CVEs published December 30, 2021
50 CVEs were published on December 30, 2021: 0 critical, 6 high.
- Published
- 50
- Critical
- 0
- High
- 6
- Medium
- 4
- Low
- 1
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Trendnet AC2600 TEW-827DRU
- 17
- Wireshark Foundation Wireshark
- 7
- Netgear Nighthawk R6700
- 6
- Netgear RAX43
- 6
- Quagga Services on D-Link DIR-2640 Routers
- 3
- Bitmask Riseup VPN
- 1
- IBM i
- 1
- jcubic jquery.terminal · jquery.terminal
- 1
- mermaid-js mermaid · mermaid
- 1
- mruby/mruby
- 1
High 6
- CVE-2021-43861Incorrect sanitisation function leads to `XSS`mermaid-js mermaid · mermaid
- CVE-2021-4181Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture Wireshark Foundation Wireshark
- CVE-2021-4182Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
- CVE-2021-4184Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafteWireshark Foundation Wireshark
- CVE-2021-4185Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted captureWireshark Foundation Wireshark
- CVE-2021-4190Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
Medium, low and unrated 44
- CVE-2021-44466Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls.Bitmask Riseup VPN
- CVE-2021-20174Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface.Netgear Nighthawk R6700
- CVE-2021-20175Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface.Netgear Nighthawk R6700
- CVE-2021-20173Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device.Netgear Nighthawk R6700
- CVE-2021-45077Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext.Netgear Nighthawk R6700
- CVE-2021-23147Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console.Netgear Nighthawk R6700
- CVE-2021-45732Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential.Netgear Nighthawk R6700
- CVE-2021-20172All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability.Netgear Genie Installer for macOS
- CVE-2021-20169Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface.Netgear RAX43
- CVE-2021-20167Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability.Netgear RAX43
- CVE-2021-20168Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface.Netgear RAX43
- CVE-2021-20166Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability.Netgear RAX43
- CVE-2021-20170Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials.Netgear RAX43
- CVE-2021-20171Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext.Netgear RAX43
- CVE-2021-20165Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections.Trendnet AC2600 TEW-827DRU
- CVE-2021-20164Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device.Trendnet AC2600 TEW-827DRU
- CVE-2021-20150Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard.Trendnet AC2600 TEW-827DRU
- CVE-2021-20151Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device.Trendnet AC2600 TEW-827DRU
- CVE-2021-20149Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface.Trendnet AC2600 TEW-827DRU
- CVE-2021-20163Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page.Trendnet AC2600 TEW-827DRU
- CVE-2021-20161Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality.Trendnet AC2600 TEW-827DRU
- CVE-2021-20162Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext.Trendnet AC2600 TEW-827DRU
- CVE-2021-20160Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device.Trendnet AC2600 TEW-827DRU
- CVE-2021-20155Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials.Trendnet AC2600 TEW-827DRU
- CVE-2021-20153Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality.Trendnet AC2600 TEW-827DRU
- CVE-2021-20154Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface.Trendnet AC2600 TEW-827DRU
- CVE-2021-20152Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality.Trendnet AC2600 TEW-827DRU
- CVE-2021-20159Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection.Trendnet AC2600 TEW-827DRU
- CVE-2021-20157It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command.Trendnet AC2600 TEW-827DRU
- CVE-2021-20158Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability.Trendnet AC2600 TEW-827DRU
- CVE-2021-20156Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware updatTrendnet AC2600 TEW-827DRU
- CVE-2021-20134Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allowQuagga Services on D-Link DIR-2640 Routers
- CVE-2021-20132Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attackQuagga Services on D-Link DIR-2640 Routers
- CVE-2021-20133Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allowQuagga Services on D-Link DIR-2640 Routers
- CVE-2021-45379Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability.
- CVE-2021-38876IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting.IBM i
- CVE-2020-29292iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range
- CVE-2021-43862Self XSS on user inputjcubic jquery.terminal · jquery.terminal
- CVE-2021-45815Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-45818SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting.
- CVE-2021-45427Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal.
- CVE-2021-4188NULL Pointer Dereference in mruby/mrubymruby/mruby
- CVE-2021-4183Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture fileWireshark Foundation Wireshark
- CVE-2021-4186Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark