CVEs published December 24, 2021
15 CVEs were published on December 24, 2021: 1 critical, 3 high.
- Published
- 15
- Critical
- 1
- High
- 3
- Medium
- 1
- Low
- 0
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Japan Total System Co. GroupSession Free edition, GroupSess…
- 3
- IDEC PLC
- 2
- elgg/elgg
- 1
- github.com/kataras/iris · github.com/kataras/iris/v12
- 1
- invoiceninja/invoiceninja · hillelcoren/invoice-ninja
- 1
- js-data
- 1
- parse-link-header
- 1
Critical 1
High 3
Medium, low and unrated 11
- CVE-2021-45480An issue was discovered in the Linux kernel before 5.15.11.
- CVE-2021-3977Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninjainvoiceninja/invoiceninja · hillelcoren/invoice-ninja
- CVE-2021-20876Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession Japan Total System Co. GroupSession Free edition, GroupSess…
- CVE-2021-20875Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession ZJapan Total System Co. GroupSession Free edition, GroupSess…
- CVE-2021-20874Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud Japan Total System Co. GroupSession Free edition, GroupSess…
- CVE-2021-20827Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICRIDEC PLC
- CVE-2021-20826Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A SeriesIDEC PLC
- CVE-2021-45471In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
- CVE-2021-45472In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 format
- CVE-2021-45473In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-informati
- CVE-2021-45474In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.