CVEs published December 23, 2021
94 CVEs were published on December 23, 2021: 7 critical, 5 high.
- Published
- 94
- Critical
- 7
- High
- 5
- Medium
- 2
- Low
- 0
- Unrated
- 80
- Now in CISA KEV
- 0
- Fix available
- 60
Most affected products
- Google Chrome
- 36
- Apple macOS
- 11
- mySCADA myPRO
- 8
- Privoxy
- 3
- Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…
- 2
- SonicWall SMA100
- 2
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 1
- Apple iOS
- 1
- Apple iOS · Apple macOS
- 1
- Apple iOS · Apple watchOS +3
- 1
Critical 7
High 5
- CVE-2021-43989mySCADA myPROmySCADA myPRO
- CVE-2021-43854Inefficient Regular Expression Complexity in nltknltk
- CVE-2021-4118Deserialization of Untrusted Data in pytorchlightning/pytorch-lightningpytorchlightning/pytorch-lightning · lightning +1
- CVE-2021-23175NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access cNVIDIA GeForce Experience Software
- CVE-2021-45462In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.
Medium, low and unrated 82
- CVE-2020-35398An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames de
- CVE-2021-45470lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of s
- CVE-2021-3622A flaw was found in the hivex library.hivex
- CVE-2021-27006StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administraStorageGRID
- CVE-2021-27007NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited couNetApp Virtual Desktop Service
- CVE-2021-3584A server side remote code execution vulnerability was found in Foreman project.foreman
- CVE-2021-4024A flaw was found in podman.podman · github.com/containers/podman/v3 +2
- CVE-2021-44543An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Privoxy is configured privoxy
- CVE-2021-44542A memory leak vulnerability was found in Privoxy when handling errors.Privoxy
- CVE-2021-44540A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.Privoxy
- CVE-2021-44541A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get thePrivoxy
- CVE-2021-20318The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978.Artemis in EAP
- CVE-2021-35243HTTP PUT & DELETE Methods EnabledSolarWinds Web Help Desk
- CVE-2020-3886A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2021-30767A logic issue was addressed with improved state management.Apple watchOS · Apple iOS and iPadOS +1
- CVE-2020-3896This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2019-8702This issue was addressed with a new entitlement.Apple iOS · Apple macOS
- CVE-2017-13908An issue in handling file permissions was addressed with improved validation.Apple macOS
- CVE-2019-8703This issue was addressed with improved entitlements.Apple tvOS · Apple iOS +2
- CVE-2018-4302A null pointer dereference was addressed with improved validation.Apple iOS · Apple watchOS +3
- CVE-2019-8643CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14.Apple macOS
- CVE-2017-13910An access issue was addressed with additional sandbox restrictions on applications.Apple macOS
- CVE-2018-4478A validation issue was addressed with improved logic.Apple macOS
- CVE-2017-13909An issue existed in the storage of sensitive tokens.Apple macOS
- CVE-2017-13906A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2017-13907A state management issue was addressed with improved state validation.Apple macOS
- CVE-2017-13892An issue existed in the handling of Contact sharing.Apple macOS
- CVE-2017-13835A memory corruption issue was addressed with improved memory handling.Apple macOS
- CVE-2017-13880A memory corruption issue was addressed with improved memory handling.Apple watchOS · Apple iOS
- CVE-2017-13905A race condition was addressed with additional validation.Apple watchOS · Apple tvOS +1
- CVE-2017-2375An issue existed in preventing the uploading of CallKit call history to iCloud.Apple iOS
- CVE-2017-2488A cryptographic weakness existed in the authentication protocol of Remote Desktop.Apple Remote Desktop
- CVE-2021-45469In __f2fs_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an inva
- CVE-2021-40161A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 versioRevit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…
- CVE-2021-40160PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file.Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…
- CVE-2021-43849DoS vulnerabilityNiklasMerz cordova-plugin-fingerprint-aio · cordova-plugin-…
- CVE-2021-44526Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations.
- CVE-2021-44600The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through th
- CVE-2021-44599The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks.
- CVE-2021-44548Apache Solr information disclosure vulnerability through DataImportHandlerApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2021-4144TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.TP-LINK TL-WR802N
- CVE-2021-45463load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered.
- CVE-2021-20050An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user lSonicWall SMA100
- CVE-2021-20049A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration baseSonicWall SMA100
- CVE-2021-4079Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via crGoogle Chrome
- CVE-2021-4078Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-4068Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2021-4067Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2021-4066Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2021-4065Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2021-4064Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap coGoogle Chrome
- CVE-2021-4063Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2021-4062Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2021-4061Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-4059Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2021-4058Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-4057Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2021-4056Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-4055Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious exGoogle Chrome
- CVE-2021-4054Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted Google Chrome
- CVE-2021-4053Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2021-4052Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension Google Chrome
- CVE-2021-38022Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin dataGoogle Chrome
- CVE-2021-38021Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions Google Chrome
- CVE-2021-38020Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the Google Chrome
- CVE-2021-38019Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2021-38018Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via aGoogle Chrome
- CVE-2021-38017Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restGoogle Chrome
- CVE-2021-38016Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin pGoogle Chrome
- CVE-2021-38015Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a maliciousGoogle Chrome
- CVE-2021-38014Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2021-38013Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had compromGoogle Chrome
- CVE-2021-38012Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-38011Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-38010Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2021-38009Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2021-38008Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2021-38007Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HGoogle Chrome
- CVE-2021-38006Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2021-38005Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2021-3621A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommandssssd
- CVE-2021-44273e2guardian v5.4.x <= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine.