CVEs published December 21, 2021
66 CVEs were published on December 21, 2021: 3 critical, 7 high. 1 is now in CISA KEV.
- Published
- 66
- Critical
- 3
- High
- 7
- Medium
- 10
- Low
- 0
- Unrated
- 46
- Now in CISA KEV
- 1
- Fix available
- 18
Most affected products
- Mesa Labs AmegaView
- 5
- Dell Avamar
- 3
- Dell Wyse Management Suite
- 2
- Logo Carousel – Logo Slider, Logo Showcase, and Clients Log…
- 2
- anuko timetracker
- 1
- Blog2Social: Social Media Auto Post & Scheduler
- 1
- Contact Form, Drag and Drop Form Builder for WordPress – Ev…
- 1
- crypto-org-chain cronos · github.com/crypto-org-chain/cr… +2
- 1
- Dell PowerPath Management Appliance
- 1
- Dell PowerScale OneFS
- 1
Critical 3
- CVE-2021-27447Mesa Labs AmegaView command injectionMesa Labs AmegaView
- CVE-2021-27449Mesa Labs AmegaView Command InjectionMesa Labs AmegaView
- CVE-2021-36336Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execuDell Wyse Management Suite
High 7
- CVE-2021-43851SQL injection vulnerability in anuko timetrackeranuko timetracker
- CVE-2021-27451Mesa Labs AmegaView improper authenticationMesa Labs AmegaView
- CVE-2021-27453Mesa Labs AmegaView authentication bypassMesa Labs AmegaView
- CVE-2021-27445Mesa Labs AmegaView Improper Privilege ManagementMesa Labs AmegaView
- CVE-2021-44207Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
- CVE-2021-43587Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key.Dell PowerPath Management Appliance
- CVE-2021-43839Drainage of FeeCollector's Block Transaction Feescrypto-org-chain cronos · github.com/crypto-org-chain/cr… +2
Medium, low and unrated 56
- CVE-2021-44927A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function, which causes a segmentation fault and ap
- CVE-2021-44926A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function, which causes a segmentation fault and app
- CVE-2021-44925A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault a
- CVE-2021-44924An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service.
- CVE-2021-44923A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault
- CVE-2021-44922A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and ap
- CVE-2021-44921A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentatio
- CVE-2021-44920An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump_od_to_saf.isra function, which causes a segmentation fa
- CVE-2021-44919A Null Pointer Dereference vulnerability exists in the gf_sg_vrml_mf_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and
- CVE-2021-44918A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf_node_get_field function, which can cause a segmentation fault and ap
- CVE-2021-44917A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and a
- CVE-2021-38966IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting.IBM Cloud Pak for Automation
- CVE-2021-38900IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obtIBM Business Automation Workflow · IBM Cloud Pak for Automa…
- CVE-2021-38893IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site IBM Cloud Pak for Automation · IBM Business Process Manager…
- CVE-2021-44859An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12.
- CVE-2021-44860An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12.
- CVE-2021-44423An out-of-bounds read vulnerability exists when reading a BMP file using Open Design Alliance (ODA) Drawings Explorer before 2022.12.
- CVE-2021-44422An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12.
- CVE-2021-45293A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.
- CVE-2020-19770A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie
- CVE-2021-45290A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.
- CVE-2021-45289A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service.
- CVE-2021-36350Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors.Dell PowerScale OneFS
- CVE-2021-36341Dell Wyse Device Agent version 14.5.4.1 and below contain a sensitive data exposure vulnerability.Dell Wyse Device Agent
- CVE-2021-36337Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible tDell Wyse Management Suite
- CVE-2021-36318Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability.Dell Avamar
- CVE-2021-36317Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller.Dell Avamar
- CVE-2021-36316Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI.Dell Avamar
- CVE-2021-45288A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box comma
- CVE-2021-44874Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query.
- CVE-2021-44876Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration.
- CVE-2021-44875Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration.
- CVE-2021-44877Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control.
- CVE-2012-20001PrestaShop before 1.5.2 allows XSS via the "<object data='data:text/html" substring in the message field.prestashop/prestashop
- CVE-2021-45090Stormshield Endpoint Security before 2.1.2 allows remote code execution.
- CVE-2021-45089Stormshield Endpoint Security 2.x before 2.1.2 has Incorrect Access Control.
- CVE-2021-45091Stormshield Endpoint Security from 2.1.0 to 2.1.1 has Incorrect Access Control.
- CVE-2021-4139Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2021-45255The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks.
- CVE-2021-45253The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks.
- CVE-2021-45252Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_to
- CVE-2021-24981Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File UploadDirectorist – Business Directory Plugin
- CVE-2021-24956Blog2Social < 6.8.7 - Reflected Cross-Site ScriptingBlog2Social: Social Media Auto Post & Scheduler
- CVE-2021-24941Icegram < 2.0.5 - Reflected Cross-Site ScriptingPopups, Welcome Bar, Optins and Lead Generation Plugin – Ic…
- CVE-2021-24907Everest Forms < 1.8.0 - Reflected Cross-Site ScriptingContact Form, Drag and Drop Form Builder for WordPress – Ev…
- CVE-2021-24849WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL InjectionWCFM Marketplace – Best Multivendor Marketplace for WooComm…
- CVE-2021-24846Ni WooCommerce Custom Order Status < 1.9.7 - Subscriber+ SQL InjectionNi WooCommerce Custom Order Status
- CVE-2021-24750WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL InjectionWP Visitor Statistics
- CVE-2021-24739Logo Carousel < 3.4.2 - Unauthorised Private Post AccessLogo Carousel – Logo Slider, Logo Showcase, and Clients Log…
- CVE-2021-24738Logo Carousel < 3.4.2 - Contributor+ Stored Cross-Site ScriptingLogo Carousel – Logo Slider, Logo Showcase, and Clients Log…
- CVE-2021-24578SportsPress < 2.7.9 - Reflected Cross-Site ScriptingSportsPress – Sports Club & League Manager
- CVE-2021-45291The gf_dump_setup function in GPAC 1.0.1 allows malicoius users to cause a denial of service (Invalid memory address dereference) via a craf
- CVE-2021-45292The gf_isom_hint_rtp_read function in GPAC 1.0.1 allows attackers to cause a denial of service (Invalid memory address dereference) via a cr
- CVE-2021-45297An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size.
- CVE-2021-45450In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa_cipher_generate_iv and psa_cipher_encrypt allow policy bypass or oracle-based decryption
- CVE-2021-45451In Mbed TLS before 3.1.0, psa_aead_generate_nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locati