# CVEs published 2021-12-21 66 CVEs were published on December 21, 2021: 3 critical, 7 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2021-43851](https://cve.now/CVE-2021-43851.md): SQL injection vulnerability in anuko timetracker (CVSS 8.1, anuko timetracker) - [CVE-2021-44927](https://cve.now/CVE-2021-44927.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf\_sg\_vrml\_mf\_append function, which causes a segmentation fault and ap (no CVSS) - [CVE-2021-44926](https://cve.now/CVE-2021-44926.md): A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf\_node\_get\_tag function, which causes a segmentation fault and app (no CVSS) - [CVE-2021-44925](https://cve.now/CVE-2021-44925.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf\_svg\_get\_attribute\_name function, which causes a segmentation fault a (no CVSS) - [CVE-2021-44924](https://cve.now/CVE-2021-44924.md): An infinite loop vulnerability exists in gpac 1.1.0 in the gf\_log function, which causes a Denial of Service. (no CVSS) - [CVE-2021-44923](https://cve.now/CVE-2021-44923.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf\_dump\_vrml\_dyn\_field.isra function, which causes a segmentation fault (no CVSS) - [CVE-2021-44922](https://cve.now/CVE-2021-44922.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD\_CheckSFTimeOffset function, which causes a segmentation fault and ap (no CVSS) - [CVE-2021-44921](https://cve.now/CVE-2021-44921.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf\_isom\_parse\_movie\_boxes\_internal function, which causes a segmentatio (no CVSS) - [CVE-2021-44920](https://cve.now/CVE-2021-44920.md): An invalid memory address dereference vulnerability exists in gpac 1.1.0 in the dump\_od\_to\_saf.isra function, which causes a segmentation fa (no CVSS) - [CVE-2021-44919](https://cve.now/CVE-2021-44919.md): A Null Pointer Dereference vulnerability exists in the gf\_sg\_vrml\_mf\_alloc function in gpac 1.1.0-DEV, which causes a segmentation fault and (no CVSS) - [CVE-2021-44918](https://cve.now/CVE-2021-44918.md): A Null Pointer Dereference vulnerability exists in gpac 1.1.0 in the gf\_node\_get\_field function, which can cause a segmentation fault and ap (no CVSS) - [CVE-2021-44917](https://cve.now/CVE-2021-44917.md): A Divide by Zero vulnerability exists in gnuplot 5.4 in the boundary3d function in graph3d.c, which could cause a Arithmetic exception and a (no CVSS) - [CVE-2021-38966](https://cve.now/CVE-2021-38966.md): IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Cloud Pak for Automation) - [CVE-2021-38900](https://cve.now/CVE-2021-38900.md): IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 could allow a privileged user to obt (CVSS 4.9, IBM Business Automation Workflow · IBM Cloud Pak for Automa…) - [CVE-2021-38893](https://cve.now/CVE-2021-38893.md): IBM Business Process Manager 8.5 and 8.6 and IBM Business Automation Workflow 18.0, 19.0, 20.0 and 21.0 are vulnerable to stored cross-site (CVSS 6.4, IBM Cloud Pak for Automation · IBM Business Process Manager…) - [CVE-2021-44859](https://cve.now/CVE-2021-44859.md): An out-of-bounds read vulnerability exists when reading a TGA file using Open Design Alliance Drawings SDK before 2022.12. (no CVSS) - [CVE-2021-44860](https://cve.now/CVE-2021-44860.md): An out-of-bounds read vulnerability exists when reading a TIF file using Open Design Alliance Drawings SDK before 2022.12. (no CVSS) - [CVE-2021-44423](https://cve.now/CVE-2021-44423.md): An out-of-bounds read vulnerability exists when reading a BMP file using Open Design Alliance (ODA) Drawings Explorer before 2022.12. (no CVSS) - [CVE-2021-44422](https://cve.now/CVE-2021-44422.md): An Improper Input Validation Vulnerability exists when reading a BMP file using Open Design Alliance Drawings SDK before 2022.12. (no CVSS) - [CVE-2021-27451](https://cve.now/CVE-2021-27451.md): Mesa Labs AmegaView improper authentication (CVSS 7.3, Mesa Labs AmegaView) - [CVE-2021-27447](https://cve.now/CVE-2021-27447.md): Mesa Labs AmegaView command injection (CVSS 10.0, Mesa Labs AmegaView) - [CVE-2021-27453](https://cve.now/CVE-2021-27453.md): Mesa Labs AmegaView authentication bypass (CVSS 7.3, Mesa Labs AmegaView) - [CVE-2021-27449](https://cve.now/CVE-2021-27449.md): Mesa Labs AmegaView Command Injection (CVSS 9.9, Mesa Labs AmegaView) - [CVE-2021-27445](https://cve.now/CVE-2021-27445.md): Mesa Labs AmegaView Improper Privilege Management (CVSS 7.8, Mesa Labs AmegaView) - [CVE-2021-45293](https://cve.now/CVE-2021-45293.md): A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet. (no CVSS) - [CVE-2021-44207](https://cve.now/CVE-2021-44207.md): Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. (CVSS 8.1, KEV) - [CVE-2020-19770](https://cve.now/CVE-2020-19770.md): A cross-site scripting (XSS) vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie (no CVSS) - [CVE-2021-45290](https://cve.now/CVE-2021-45290.md): A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle\_unreachable. (no CVSS) - [CVE-2021-45289](https://cve.now/CVE-2021-45289.md): A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service. (no CVSS) - [CVE-2021-43587](https://cve.now/CVE-2021-43587.md): Dell PowerPath Management Appliance, versions 3.2, 3.1, 3.0 P01, 3.0, and 2.6, use hard-coded cryptographic key. (CVSS 8.2, Dell PowerPath Management Appliance) - [CVE-2021-36350](https://cve.now/CVE-2021-36350.md): Dell PowerScale OneFS, versions 8.2.2-9.3.0.x, contain an authentication bypass by primary weakness in one of the authentication factors. (CVSS 5.9, Dell PowerScale OneFS) - [CVE-2021-36341](https://cve.now/CVE-2021-36341.md): Dell Wyse Device Agent version 14.5.4.1 and below contain a sensitive data exposure vulnerability. (CVSS 5.5, Dell Wyse Device Agent) - [CVE-2021-36337](https://cve.now/CVE-2021-36337.md): Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible t (CVSS 6.5, Dell Wyse Management Suite) - [CVE-2021-36336](https://cve.now/CVE-2021-36336.md): Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execu (CVSS 9.8, Dell Wyse Management Suite) - [CVE-2021-36318](https://cve.now/CVE-2021-36318.md): Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. (CVSS 6.7, Dell Avamar) - [CVE-2021-36317](https://cve.now/CVE-2021-36317.md): Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. (CVSS 6.7, Dell Avamar) - [CVE-2021-36316](https://cve.now/CVE-2021-36316.md): Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. (CVSS 6.7, Dell Avamar) - [CVE-2021-45288](https://cve.now/CVE-2021-45288.md): A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box comma (no CVSS) - [CVE-2021-43839](https://cve.now/CVE-2021-43839.md): Drainage of FeeCollector's Block Transaction Fees (CVSS 7.5, crypto-org-chain cronos · github.com/crypto-org-chain/cr… +2) - [CVE-2021-44874](https://cve.now/CVE-2021-44874.md): Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Insecure design on report build via SQL query. (no CVSS) - [CVE-2021-44876](https://cve.now/CVE-2021-44876.md): Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. (no CVSS) - [CVE-2021-44875](https://cve.now/CVE-2021-44875.md): Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to User enumeration. (no CVSS) - [CVE-2021-44877](https://cve.now/CVE-2021-44877.md): Dalmark Systems Systeam 2.22.8 build 1724 is vulnerable to Incorrect Access Control. (no CVSS) - [CVE-2012-20001](https://cve.now/CVE-2012-20001.md): PrestaShop before 1.5.2 allows XSS via the "\