CVEs published December 22, 2021
116 CVEs were published on December 22, 2021: 27 critical, 38 high.
- Published
- 116
- Critical
- 27
- High
- 38
- Medium
- 11
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 2
Most affected products
- Advantech
- 26
- Lantronix
- 24
- Garrett Metal Detectors
- 9
- Delta Electronics DIAEnergie
- 4
- Blackmagic Design
- 2
- CipherCoin Contact Form 7 Database Addon – CFDB7
- 2
- Gerbv
- 2
- pjsip pjproject
- 2
- Anker
- 1
- Anker"
- 1
Critical 27
- CVE-2021-21952An authentication bypass vulnerability exists in the CMD_DEVICE_GET_RSA_KEY_REQUEST functionality of the home_security binary of Anker Eufy Anker"
- CVE-2021-40417When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that weBlackmagic Design
- CVE-2021-40418When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property Blackmagic Design
- CVE-2021-21904A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0.Garrett Metal Detectors
- CVE-2021-21903A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0.Garrett Metal Detectors
- CVE-2021-21901A stack-based buffer overflow vulnerability exists in the CMA check_udp_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0.Garrett Metal Detectors
- CVE-2021-21895A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU).Lantronix
- CVE-2021-21892A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QELantronix
- CVE-2021-21894A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU).Lantronix
- CVE-2021-21891A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (iLantronix
- CVE-2021-21890A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (iLantronix
- CVE-2021-21889A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU).Lantronix
- CVE-2021-21888An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4Lantronix
- CVE-2021-21887A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (Lantronix
- CVE-2021-21884An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21883An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21881An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0Lantronix
- CVE-2021-21882An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21879A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21877Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests.Lantronix
- CVE-2021-21875A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter.Lantronix
- CVE-2021-21876Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests.Lantronix
- CVE-2021-21874A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter.Lantronix
- CVE-2021-21873A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter.Lantronix
- CVE-2021-21872An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0RLantronix
- CVE-2021-40393An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5Gerbv
- CVE-2021-40394An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5Gerbv
High 38
- CVE-2021-43853Cross-Site Scripting in AjaxNetProfessionalmichaelschwarz Ajax.NET-Professional · AjaxNetProfessional
- CVE-2021-21953An authentication bypass vulnerability exists in the process_msg() function of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h.Anker
- CVE-2021-21937A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21936A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21935A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21934A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21933A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21932A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21930A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21931A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21929A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21928A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21926A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21927A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21925A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21924A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21923A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21922A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21920A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21921A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21919A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21918A specially-crafted HTTP request can lead to SQL injection.Advantech
- CVE-2021-21916An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).Advantech
- CVE-2021-21917An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).Advantech
- CVE-2021-21915An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).Advantech
- CVE-2021-21911A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2Advantech
- CVE-2021-21912A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2Advantech
- CVE-2021-21910A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2Advantech
- CVE-2021-23228Delta Electronics DIAEnergie (Update A)Delta Electronics DIAEnergie
- CVE-2021-44544Delta Electronics DIAEnergie (Update A)Delta Electronics DIAEnergie
- CVE-2021-44471Delta Electronics DIAEnergie (Update A)Delta Electronics DIAEnergie
- CVE-2021-21906Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is usGarrett Metal Detectors
- CVE-2021-21905Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is usGarrett Metal Detectors
- CVE-2021-21902An authentication bypass vulnerability exists in the CMA run_server_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0.Garrett Metal Detectors
- CVE-2021-21885A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21880A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-37706Potential integer underflow upon receiving STUN message in PJSIPpjsip pjproject
- CVE-2021-43804Out-of-bounds read when parsing RTCP BYE message in PJSIPpjsip pjproject
Medium, low and unrated 51
- CVE-2020-20605Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
- CVE-2020-20601An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
- CVE-2020-20600MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
- CVE-2020-20598A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HT
- CVE-2020-20597A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers
- CVE-2020-20595A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.
- CVE-2020-20593A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.
- CVE-2020-20426S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php.
- CVE-2020-20425S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function.
- CVE-2021-45461FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to exec
- CVE-2021-39306A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big
- CVE-2021-21909Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command.Garrett Metal Detectors
- CVE-2021-21908Specially-crafted command line arguments can lead to arbitrary file deletion.Garrett Metal Detectors
- CVE-2021-31558Delta Electronics DIAEnergie (Update A)Delta Electronics DIAEnergie
- CVE-2021-21907A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0Garrett Metal Detectors
- CVE-2021-36886WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerabilityCipherCoin Contact Form 7 Database Addon – CFDB7
- CVE-2021-21896A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU).Lantronix
- CVE-2021-36885WordPress Contact Form 7 Database Addon – CFDB7 plugin <= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerabilityCipherCoin Contact Form 7 Database Addon – CFDB7
- CVE-2021-21886A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4.Lantronix
- CVE-2021-21878A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0Lantronix
- CVE-2021-45266A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault an
- CVE-2021-43157Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php.
- CVE-2021-43158In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart_remove.php allows a remote attacker to remove any product in t
- CVE-2021-44659Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve
- CVE-2021-43155Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
- CVE-2021-43156In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.
- CVE-2021-43631Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.
- CVE-2021-43630Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php.
- CVE-2021-43629Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
- CVE-2021-43628Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.
- CVE-2021-45261An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.
- CVE-2021-45260A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr_read_id.part function, which causes a segmentation fault and applic
- CVE-2021-45259An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and appl
- CVE-2021-45258A stack overflow vulnerability exists in gpac 1.1.0 via the gf_bifs_dec_proto_list function, which causes a segmentation fault and applicati
- CVE-2021-39013IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP reIBM Cloud Pak for Security
- CVE-2021-45257An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.
- CVE-2021-45256A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.
- CVE-2021-45419Certain Starcharge products are affected by Improper Input Validation.
- CVE-2021-45418Certain Starcharge products are vulnerable to Directory Traversal via main.cgi.
- CVE-2021-36750ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau
- CVE-2021-40612An issue was discovered in Opmantek Open-AudIT after 3.5.0.
- CVE-2021-40836Denial-of-Service (DoS) VulnerabilityF-Secure endpoint protection products on Windows and Mac. F…
- CVE-2021-45459lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.node-windows
- CVE-2021-44029An issue was discovered in Quest KACE Desktop Authority before 11.2.
- CVE-2021-44031An issue was discovered in Quest KACE Desktop Authority before 11.2.
- CVE-2021-44030Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method
- CVE-2021-44028XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a relat
- CVE-2021-44733A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11.
- CVE-2021-45262An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation fault and application cra
- CVE-2021-45263An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segmentation fault and app
- CVE-2021-45267An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svg_node_start function, which causes a segmentation fault