# CVEs published 2021-12-29

21 CVEs were published on December 29, 2021: 0 critical, 8 high. Days are UTC.

- [CVE-2021-43876](https://cve.now/CVE-2021-43876.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2021-4187](https://cve.now/CVE-2021-4187.md): Use After Free in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2021-36724](https://cve.now/CVE-2021-36724.md): ForeScout - SecureConnector Local Service DoS (CVSS 6.1, ForeScout eServices / eNvoice)
- [CVE-2021-25993](https://cve.now/CVE-2021-25993.md): Requarks wiki.js - Stored Cross-Site Scripting (XSS) in markdown editor (CVSS 5.4, Requarks wiki)
- [CVE-2021-23727](https://cve.now/CVE-2021-23727.md): Stored Command Injection (CVSS 7.5, celery)
- [CVE-2021-45885](https://cve.now/CVE-2021-45885.md): An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). (no CVSS)
- [CVE-2021-4175](https://cve.now/CVE-2021-4175.md): Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat (CVSS 6.6, livehelperchat/livehelperchat)
- [CVE-2021-4176](https://cve.now/CVE-2021-4176.md): Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat (CVSS 5.4, livehelperchat/livehelperchat)
- [CVE-2021-36722](https://cve.now/CVE-2021-36722.md): Emuse - eServices / eNvoice SQL injection (CVSS 7.1, Emuse eServices / eNvoice)
- [CVE-2021-36723](https://cve.now/CVE-2021-36723.md): Emuse - eServices / eNvoice Exposure Of Private Personal Information (CVSS 6.1, Emuse eServices / eNvoice)
- [CVE-2021-38688](https://cve.now/CVE-2021-38688.md): Improper Authentication in Qfile (CVSS 7.1, QNAP Systems Qfile)
- [CVE-2021-38687](https://cve.now/CVE-2021-38687.md): Stack Overflow Vulnerability in Surveillance Station (CVSS 8.1, QNAP Systems Surveillance Station)
- [CVE-2021-38680](https://cve.now/CVE-2021-38680.md): Reflected XSS in Kazoo Server (CVSS 5.3, Linn Products Limited Kazoo Server)
- [CVE-2021-35035](https://cve.now/CVE-2021-35035.md): A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obt (CVSS 4.9, Zyxel NBG6604 series firmware)
- [CVE-2021-35034](https://cve.now/CVE-2021-35034.md): An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access th (CVSS 7.4, Zyxel NBG6604 series firmware)
- [CVE-2021-25991](https://cve.now/CVE-2021-25991.md): ifme - Improper Access Control leads to admin deactivation (CVSS 5.7, ifmeorg ifme)
- [CVE-2021-25990](https://cve.now/CVE-2021-25990.md): ifme - Stored Cross-Site Scripting (XSS) in Contacts section (CVSS 5.4, ifmeorg ifme)
- [CVE-2021-25989](https://cve.now/CVE-2021-25989.md): ifme - Stored Cross-Site Scripting (XSS) in Groups section (CVSS 5.4, ifmeorg ifme)
- [CVE-2021-25988](https://cve.now/CVE-2021-25988.md): ifme - Stored Cross-Site Scripting (XSS) in Notifications section (CVSS 5.4, ifmeorg ifme)
- [CVE-2021-44161](https://cve.now/CVE-2021-44161.md): Changing Information Technology Inc. MOTP(Mobile One Time Password) - SQL Injection (CVSS 8.8, Changing MOTP)
- [CVE-2021-44160](https://cve.now/CVE-2021-44160.md): Carinal Tien Hospital Health Report System - Authorization Bypass Through User-Controlled Key (CVSS 7.3, Carinal Tien Hospital Health Report System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.