CVE-2021-44916Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierApache Software Foundation Apache HTTP Server
- CVE-2021-41561Apache Parquet-MR potential DoS in case of malicious Parquet fileApache Software Foundation Apache Parquet · org.apache.parq…
- CVE-2021-44554Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI.
- CVE-2021-44263Gurock TestRail before 7.2.4 mishandles HTML escaping.
- CVE-2021-42913The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by r
- CVE-2021-44163Chain Sea Information Integration Co., Ltd ai chatbot system - Reflected XSSChain Sea Information Integration Co. ai chatbot system
- CVE-2021-44732Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
- CVE-2021-44790Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierApache Software Foundation Apache HTTP Server
- CVE-2021-44858An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.