# CVEs published 2021-12-22

116 CVEs were published on December 22, 2021: 27 critical, 38 high. Days are UTC.

- [CVE-2020-20605](https://cve.now/CVE-2020-20605.md): Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. (no CVSS)
- [CVE-2020-20601](https://cve.now/CVE-2020-20601.md): An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. (no CVSS)
- [CVE-2020-20600](https://cve.now/CVE-2020-20600.md): MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. (no CVSS)
- [CVE-2020-20598](https://cve.now/CVE-2020-20598.md): A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HT (no CVSS)
- [CVE-2020-20597](https://cve.now/CVE-2020-20597.md): A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \\web\\PortalController.java of lemon V1.10.0 allows attackers (no CVSS)
- [CVE-2020-20595](https://cve.now/CVE-2020-20595.md): A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add. (no CVSS)
- [CVE-2020-20593](https://cve.now/CVE-2020-20593.md): A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. (no CVSS)
- [CVE-2020-20426](https://cve.now/CVE-2020-20426.md): S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php. (no CVSS)
- [CVE-2020-20425](https://cve.now/CVE-2020-20425.md): S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function. (no CVSS)
- [CVE-2021-43853](https://cve.now/CVE-2021-43853.md): Cross-Site Scripting in AjaxNetProfessional (CVSS 8.7, michaelschwarz Ajax.NET-Professional · AjaxNetProfessional)
- [CVE-2021-45461](https://cve.now/CVE-2021-45461.md): FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to exec (no CVSS)
- [CVE-2021-39306](https://cve.now/CVE-2021-39306.md): A stack buffer overflow was discovered on Realtek RTL8195AM device before 2.0.10, it exists in the client code when an attacker sends a big (no CVSS)
- [CVE-2021-21953](https://cve.now/CVE-2021-21953.md): An authentication bypass vulnerability exists in the process\_msg() function of the home\_security binary of Anker Eufy Homebase 2 2.1.6.9h. (CVSS 7.7, Anker)
- [CVE-2021-21937](https://cve.now/CVE-2021-21937.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21952](https://cve.now/CVE-2021-21952.md): An authentication bypass vulnerability exists in the CMD\_DEVICE\_GET\_RSA\_KEY\_REQUEST functionality of the home\_security binary of Anker Eufy (CVSS 9.4, Anker")
- [CVE-2021-21936](https://cve.now/CVE-2021-21936.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21935](https://cve.now/CVE-2021-21935.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21934](https://cve.now/CVE-2021-21934.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21933](https://cve.now/CVE-2021-21933.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21932](https://cve.now/CVE-2021-21932.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21930](https://cve.now/CVE-2021-21930.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21931](https://cve.now/CVE-2021-21931.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21929](https://cve.now/CVE-2021-21929.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21928](https://cve.now/CVE-2021-21928.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21926](https://cve.now/CVE-2021-21926.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21927](https://cve.now/CVE-2021-21927.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21925](https://cve.now/CVE-2021-21925.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21924](https://cve.now/CVE-2021-21924.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-40417](https://cve.now/CVE-2021-40417.md): When parsing a file that is submitted to the DPDecoder service as a job, the service will use the combination of decoding parameters that we (CVSS 9.8, Blackmagic Design)
- [CVE-2021-40418](https://cve.now/CVE-2021-40418.md): When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property (CVSS 9.8, Blackmagic Design)
- [CVE-2021-21923](https://cve.now/CVE-2021-21923.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21922](https://cve.now/CVE-2021-21922.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21920](https://cve.now/CVE-2021-21920.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21921](https://cve.now/CVE-2021-21921.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21919](https://cve.now/CVE-2021-21919.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21918](https://cve.now/CVE-2021-21918.md): A specially-crafted HTTP request can lead to SQL injection. (CVSS 7.7, Advantech)
- [CVE-2021-21916](https://cve.now/CVE-2021-21916.md): An exploitable SQL injection vulnerability exist in the ‘group\_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). (CVSS 7.7, Advantech)
- [CVE-2021-21917](https://cve.now/CVE-2021-21917.md): An exploitable SQL injection vulnerability exist in the ‘group\_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). (CVSS 7.7, Advantech)
- [CVE-2021-21915](https://cve.now/CVE-2021-21915.md): An exploitable SQL injection vulnerability exist in the ‘group\_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). (CVSS 7.7, Advantech)
- [CVE-2021-21911](https://cve.now/CVE-2021-21911.md): A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2 (CVSS 8.8, Advantech)
- [CVE-2021-21912](https://cve.now/CVE-2021-21912.md): A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2 (CVSS 8.8, Advantech)
- [CVE-2021-21910](https://cve.now/CVE-2021-21910.md): A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2 (CVSS 8.8, Advantech)
- [CVE-2021-21909](https://cve.now/CVE-2021-21909.md): Specially-crafted command line arguments can lead to arbitrary file deletion in the del .cnt|.log file delete command. (CVSS 6.0, Garrett Metal Detectors)
- [CVE-2021-23228](https://cve.now/CVE-2021-23228.md): Delta Electronics DIAEnergie (Update A) (CVSS 7.5, Delta Electronics DIAEnergie)
- [CVE-2021-21908](https://cve.now/CVE-2021-21908.md): Specially-crafted command line arguments can lead to arbitrary file deletion. (CVSS 6.0, Garrett Metal Detectors)
- [CVE-2021-31558](https://cve.now/CVE-2021-31558.md): Delta Electronics DIAEnergie (Update A) (CVSS 6.5, Delta Electronics DIAEnergie)
- [CVE-2021-44544](https://cve.now/CVE-2021-44544.md): Delta Electronics DIAEnergie (Update A) (CVSS 7.5, Delta Electronics DIAEnergie)
- [CVE-2021-44471](https://cve.now/CVE-2021-44471.md): Delta Electronics DIAEnergie (Update A) (CVSS 7.5, Delta Electronics DIAEnergie)
- [CVE-2021-21907](https://cve.now/CVE-2021-21907.md): A directory traversal vulnerability exists in the CMA CLI getenv command functionality of Garrett Metal Detectors’ iC Module CMA Version 5.0 (CVSS 4.9, Garrett Metal Detectors)
- [CVE-2021-21906](https://cve.now/CVE-2021-21906.md): Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is us (CVSS 8.2, Garrett Metal Detectors)
- [CVE-2021-21905](https://cve.now/CVE-2021-21905.md): Stack-based buffer overflow vulnerability exists in how the CMA readfile function of Garrett Metal Detectors iC Module CMA Version 5.0 is us (CVSS 8.2, Garrett Metal Detectors)
- [CVE-2021-36886](https://cve.now/CVE-2021-36886.md): WordPress Contact Form 7 Database Addon – CFDB7 plugin \<= 1.2.5.9 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 6.5, CipherCoin Contact Form 7 Database Addon – CFDB7)
- [CVE-2021-21904](https://cve.now/CVE-2021-21904.md): A directory traversal vulnerability exists in the CMA CLI setenv command of Garrett Metal Detectors’ iC Module CMA Version 5.0. (CVSS 9.1, Garrett Metal Detectors)
- [CVE-2021-21903](https://cve.now/CVE-2021-21903.md): A stack-based buffer overflow vulnerability exists in the CMA check\_udp\_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. (CVSS 9.8, Garrett Metal Detectors)
- [CVE-2021-21902](https://cve.now/CVE-2021-21902.md): An authentication bypass vulnerability exists in the CMA run\_server\_6877 functionality of Garrett Metal Detectors iC Module CMA Version 5.0. (CVSS 7.5, Garrett Metal Detectors)
- [CVE-2021-21896](https://cve.now/CVE-2021-21896.md): A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). (CVSS 4.9, Lantronix)
- [CVE-2021-21901](https://cve.now/CVE-2021-21901.md): A stack-based buffer overflow vulnerability exists in the CMA check\_udp\_crc function of Garrett Metal Detectors’ iC Module CMA Version 5.0. (CVSS 9.8, Garrett Metal Detectors)
- [CVE-2021-21895](https://cve.now/CVE-2021-21895.md): A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). (CVSS 9.1, Lantronix)
- [CVE-2021-21892](https://cve.now/CVE-2021-21892.md): A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QE (CVSS 9.9, Lantronix)
- [CVE-2021-21894](https://cve.now/CVE-2021-21894.md): A directory traversal vulnerability exists in the Web Manager FsTFtp functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). (CVSS 9.1, Lantronix)
- [CVE-2021-21891](https://cve.now/CVE-2021-21891.md): A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (i (CVSS 9.1, Lantronix)
- [CVE-2021-21890](https://cve.now/CVE-2021-21890.md): A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (i (CVSS 9.1, Lantronix)
- [CVE-2021-36885](https://cve.now/CVE-2021-36885.md): WordPress Contact Form 7 Database Addon – CFDB7 plugin \<= 1.2.6.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability (CVSS 6.1, CipherCoin Contact Form 7 Database Addon – CFDB7)
- [CVE-2021-21889](https://cve.now/CVE-2021-21889.md): A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). (CVSS 9.9, Lantronix)
- [CVE-2021-21888](https://cve.now/CVE-2021-21888.md): An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (CVSS 9.1, Lantronix)
- [CVE-2021-21887](https://cve.now/CVE-2021-21887.md): A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 ( (CVSS 9.1, Lantronix)
- [CVE-2021-21885](https://cve.now/CVE-2021-21885.md): A directory traversal vulnerability exists in the Web Manager FsMove functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 7.2, Lantronix)
- [CVE-2021-21886](https://cve.now/CVE-2021-21886.md): A directory traversal vulnerability exists in the Web Manager FSBrowsePage functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 4.3, Lantronix)
- [CVE-2021-21884](https://cve.now/CVE-2021-21884.md): An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 9.1, Lantronix)
- [CVE-2021-21883](https://cve.now/CVE-2021-21883.md): An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 9.9, Lantronix)
- [CVE-2021-21881](https://cve.now/CVE-2021-21881.md): An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0 (CVSS 9.9, Lantronix)
- [CVE-2021-21882](https://cve.now/CVE-2021-21882.md): An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 9.9, Lantronix)
- [CVE-2021-21880](https://cve.now/CVE-2021-21880.md): A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 7.2, Lantronix)
- [CVE-2021-21879](https://cve.now/CVE-2021-21879.md): A directory traversal vulnerability exists in the Web Manager File Upload functionality of Lantronix PremierWave 2050 8.9.0.0R4. (CVSS 9.9, Lantronix)
- [CVE-2021-21878](https://cve.now/CVE-2021-21878.md): A local file inclusion vulnerability exists in the Web Manager Applications and FsBrowse functionality of Lantronix PremierWave 2050 8.9.0.0 (CVSS 4.9, Lantronix)
- [CVE-2021-21877](https://cve.now/CVE-2021-21877.md): Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. (CVSS 9.1, Lantronix)
- [CVE-2021-21875](https://cve.now/CVE-2021-21875.md): A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. (CVSS 9.1, Lantronix)
- [CVE-2021-21876](https://cve.now/CVE-2021-21876.md): Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. (CVSS 9.1, Lantronix)
- [CVE-2021-21874](https://cve.now/CVE-2021-21874.md): A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. (CVSS 9.1, Lantronix)
- [CVE-2021-21873](https://cve.now/CVE-2021-21873.md): A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. (CVSS 9.1, Lantronix)
- [CVE-2021-21872](https://cve.now/CVE-2021-21872.md): An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R (CVSS 9.9, Lantronix)
- [CVE-2021-45266](https://cve.now/CVE-2021-45266.md): A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr\_read\_anim\_values\_ex function, which causes a segmentation fault an (no CVSS)
- [CVE-2021-43157](https://cve.now/CVE-2021-43157.md): Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart\_remove.php. (no CVSS)
- [CVE-2021-43158](https://cve.now/CVE-2021-43158.md): In ProjectWorlds Online Shopping System PHP 1.0, a CSRF vulnerability in cart\_remove.php allows a remote attacker to remove any product in t (no CVSS)
- [CVE-2021-44659](https://cve.now/CVE-2021-44659.md): Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve (no CVSS)
- [CVE-2021-43155](https://cve.now/CVE-2021-43155.md): Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php. (no CVSS)
- [CVE-2021-43156](https://cve.now/CVE-2021-43156.md): In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin\_delete.php allows a remote attacker to delete any book. (no CVSS)
- [CVE-2021-43631](https://cve.now/CVE-2021-43631.md): Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment\_no parameter in payment.php. (no CVSS)
- [CVE-2021-43630](https://cve.now/CVE-2021-43630.md): Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add\_patient.php. (no CVSS)
- [CVE-2021-43629](https://cve.now/CVE-2021-43629.md): Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin\_home.php. (no CVSS)
- [CVE-2021-43628](https://cve.now/CVE-2021-43628.md): Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php. (no CVSS)
- [CVE-2021-45261](https://cve.now/CVE-2021-45261.md): An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another\_hunk function, which causes a Denial of Service. (no CVSS)
- [CVE-2021-45260](https://cve.now/CVE-2021-45260.md): A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr\_read\_id.part function, which causes a segmentation fault and applic (no CVSS)
- [CVE-2021-45259](https://cve.now/CVE-2021-45259.md): An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf\_svg\_node\_del function, which causes a segmentation fault and appl (no CVSS)
- [CVE-2021-45258](https://cve.now/CVE-2021-45258.md): A stack overflow vulnerability exists in gpac 1.1.0 via the gf\_bifs\_dec\_proto\_list function, which causes a segmentation fault and applicati (no CVSS)
- [CVE-2021-39013](https://cve.now/CVE-2021-39013.md): IBM Cloud Pak for Security (CP4S) 1.7.2.0, 1.7.1.0, and 1.7.0.0 could allow an authenticated user to obtain sensitive information in HTTP re (CVSS 4.3, IBM Cloud Pak for Security)
- [CVE-2021-45257](https://cve.now/CVE-2021-45257.md): An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste\_tokens function. (no CVSS)
- [CVE-2021-45256](https://cve.now/CVE-2021-45256.md): A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c. (no CVSS)
- [CVE-2021-45419](https://cve.now/CVE-2021-45419.md): Certain Starcharge products are affected by Improper Input Validation. (no CVSS)
- [CVE-2021-45418](https://cve.now/CVE-2021-45418.md): Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. (no CVSS)
- [CVE-2021-36750](https://cve.now/CVE-2021-36750.md): ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau (no CVSS)
- [CVE-2021-40612](https://cve.now/CVE-2021-40612.md): An issue was discovered in Opmantek Open-AudIT after 3.5.0. (no CVSS)
- [CVE-2021-40836](https://cve.now/CVE-2021-40836.md): Denial-of-Service (DoS) Vulnerability (CVSS 4.6, F-Secure endpoint protection products on Windows and Mac. F…)
- [CVE-2021-45459](https://cve.now/CVE-2021-45459.md): lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter. (no CVSS, node-windows)
- [CVE-2021-44029](https://cve.now/CVE-2021-44029.md): An issue was discovered in Quest KACE Desktop Authority before 11.2. (no CVSS)
- [CVE-2021-44031](https://cve.now/CVE-2021-44031.md): An issue was discovered in Quest KACE Desktop Authority before 11.2. (no CVSS)
- [CVE-2021-44030](https://cve.now/CVE-2021-44030.md): Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method (no CVSS)
- [CVE-2021-44028](https://cve.now/CVE-2021-44028.md): XXE can occur in Quest KACE Desktop Authority before 11.2 because the log4net configuration file might be controlled by an attacker, a relat (no CVSS)
- [CVE-2021-37706](https://cve.now/CVE-2021-37706.md): Potential integer underflow upon receiving STUN message in PJSIP (CVSS 7.3, pjsip pjproject)
- [CVE-2021-40393](https://cve.now/CVE-2021-40393.md): An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5 (CVSS 10.0, Gerbv)
- [CVE-2021-40394](https://cve.now/CVE-2021-40394.md): An out-of-bounds write vulnerability exists in the RS-274X aperture macro variables handling functionality of Gerbv 2.7.0 and dev (commit b5 (CVSS 10.0, Gerbv)
- [CVE-2021-43804](https://cve.now/CVE-2021-43804.md): Out-of-bounds read when parsing RTCP BYE message in PJSIP (CVSS 7.3, pjsip pjproject)
- [CVE-2021-44733](https://cve.now/CVE-2021-44733.md): A use-after-free exists in drivers/tee/tee\_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. (no CVSS)
- [CVE-2021-45262](https://cve.now/CVE-2021-45262.md): An invalid free vulnerability exists in gpac 1.1.0 via the gf\_sg\_command\_del function, which causes a segmentation fault and application cra (no CVSS)
- [CVE-2021-45263](https://cve.now/CVE-2021-45263.md): An invalid free vulnerability exists in gpac 1.1.0 via the gf\_svg\_delete\_attribute\_value function, which causes a segmentation fault and app (no CVSS)
- [CVE-2021-45267](https://cve.now/CVE-2021-45267.md): An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svg\_node\_start function, which causes a segmentation fault (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.