# CVEs published 2021-12-28 28 CVEs were published on December 28, 2021: 0 critical, 2 high. Days are UTC. - [CVE-2021-44832](https://cve.now/CVE-2021-44832.md): Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (CVSS 6.6, Apache Software Foundation Apache Log4j2 · org.apache.lo… +1) - [CVE-2020-22061](https://cve.now/CVE-2020-22061.md): SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. (no CVSS) - [CVE-2020-22057](https://cve.now/CVE-2020-22057.md): The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default (no CVSS) - [CVE-2020-7883](https://cve.now/CVE-2020-7883.md): Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote fil (no CVSS, WOWSOFT Printchaser) - [CVE-2020-7878](https://cve.now/CVE-2020-7878.md): An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). (no CVSS, 4NB VideoOffice) - [CVE-2021-43554](https://cve.now/CVE-2021-43554.md): FATEK Automation WinProladder (CVSS 7.8, FATEK Automation WinProladder) - [CVE-2021-43556](https://cve.now/CVE-2021-43556.md): FATEK Automation WinProladder (CVSS 7.8, FATEK Automation WinProladder) - [CVE-2021-42583](https://cve.now/CVE-2021-42583.md): A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the expo (no CVSS, github.com/foxcpp/maddy) - [CVE-2021-45814](https://cve.now/CVE-2021-45814.md): Nettmp NNT 5.1 is affected by a SQL injection vulnerability. (no CVSS) - [CVE-2021-45813](https://cve.now/CVE-2021-45813.md): SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS) - [CVE-2021-45812](https://cve.now/CVE-2021-45812.md): NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS) - [CVE-2021-45903](https://cve.now/CVE-2021-45903.md): A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a (no CVSS) - [CVE-2019-20082](https://cve.now/CVE-2019-20082.md): ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan\_dns1\_x or lan\_dns2\_x parameter to Advanced\_LAN\_Content.asp. (no CVSS) - [CVE-2018-17875](https://cve.now/CVE-2018-17875.md): A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands (no CVSS) - [CVE-2021-45425](https://cve.now/CVE-2021-45425.md): Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes. (no CVSS) - [CVE-2021-37400](https://cve.now/CVE-2021-37400.md): An attacker may obtain the user credentials from the communication between the PLC and the software. (no CVSS) - [CVE-2021-37401](https://cve.now/CVE-2021-37401.md): An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. (no CVSS) - [CVE-2021-40579](https://cve.now/CVE-2021-40579.md): https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access (no CVSS) - [CVE-2021-35032](https://cve.now/CVE-2021-35032.md): A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbit (CVSS 6.4, Zyxel GS1900 series firmware) - [CVE-2021-35031](https://cve.now/CVE-2021-35031.md): A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow (CVSS 6.8, Zyxel GS1900 series firmware · Zyxel XGS1210 series firm… +1) - [CVE-2021-4179](https://cve.now/CVE-2021-4179.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.6, livehelperchat/livehelperchat) - [CVE-2021-4177](https://cve.now/CVE-2021-4177.md): Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat (CVSS 4.3, livehelperchat/livehelperchat) - [CVE-2021-20873](https://cve.now/CVE-2021-20873.md): Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. (no CVSS, Yappli) - [CVE-2021-45908](https://cve.now/CVE-2021-45908.md): An issue was discovered in gif2apng 1.9. (no CVSS) - [CVE-2021-45909](https://cve.now/CVE-2021-45909.md): An issue was discovered in gif2apng 1.9. (no CVSS) - [CVE-2021-45910](https://cve.now/CVE-2021-45910.md): An issue was discovered in gif2apng 1.9. (no CVSS) - [CVE-2021-45911](https://cve.now/CVE-2021-45911.md): An issue was discovered in gif2apng 1.9. (no CVSS) - [CVE-2021-45907](https://cve.now/CVE-2021-45907.md): An issue was discovered in gif2apng 1.9. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2021-12-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.