CVEs published December 27, 2021
54 CVEs were published on December 27, 2021: 2 critical, 6 high.
- Published
- 54
- Critical
- 2
- High
- 6
- Medium
- 6
- Low
- 0
- Unrated
- 40
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Philips IntelliBridge EC 40 Hub · Philips IntelliBridge EC…
- 2
- Philips Patient Information Center iX
- 2
- Requarks wiki
- 2
- ZXIN10 CMS
- 2
- Apache Software Foundation Apache APISIX Dashboard
- 1
- Contact Form & Lead Form Elementor Builder
- 1
- Gerapy
- 1
- Gwolle Guestbook
- 1
- IBM OPENBMC
- 1
- minio
- 1
Critical 2
High 6
- CVE-2021-43858User privilege escalation in MinIOminio
- CVE-2021-33017Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or ChannelPhilips IntelliBridge EC 40 Hub · Philips IntelliBridge EC…
- CVE-2021-32993Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded CredentialsPhilips IntelliBridge EC 40 Hub · Philips IntelliBridge EC…
- CVE-2021-43855Stored XSS via SVG in Requarks/wikiRequarks wiki
- CVE-2021-43856Stored XSS in non-image uploads in Requarks/wikiRequarks wiki
- CVE-2021-43845Prevent out-of-bounds read in PJSIPpjsip pjproject
Medium, low and unrated 46
- CVE-2021-45904OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.
- CVE-2021-45905OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.
- CVE-2021-45906OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.
- CVE-2020-21238An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
- CVE-2020-21237An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
- CVE-2020-21236A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts
- CVE-2021-45884In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled,
- CVE-2021-45896Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is_ctc_admin=1 to login_web_app.cgi and use of
- CVE-2020-20948An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variab
- CVE-2020-20946Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
- CVE-2020-20944An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
- CVE-2020-20945A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add admi
- CVE-2020-20943A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arb
- CVE-2021-45895Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.netgen/tagsbundle
- CVE-2021-45890basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.
- CVE-2021-21750ZTE BigVideo Analysis product has a privilege escalation vulnerability.ZXIN10 CMS
- CVE-2021-21751ZTE BigVideo analysis product has an input verification vulnerability.ZXIN10 CMS
- CVE-2021-23244ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelisOPPO Android Phone
- CVE-2021-43550Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic AlgorithmPhilips Efficia CM Series · Philips Patient Information Cen…
- CVE-2021-43548Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input ValidationPhilips Patient Information Center iX
- CVE-2021-43552Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic KeyPhilips Patient Information Center iX
- CVE-2021-35232Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate QueriesSolarWinds Web Help Desk
- CVE-2021-38961IBM OPENBMC OP910 is vulnerable to cross-site scripting.IBM OPENBMC
- CVE-2021-45232security vulnerability on unauthorized access.Apache Software Foundation Apache APISIX Dashboard
- CVE-2021-45339Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted p
- CVE-2021-45338Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unn
- CVE-2021-45337Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to
- CVE-2021-45336Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated
- CVE-2021-45335Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of
- CVE-2021-4173Use After Free in vim/vimvim/vim
- CVE-2021-45790An arbitrary file upload vulnerability was found in Metersphere v1.15.4.
- CVE-2021-45789An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the fil
- CVE-2021-45788Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.
- CVE-2021-45843glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability.
- CVE-2021-24997WP Guppy < 1.3 - Sensitive Information DisclosureWP Guppy
- CVE-2021-24998Simple JWT Login < 3.3.0 - Insecure Password CreationSimple JWT Login
- CVE-2021-24992Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site ScriptingSmart Floating / Sticky Buttons – Call, Sharing, Chat Widge…
- CVE-2021-24984WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site ScriptingWPFront User Role Editor
- CVE-2021-24988WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site ScriptingWP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…
- CVE-2021-24980Gwolle Guestbook < 4.2.0 - Reflected Cross-Site ScriptingGwolle Guestbook
- CVE-2021-24979Paid Memberships Pro < 2.6.6 - Reflected Cross-Site ScriptingPaid Memberships Pro
- CVE-2021-24967Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site ScriptingContact Form & Lead Form Elementor Builder
- CVE-2021-24969Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site ScriptingWordPress Download Manager
- CVE-2021-24902Typebot < 1.4.3 - Admin+ Stored Cross Site ScriptingTypebot | Build beautiful conversational forms
- CVE-2021-24797Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site ScriptingTickera – WordPress Event Ticketing
- CVE-2021-24753Rich Reviews by Starfish < 1.9.6 - Admin+ SQL InjectionRich Reviews by Starfish