# CVEs published 2021-12-23

94 CVEs were published on December 23, 2021: 7 critical, 5 high. Days are UTC.

- [CVE-2020-35398](https://cve.now/CVE-2020-35398.md): An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumeration of usernames de (no CVSS)
- [CVE-2021-45470](https://cve.now/CVE-2021-45470.md): lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of s (no CVSS)
- [CVE-2021-3622](https://cve.now/CVE-2021-3622.md): A flaw was found in the hivex library. (no CVSS, hivex)
- [CVE-2021-27006](https://cve.now/CVE-2021-27006.md): StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may allow an administra (no CVSS, StorageGRID)
- [CVE-2021-27007](https://cve.now/CVE-2021-27007.md): NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when successfully exploited cou (no CVSS, NetApp Virtual Desktop Service)
- [CVE-2021-3584](https://cve.now/CVE-2021-3584.md): A server side remote code execution vulnerability was found in Foreman project. (no CVSS, foreman)
- [CVE-2021-4024](https://cve.now/CVE-2021-4024.md): A flaw was found in podman. (no CVSS, podman · github.com/containers/podman/v3 +2)
- [CVE-2021-44543](https://cve.now/CVE-2021-44543.md): An XSS vulnerability was found in Privoxy which was fixed in cgi\_error\_no\_template() by encode the template name when Privoxy is configured (no CVSS, privoxy)
- [CVE-2021-44542](https://cve.now/CVE-2021-44542.md): A memory leak vulnerability was found in Privoxy when handling errors. (no CVSS, Privoxy)
- [CVE-2021-44540](https://cve.now/CVE-2021-44540.md): A vulnerability was found in Privoxy which was fixed in get\_url\_spec\_param() by freeing memory of compiled pattern spec before bailing. (no CVSS, Privoxy)
- [CVE-2021-44541](https://cve.now/CVE-2021-44541.md): A vulnerability was found in Privoxy which was fixed in process\_encrypted\_request\_headers() by freeing header memory when failing to get the (no CVSS, Privoxy)
- [CVE-2021-20318](https://cve.now/CVE-2021-20318.md): The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. (no CVSS, Artemis in EAP)
- [CVE-2021-43985](https://cve.now/CVE-2021-43985.md): mySCADA myPRO (CVSS 9.1, mySCADA myPRO)
- [CVE-2021-43989](https://cve.now/CVE-2021-43989.md): mySCADA myPRO (CVSS 7.5, mySCADA myPRO)
- [CVE-2021-43981](https://cve.now/CVE-2021-43981.md): mySCADA myPRO (CVSS 10.0, mySCADA myPRO)
- [CVE-2021-44453](https://cve.now/CVE-2021-44453.md): mySCADA myPRO (CVSS 10.0, mySCADA myPRO)
- [CVE-2021-43984](https://cve.now/CVE-2021-43984.md): mySCADA myPRO (CVSS 10.0, mySCADA myPRO)
- [CVE-2021-22657](https://cve.now/CVE-2021-22657.md): mySCADA myPRO (CVSS 10.0, mySCADA myPRO)
- [CVE-2021-43987](https://cve.now/CVE-2021-43987.md): mySCADA myPRO (CVSS 9.8, mySCADA myPRO)
- [CVE-2021-23198](https://cve.now/CVE-2021-23198.md): mySCADA myPRO (CVSS 10.0, mySCADA myPRO)
- [CVE-2021-35243](https://cve.now/CVE-2021-35243.md): HTTP PUT & DELETE Methods Enabled (CVSS 5.3, SolarWinds Web Help Desk)
- [CVE-2020-3886](https://cve.now/CVE-2020-3886.md): A use after free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2021-30767](https://cve.now/CVE-2021-30767.md): A logic issue was addressed with improved state management. (no CVSS, Apple watchOS · Apple iOS and iPadOS +1)
- [CVE-2020-3896](https://cve.now/CVE-2020-3896.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2019-8702](https://cve.now/CVE-2019-8702.md): This issue was addressed with a new entitlement. (no CVSS, Apple iOS · Apple macOS)
- [CVE-2017-13908](https://cve.now/CVE-2017-13908.md): An issue in handling file permissions was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2019-8703](https://cve.now/CVE-2019-8703.md): This issue was addressed with improved entitlements. (no CVSS, Apple tvOS · Apple iOS +2)
- [CVE-2018-4302](https://cve.now/CVE-2018-4302.md): A null pointer dereference was addressed with improved validation. (no CVSS, Apple iOS · Apple watchOS +3)
- [CVE-2019-8643](https://cve.now/CVE-2019-8643.md): CVE-2019-8643: Arun Sharma of VMWare This issue is fixed in macOS Mojave 10.14. (no CVSS, Apple macOS)
- [CVE-2017-13910](https://cve.now/CVE-2017-13910.md): An access issue was addressed with additional sandbox restrictions on applications. (no CVSS, Apple macOS)
- [CVE-2018-4478](https://cve.now/CVE-2018-4478.md): A validation issue was addressed with improved logic. (no CVSS, Apple macOS)
- [CVE-2017-13909](https://cve.now/CVE-2017-13909.md): An issue existed in the storage of sensitive tokens. (no CVSS, Apple macOS)
- [CVE-2017-13906](https://cve.now/CVE-2017-13906.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2017-13907](https://cve.now/CVE-2017-13907.md): A state management issue was addressed with improved state validation. (no CVSS, Apple macOS)
- [CVE-2017-13892](https://cve.now/CVE-2017-13892.md): An issue existed in the handling of Contact sharing. (no CVSS, Apple macOS)
- [CVE-2017-13835](https://cve.now/CVE-2017-13835.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2017-13880](https://cve.now/CVE-2017-13880.md): A memory corruption issue was addressed with improved memory handling. (no CVSS, Apple watchOS · Apple iOS)
- [CVE-2017-13905](https://cve.now/CVE-2017-13905.md): A race condition was addressed with additional validation. (no CVSS, Apple watchOS · Apple tvOS +1)
- [CVE-2017-2375](https://cve.now/CVE-2017-2375.md): An issue existed in preventing the uploading of CallKit call history to iCloud. (no CVSS, Apple iOS)
- [CVE-2017-2488](https://cve.now/CVE-2017-2488.md): A cryptographic weakness existed in the authentication protocol of Remote Desktop. (no CVSS, Apple Remote Desktop)
- [CVE-2021-45469](https://cve.now/CVE-2021-45469.md): In \_\_f2fs\_setxattr in fs/f2fs/xattr.c in the Linux kernel through 5.15.11, there is an out-of-bounds memory access when an inode has an inva (no CVSS)
- [CVE-2021-40161](https://cve.now/CVE-2021-40161.md): A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 versio (no CVSS, Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…)
- [CVE-2021-40160](https://cve.now/CVE-2021-40160.md): PDFTron prior to 9.0.7 version may be forced to read beyond allocated boundaries when parsing a maliciously crafted PDF file. (no CVSS, Revit, Navisworks, Autodesk® Advance Steel, AutoCAD®, AutoC…)
- [CVE-2021-43854](https://cve.now/CVE-2021-43854.md): Inefficient Regular Expression Complexity in nltk (CVSS 7.5, nltk)
- [CVE-2021-4118](https://cve.now/CVE-2021-4118.md): Deserialization of Untrusted Data in pytorchlightning/pytorch-lightning (CVSS 7.8, pytorchlightning/pytorch-lightning · lightning +1)
- [CVE-2021-43849](https://cve.now/CVE-2021-43849.md): DoS vulnerability (CVSS 6.2, NiklasMerz cordova-plugin-fingerprint-aio · cordova-plugin-…)
- [CVE-2021-23175](https://cve.now/CVE-2021-23175.md): NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access c (CVSS 8.2, NVIDIA GeForce Experience Software)
- [CVE-2021-44526](https://cve.now/CVE-2021-44526.md): Zoho ManageEngine ServiceDesk Plus before 12003 allows authentication bypass in certain admin configurations. (no CVSS)
- [CVE-2021-44600](https://cve.now/CVE-2021-44600.md): The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through th (no CVSS)
- [CVE-2021-44599](https://cve.now/CVE-2021-44599.md): The id parameter from Online Enrollment Management System 1.0 system appears to be vulnerable to SQL injection attacks. (no CVSS)
- [CVE-2021-44548](https://cve.now/CVE-2021-44548.md): Apache Solr information disclosure vulnerability through DataImportHandler (no CVSS, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2021-4144](https://cve.now/CVE-2021-4144.md): TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection. (no CVSS, TP-LINK TL-WR802N)
- [CVE-2021-45463](https://cve.now/CVE-2021-45463.md): load\_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. (no CVSS)
- [CVE-2021-20050](https://cve.now/CVE-2021-20050.md): An Improper Access Control Vulnerability in the SMA100 series leads to multiple restricted management APIs being accessible without a user l (no CVSS, SonicWall SMA100)
- [CVE-2021-20049](https://cve.now/CVE-2021-20049.md): A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration base (no CVSS, SonicWall SMA100)
- [CVE-2021-4079](https://cve.now/CVE-2021-4079.md): Out of bounds write in WebRTC in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via cr (no CVSS, Google Chrome)
- [CVE-2021-4078](https://cve.now/CVE-2021-4078.md): Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-4068](https://cve.now/CVE-2021-4068.md): Insufficient data validation in new tab page in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via (no CVSS, Google Chrome)
- [CVE-2021-4067](https://cve.now/CVE-2021-4067.md): Use after free in window manager in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2021-4066](https://cve.now/CVE-2021-4066.md): Integer underflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2021-4065](https://cve.now/CVE-2021-4065.md): Use after free in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2021-4064](https://cve.now/CVE-2021-4064.md): Use after free in screen capture in Google Chrome on ChromeOS prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap co (no CVSS, Google Chrome)
- [CVE-2021-4063](https://cve.now/CVE-2021-4063.md): Use after free in developer tools in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2021-4062](https://cve.now/CVE-2021-4062.md): Heap buffer overflow in BFCache in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to (no CVSS, Google Chrome)
- [CVE-2021-4061](https://cve.now/CVE-2021-4061.md): Type confusion in V8 in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-4059](https://cve.now/CVE-2021-4059.md): Insufficient data validation in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to leak cross-origin data via a craf (no CVSS, Google Chrome)
- [CVE-2021-4058](https://cve.now/CVE-2021-4058.md): Heap buffer overflow in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-4057](https://cve.now/CVE-2021-4057.md): Use after free in file API in Google Chrome prior to 96.0.4664.93 allowed a remote attacker who had compromised the renderer process to pote (no CVSS, Google Chrome)
- [CVE-2021-4056](https://cve.now/CVE-2021-4056.md): Type confusion in loader in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-4055](https://cve.now/CVE-2021-4055.md): Heap buffer overflow in extensions in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious ex (no CVSS, Google Chrome)
- [CVE-2021-4054](https://cve.now/CVE-2021-4054.md): Incorrect security UI in autofill in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform domain spoofing via a crafted (no CVSS, Google Chrome)
- [CVE-2021-4053](https://cve.now/CVE-2021-4053.md): Use after free in UI in Google Chrome on Linux prior to 96.0.4664.93 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2021-4052](https://cve.now/CVE-2021-4052.md): Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension (no CVSS, Google Chrome)
- [CVE-2021-38022](https://cve.now/CVE-2021-38022.md): Inappropriate implementation in WebAuthentication in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data (no CVSS, Google Chrome)
- [CVE-2021-38021](https://cve.now/CVE-2021-38021.md): Inappropriate implementation in referrer in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation restrictions (no CVSS, Google Chrome)
- [CVE-2021-38020](https://cve.now/CVE-2021-38020.md): Insufficient policy enforcement in contacts picker in Google Chrome on Android prior to 96.0.4664.45 allowed a remote attacker to spoof the (no CVSS, Google Chrome)
- [CVE-2021-38019](https://cve.now/CVE-2021-38019.md): Insufficient policy enforcement in CORS in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a cra (no CVSS, Google Chrome)
- [CVE-2021-38018](https://cve.now/CVE-2021-38018.md): Inappropriate implementation in navigation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to perform domain spoofing via a (no CVSS, Google Chrome)
- [CVE-2021-38017](https://cve.now/CVE-2021-38017.md): Insufficient policy enforcement in iframe sandbox in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass navigation rest (no CVSS, Google Chrome)
- [CVE-2021-38016](https://cve.now/CVE-2021-38016.md): Insufficient policy enforcement in background fetch in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to bypass same origin p (no CVSS, Google Chrome)
- [CVE-2021-38015](https://cve.now/CVE-2021-38015.md): Inappropriate implementation in input in Google Chrome prior to 96.0.4664.45 allowed an attacker who convinced a user to install a malicious (no CVSS, Google Chrome)
- [CVE-2021-38014](https://cve.now/CVE-2021-38014.md): Out of bounds write in Swiftshader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption v (no CVSS, Google Chrome)
- [CVE-2021-38013](https://cve.now/CVE-2021-38013.md): Heap buffer overflow in fingerprint recognition in Google Chrome on ChromeOS prior to 96.0.4664.45 allowed a remote attacker who had comprom (no CVSS, Google Chrome)
- [CVE-2021-38012](https://cve.now/CVE-2021-38012.md): Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-38011](https://cve.now/CVE-2021-38011.md): Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-38010](https://cve.now/CVE-2021-38010.md): Inappropriate implementation in service workers in Google Chrome prior to 96.0.4664.45 allowed a remote attacker who had compromised the ren (no CVSS, Google Chrome)
- [CVE-2021-38009](https://cve.now/CVE-2021-38009.md): Inappropriate implementation in cache in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to leak cross-origin data via a craft (no CVSS, Google Chrome)
- [CVE-2021-38008](https://cve.now/CVE-2021-38008.md): Use after free in media in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafte (no CVSS, Google Chrome)
- [CVE-2021-38007](https://cve.now/CVE-2021-38007.md): Type confusion in V8 in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a crafted H (no CVSS, Google Chrome)
- [CVE-2021-38006](https://cve.now/CVE-2021-38006.md): Use after free in storage foundation in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption (no CVSS, Google Chrome)
- [CVE-2021-38005](https://cve.now/CVE-2021-38005.md): Use after free in loader in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2021-3621](https://cve.now/CVE-2021-3621.md): A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands (no CVSS, sssd)
- [CVE-2021-44273](https://cve.now/CVE-2021-44273.md): e2guardian v5.4.x \<= v5.4.3r is affected by missing SSL certificate validation in the SSL MITM engine. (no CVSS)
- [CVE-2021-45462](https://cve.now/CVE-2021-45462.md): In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.