# CVEs published 2021-12-24

15 CVEs were published on December 24, 2021: 1 critical, 3 high. Days are UTC.

- [CVE-2021-45480](https://cve.now/CVE-2021-45480.md): An issue was discovered in the Linux kernel before 5.15.11. (no CVSS)
- [CVE-2021-3977](https://cve.now/CVE-2021-3977.md): Cross-site Scripting (XSS) - Stored in invoiceninja/invoiceninja (CVSS 6.5, invoiceninja/invoiceninja · hillelcoren/invoice-ninja)
- [CVE-2021-23490](https://cve.now/CVE-2021-23490.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, parse-link-header)
- [CVE-2021-23574](https://cve.now/CVE-2021-23574.md): Prototype Pollution (CVSS 7.5, js-data)
- [CVE-2021-4072](https://cve.now/CVE-2021-4072.md): Cross-site Scripting (XSS) - Stored in elgg/elgg (CVSS 9.0, elgg/elgg)
- [CVE-2021-23772](https://cve.now/CVE-2021-23772.md): Arbitrary File Write (CVSS 7.5, github.com/kataras/iris · github.com/kataras/iris/v12)
- [CVE-2021-20876](https://cve.now/CVE-2021-20876.md): Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession (no CVSS, Japan Total System Co. GroupSession Free edition, GroupSess…)
- [CVE-2021-20875](https://cve.now/CVE-2021-20875.md): Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier, and GroupSession Z (no CVSS, Japan Total System Co. GroupSession Free edition, GroupSess…)
- [CVE-2021-20874](https://cve.now/CVE-2021-20874.md): Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud (no CVSS, Japan Total System Co. GroupSession Free edition, GroupSess…)
- [CVE-2021-20827](https://cve.now/CVE-2021-20827.md): Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICR (no CVSS, IDEC PLC)
- [CVE-2021-20826](https://cve.now/CVE-2021-20826.md): Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series (no CVSS, IDEC PLC)
- [CVE-2021-45471](https://cve.now/CVE-2021-45471.md): In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. (no CVSS)
- [CVE-2021-45472](https://cve.now/CVE-2021-45472.md): In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 format (no CVSS)
- [CVE-2021-45473](https://cve.now/CVE-2021-45473.md): In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-informati (no CVSS)
- [CVE-2021-45474](https://cve.now/CVE-2021-45474.md): In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.