# CVEs published 2021-12-27

54 CVEs were published on December 27, 2021: 2 critical, 6 high. Days are UTC.

- [CVE-2021-45904](https://cve.now/CVE-2021-45904.md): OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen. (no CVSS)
- [CVE-2021-45905](https://cve.now/CVE-2021-45905.md): OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen. (no CVSS)
- [CVE-2021-45906](https://cve.now/CVE-2021-45906.md): OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen. (no CVSS)
- [CVE-2020-21238](https://cve.now/CVE-2020-21238.md): An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. (no CVSS)
- [CVE-2020-21237](https://cve.now/CVE-2020-21237.md): An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks. (no CVSS)
- [CVE-2020-21236](https://cve.now/CVE-2020-21236.md): A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts (no CVSS)
- [CVE-2021-45884](https://cve.now/CVE-2021-45884.md): In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, (no CVSS)
- [CVE-2021-45896](https://cve.now/CVE-2021-45896.md): Nokia FastMile 3TG00118ABAD52 devices allow privilege escalation by an authenticated user via is\_ctc\_admin=1 to login\_web\_app.cgi and use of (no CVSS)
- [CVE-2021-43858](https://cve.now/CVE-2021-43858.md): User privilege escalation in MinIO (CVSS 8.8, minio)
- [CVE-2020-20948](https://cve.now/CVE-2020-20948.md): An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variab (no CVSS)
- [CVE-2020-20946](https://cve.now/CVE-2020-20946.md): Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add. (no CVSS)
- [CVE-2020-20944](https://cve.now/CVE-2020-20944.md): An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files. (no CVSS)
- [CVE-2020-20945](https://cve.now/CVE-2020-20945.md): A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add admi (no CVSS)
- [CVE-2020-20943](https://cve.now/CVE-2020-20943.md): A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arb (no CVSS)
- [CVE-2021-45895](https://cve.now/CVE-2021-45895.md): Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface. (no CVSS, netgen/tagsbundle)
- [CVE-2021-45890](https://cve.now/CVE-2021-45890.md): basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. (no CVSS)
- [CVE-2021-21750](https://cve.now/CVE-2021-21750.md): ZTE BigVideo Analysis product has a privilege escalation vulnerability. (no CVSS, ZXIN10 CMS)
- [CVE-2021-21751](https://cve.now/CVE-2021-21751.md): ZTE BigVideo analysis product has an input verification vulnerability. (no CVSS, ZXIN10 CMS)
- [CVE-2021-23244](https://cve.now/CVE-2021-23244.md): ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But some apps in whitelis (no CVSS, OPPO Android Phone)
- [CVE-2021-43550](https://cve.now/CVE-2021-43550.md): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic Algorithm (CVSS 5.9, Philips Efficia CM Series · Philips Patient Information Cen…)
- [CVE-2021-43548](https://cve.now/CVE-2021-43548.md): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation (CVSS 6.5, Philips Patient Information Center iX)
- [CVE-2021-43552](https://cve.now/CVE-2021-43552.md): Philips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key (CVSS 6.1, Philips Patient Information Center iX)
- [CVE-2021-33017](https://cve.now/CVE-2021-33017.md): Philips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel (CVSS 8.1, Philips IntelliBridge EC 40 Hub · Philips IntelliBridge EC…)
- [CVE-2021-32993](https://cve.now/CVE-2021-32993.md): Philips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials (CVSS 8.1, Philips IntelliBridge EC 40 Hub · Philips IntelliBridge EC…)
- [CVE-2021-4161](https://cve.now/CVE-2021-4161.md): ICSA-21-357-01 Moxa MGate Protocol Gateways (CVSS 9.8, Moxa MGate MB3180 Series · Moxa MGate MB3280 Series +1)
- [CVE-2021-35232](https://cve.now/CVE-2021-35232.md): Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries (CVSS 6.8, SolarWinds Web Help Desk)
- [CVE-2021-43857](https://cve.now/CVE-2021-43857.md): Gerapy may contain remote code execution vulnerability (CVSS 9.8, Gerapy)
- [CVE-2021-43855](https://cve.now/CVE-2021-43855.md): Stored XSS via SVG in Requarks/wiki (CVSS 8.2, Requarks wiki)
- [CVE-2021-43856](https://cve.now/CVE-2021-43856.md): Stored XSS in non-image uploads in Requarks/wiki (CVSS 8.2, Requarks wiki)
- [CVE-2021-38961](https://cve.now/CVE-2021-38961.md): IBM OPENBMC OP910 is vulnerable to cross-site scripting. (CVSS 6.1, IBM OPENBMC)
- [CVE-2021-45232](https://cve.now/CVE-2021-45232.md): security vulnerability on unauthorized access. (no CVSS, Apache Software Foundation Apache APISIX Dashboard)
- [CVE-2021-45339](https://cve.now/CVE-2021-45339.md): Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted p (no CVSS)
- [CVE-2021-45338](https://cve.now/CVE-2021-45338.md): Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unn (no CVSS)
- [CVE-2021-45337](https://cve.now/CVE-2021-45337.md): Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to (no CVSS)
- [CVE-2021-45336](https://cve.now/CVE-2021-45336.md): Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated (no CVSS)
- [CVE-2021-45335](https://cve.now/CVE-2021-45335.md): Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of (no CVSS)
- [CVE-2021-4173](https://cve.now/CVE-2021-4173.md): Use After Free in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2021-45790](https://cve.now/CVE-2021-45790.md): An arbitrary file upload vulnerability was found in Metersphere v1.15.4. (no CVSS)
- [CVE-2021-45789](https://cve.now/CVE-2021-45789.md): An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the fil (no CVSS)
- [CVE-2021-45788](https://cve.now/CVE-2021-45788.md): Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter. (no CVSS)
- [CVE-2021-45843](https://cve.now/CVE-2021-45843.md): glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-24997](https://cve.now/CVE-2021-24997.md): WP Guppy \< 1.3 - Sensitive Information Disclosure (no CVSS, WP Guppy)
- [CVE-2021-24998](https://cve.now/CVE-2021-24998.md): Simple JWT Login \< 3.3.0 - Insecure Password Creation (no CVSS, Simple JWT Login)
- [CVE-2021-24992](https://cve.now/CVE-2021-24992.md): Buttonizer - Smart Floating Action Button \< 2.5.5 - Admin+ Stored Cross-Site Scripting (no CVSS, Smart Floating / Sticky Buttons – Call, Sharing, Chat Widge…)
- [CVE-2021-24984](https://cve.now/CVE-2021-24984.md): WPFront User Role Editor \< 3.2.1.11184 - Reflected Cross-Site Scripting (no CVSS, WPFront User Role Editor)
- [CVE-2021-24988](https://cve.now/CVE-2021-24988.md): WP RSS Aggregator \< 4.19.3 - Subscriber+ Stored Cross-Site Scripting (no CVSS, WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video…)
- [CVE-2021-24980](https://cve.now/CVE-2021-24980.md): Gwolle Guestbook \< 4.2.0 - Reflected Cross-Site Scripting (no CVSS, Gwolle Guestbook)
- [CVE-2021-24979](https://cve.now/CVE-2021-24979.md): Paid Memberships Pro \< 2.6.6 - Reflected Cross-Site Scripting (no CVSS, Paid Memberships Pro)
- [CVE-2021-24967](https://cve.now/CVE-2021-24967.md): Contact Form & Lead Form Elementor Builder \< 1.6.4 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Contact Form & Lead Form Elementor Builder)
- [CVE-2021-24969](https://cve.now/CVE-2021-24969.md): Download Manager \< 3.2.22 - Subscriber+ Stored Cross-Site Scripting (no CVSS, WordPress Download Manager)
- [CVE-2021-24902](https://cve.now/CVE-2021-24902.md): Typebot \< 1.4.3 - Admin+ Stored Cross Site Scripting (no CVSS, Typebot | Build beautiful conversational forms)
- [CVE-2021-24797](https://cve.now/CVE-2021-24797.md): Tickera \< 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting (no CVSS, Tickera – WordPress Event Ticketing)
- [CVE-2021-24753](https://cve.now/CVE-2021-24753.md): Rich Reviews by Starfish \< 1.9.6 - Admin+ SQL Injection (no CVSS, Rich Reviews by Starfish)
- [CVE-2021-43845](https://cve.now/CVE-2021-43845.md): Prevent out-of-bounds read in PJSIP (CVSS 8.2, pjsip pjproject)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.