# CVEs published 2021-12-20

70 CVEs were published on December 20, 2021: 3 critical, 25 high. Days are UTC.

- [CVE-2021-43842](https://cve.now/CVE-2021-43842.md): Stored XSS via SVG file upload in Wiki.js (CVSS 5.4, Requarks wiki)
- [CVE-2021-43847](https://cve.now/CVE-2021-43847.md): Authorization Bypass in Space Invite in HumHub (CVSS 6.5, humhub)
- [CVE-2021-43846](https://cve.now/CVE-2021-43846.md): CSRF forgery protection bypass for Spree::OrdersController#populate (CVSS 5.3, solidusio solidus · solidus\_frontend)
- [CVE-2021-43844](https://cve.now/CVE-2021-43844.md): Externally Controlled Reference to a Resource in Another Sphere in MSEdgeRedirect (CVSS 8.8, rcmaehl MSEdgeRedirect)
- [CVE-2021-43843](https://cve.now/CVE-2021-43843.md): Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1 (CVSS 5.3, yhatt jsx-slack · jsx-slack)
- [CVE-2021-42138](https://cve.now/CVE-2021-42138.md): A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all (CVSS 7.2, Thales CPL Safenet Authentication Service)
- [CVE-2021-42808](https://cve.now/CVE-2021-42808.md): The Sentinel Protection Installer 7.7.0 creates files and directory with all privileges granting any user full permissions. (CVSS 6.5, Thales Sentinel Protection Installer)
- [CVE-2021-42809](https://cve.now/CVE-2021-42809.md): The Sentinel Protection Installer 7.7.0 does not properly restrict loading Dynamic Link Library (CVSS 6.5, Thales Sentinel Protection Installer)
- [CVE-2021-38419](https://cve.now/CVE-2021-38419.md): Fuji Electric Tellus Lite V-Simulator out of bounds write (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-38413](https://cve.now/CVE-2021-38413.md): Fuji Electric Tellus Lite V-Simulator stack based buffer overflow (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-38415](https://cve.now/CVE-2021-38415.md): Fuji Electric Tellus Lite V-Simulator heap based buffer overflow (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-38421](https://cve.now/CVE-2021-38421.md): Fuji Electric Tellus Lite V-Simulator out of bounds read (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-38401](https://cve.now/CVE-2021-38401.md): Fuji Electric Tellus Lite V-Simulator untrusted pointer dereference (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-38409](https://cve.now/CVE-2021-38409.md): Fuji Electric Tellus Lite V-Simulator uninitialized pointer (CVSS 7.8, Fuji Electric V-Server Lite · Fuji Electric Tellus Lite V-S…)
- [CVE-2021-44697](https://cve.now/CVE-2021-44697.md): Adobe Audition MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Audition)
- [CVE-2021-44698](https://cve.now/CVE-2021-44698.md): Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Audition)
- [CVE-2021-44699](https://cve.now/CVE-2021-44699.md): Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Audition)
- [CVE-2021-44181](https://cve.now/CVE-2021-44181.md): Adobe Dimension GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2021-44180](https://cve.now/CVE-2021-44180.md): Adobe Dimension PCX File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2021-44183](https://cve.now/CVE-2021-44183.md): Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Dimension)
- [CVE-2021-44182](https://cve.now/CVE-2021-44182.md): Adobe Dimension SVG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Dimension)
- [CVE-2021-43763](https://cve.now/CVE-2021-43763.md): Adobe Dimension TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Dimension)
- [CVE-2021-44179](https://cve.now/CVE-2021-44179.md): Adobe Dimension GIF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2021-43746](https://cve.now/CVE-2021-43746.md): Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 5.5, Adobe Premiere Rush)
- [CVE-2021-43750](https://cve.now/CVE-2021-43750.md): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (CVSS 5.5, Adobe Premiere Rush)
- [CVE-2021-43023](https://cve.now/CVE-2021-43023.md): Adobe Premiere Rush EPS/TIFF File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-43025](https://cve.now/CVE-2021-43025.md): Adobe Premiere Rush SVG File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere)
- [CVE-2021-43030](https://cve.now/CVE-2021-43030.md): Adobe Premiere Rush MP4 File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe Premiere Rush)
- [CVE-2021-43749](https://cve.now/CVE-2021-43749.md): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (CVSS 5.5, Adobe Premiere Rush)
- [CVE-2021-40784](https://cve.now/CVE-2021-40784.md): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43748](https://cve.now/CVE-2021-43748.md): Adobe Premiere Rush NULL Pointer Dereference Local Denial-of-Service (CVSS 5.5, Adobe Premiere Rush)
- [CVE-2021-43024](https://cve.now/CVE-2021-43024.md): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43022](https://cve.now/CVE-2021-43022.md): Adobe Premiere Rush PNG File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43747](https://cve.now/CVE-2021-43747.md): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43021](https://cve.now/CVE-2021-43021.md): Adobe Premiere Rush EXR File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43029](https://cve.now/CVE-2021-43029.md): Adobe Premiere Rush M4A File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43028](https://cve.now/CVE-2021-43028.md): Adobe Premiere Rush M4A File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-40783](https://cve.now/CVE-2021-40783.md): Adobe Premiere Rush WAV File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-43026](https://cve.now/CVE-2021-43026.md): Adobe Premiere Rush MXF File Memory Corruption Remote Code Execution (CVSS 7.8, Adobe Premiere Rush)
- [CVE-2021-22056](https://cve.now/CVE-2021-22056.md): VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. (no CVSS, VMware Workspace ONE Access and Identity Manager)
- [CVE-2021-22057](https://cve.now/CVE-2021-22057.md): VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 contain an authentication bypass vulnerability. (no CVSS, VMware Workspace ONE Access)
- [CVE-2021-35234](https://cve.now/CVE-2021-35234.md): Exposed Dangerous Functions - Privileged Escalation (CVSS 8.0, SolarWinds Orion Core)
- [CVE-2021-35244](https://cve.now/CVE-2021-35244.md): Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6 (CVSS 6.8, SolarWinds Orion Platform)
- [CVE-2021-35248](https://cve.now/CVE-2021-35248.md): Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users (CVSS 6.8, SolarWinds Orion)
- [CVE-2021-36887](https://cve.now/CVE-2021-36887.md): WordPress tarteaucitron.js – Cookies legislation & GDPR plugin \<= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) (CVSS 6.1, tarteaucitron.js – Cookies legislation & GDPR)
- [CVE-2021-36889](https://cve.now/CVE-2021-36889.md): WordPress tarteaucitron.js – Cookies legislation & GDPR plugin \<= 1.6 - Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities (CVSS 3.4, tarteaucitron.js – Cookies legislation & GDPR)
- [CVE-2020-19316](https://cve.now/CVE-2020-19316.md): OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. (no CVSS, laravel/framework)
- [CVE-2021-43437](https://cve.now/CVE-2021-43437.md): In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the web application and ca (no CVSS)
- [CVE-2021-43438](https://cve.now/CVE-2021-43438.md): Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field (no CVSS)
- [CVE-2021-43439](https://cve.now/CVE-2021-43439.md): RCE in Add Review Function in iResturant 1.0 Allows remote attacker to execute commands remotely (no CVSS)
- [CVE-2021-43441](https://cve.now/CVE-2021-43441.md): An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup form (no CVSS)
- [CVE-2021-43440](https://cve.now/CVE-2021-43440.md): Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code via signup form in the (no CVSS)
- [CVE-2021-44525](https://cve.now/CVE-2021-44525.md): Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a filter bypass in which (no CVSS)
- [CVE-2021-44675](https://cve.now/CVE-2021-44675.md): Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass (no CVSS)
- [CVE-2021-44676](https://cve.now/CVE-2021-44676.md): Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few (no CVSS)
- [CVE-2020-8105](https://cve.now/CVE-2020-8105.md): Command Execution due to unsanitized input (CVSS 9.6, Abode iota All-In-One Security Kit)
- [CVE-2021-44916](https://cve.now/CVE-2021-44916.md): Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-44224](https://cve.now/CVE-2021-44224.md): Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-41561](https://cve.now/CVE-2021-41561.md): Apache Parquet-MR potential DoS in case of malicious Parquet file (no CVSS, Apache Software Foundation Apache Parquet · org.apache.parq…)
- [CVE-2021-44554](https://cve.now/CVE-2021-44554.md): Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /changePassword URI. (no CVSS)
- [CVE-2021-44263](https://cve.now/CVE-2021-44263.md): Gurock TestRail before 7.2.4 mishandles HTML escaping. (no CVSS)
- [CVE-2021-42913](https://cve.now/CVE-2021-42913.md): The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and cleartext passwords by r (no CVSS)
- [CVE-2021-44164](https://cve.now/CVE-2021-44164.md): Chain Sea Information Integration Co., Ltd ai chatbot system - Arbitrary File Upload (CVSS 9.8, Chain Sea Information Integration Co. ai chatbot system)
- [CVE-2021-44163](https://cve.now/CVE-2021-44163.md): Chain Sea Information Integration Co., Ltd ai chatbot system - Reflected XSS (CVSS 6.1, Chain Sea Information Integration Co. ai chatbot system)
- [CVE-2021-44162](https://cve.now/CVE-2021-44162.md): Chain Sea Information Integration Co., Ltd ai chatbot system - Path Traversal (CVSS 7.5, Chain Sea Information Integration Co. ai chatbot system)
- [CVE-2021-44159](https://cve.now/CVE-2021-44159.md): 4MOSAn GCB Doctor - Unrestricted Upload of File (CVSS 9.8, 4MOSAn GCB Doctor)
- [CVE-2021-3860](https://cve.now/CVE-2021-3860.md): JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user (CVSS 8.8, JFrog Artifactory)
- [CVE-2021-44732](https://cve.now/CVE-2021-44732.md): Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls\_ssl\_set\_session() failure. (no CVSS)
- [CVE-2021-44790](https://cve.now/CVE-2021-44790.md): Possible buffer overflow when parsing multipart content in mod\_lua of Apache HTTP Server 2.4.51 and earlier (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2021-44858](https://cve.now/CVE-2021-44858.md): An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.