# CVEs published 2021-12-30

50 CVEs were published on December 30, 2021: 0 critical, 6 high. Days are UTC.

- [CVE-2021-44466](https://cve.now/CVE-2021-44466.md): Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. (no CVSS, Bitmask Riseup VPN)
- [CVE-2021-20174](https://cve.now/CVE-2021-20174.md): Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-20175](https://cve.now/CVE-2021-20175.md): Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-20173](https://cve.now/CVE-2021-20173.md): Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-45077](https://cve.now/CVE-2021-45077.md): Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-23147](https://cve.now/CVE-2021-23147.md): Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-45732](https://cve.now/CVE-2021-45732.md): Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. (no CVSS, Netgear Nighthawk R6700)
- [CVE-2021-20172](https://cve.now/CVE-2021-20172.md): All known versions of the Netgear Genie Installer for macOS contain a local privilege escalation vulnerability. (no CVSS, Netgear Genie Installer for macOS)
- [CVE-2021-20169](https://cve.now/CVE-2021-20169.md): Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. (no CVSS, Netgear RAX43)
- [CVE-2021-20167](https://cve.now/CVE-2021-20167.md): Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. (no CVSS, Netgear RAX43)
- [CVE-2021-20168](https://cve.now/CVE-2021-20168.md): Netgear RAX43 version 1.0.3.96 does not have sufficient protections to the UART interface. (no CVSS, Netgear RAX43)
- [CVE-2021-20166](https://cve.now/CVE-2021-20166.md): Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. (no CVSS, Netgear RAX43)
- [CVE-2021-20170](https://cve.now/CVE-2021-20170.md): Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. (no CVSS, Netgear RAX43)
- [CVE-2021-20171](https://cve.now/CVE-2021-20171.md): Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. (no CVSS, Netgear RAX43)
- [CVE-2021-20165](https://cve.now/CVE-2021-20165.md): Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20164](https://cve.now/CVE-2021-20164.md): Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20150](https://cve.now/CVE-2021-20150.md): Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20151](https://cve.now/CVE-2021-20151.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20149](https://cve.now/CVE-2021-20149.md): Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20163](https://cve.now/CVE-2021-20163.md): Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20161](https://cve.now/CVE-2021-20161.md): Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient protections for the UART functionality. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20162](https://cve.now/CVE-2021-20162.md): Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20160](https://cve.now/CVE-2021-20160.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20155](https://cve.now/CVE-2021-20155.md): Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20153](https://cve.now/CVE-2021-20153.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20154](https://cve.now/CVE-2021-20154.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20152](https://cve.now/CVE-2021-20152.md): Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20159](https://cve.now/CVE-2021-20159.md): Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20157](https://cve.now/CVE-2021-20157.md): It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20158](https://cve.now/CVE-2021-20158.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20156](https://cve.now/CVE-2021-20156.md): Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware updat (no CVSS, Trendnet AC2600 TEW-827DRU)
- [CVE-2021-20134](https://cve.now/CVE-2021-20134.md): Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allow (no CVSS, Quagga Services on D-Link DIR-2640 Routers)
- [CVE-2021-20132](https://cve.now/CVE-2021-20132.md): Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attack (no CVSS, Quagga Services on D-Link DIR-2640 Routers)
- [CVE-2021-20133](https://cve.now/CVE-2021-20133.md): Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allow (no CVSS, Quagga Services on D-Link DIR-2640 Routers)
- [CVE-2021-45379](https://cve.now/CVE-2021-45379.md): Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. (no CVSS)
- [CVE-2021-38876](https://cve.now/CVE-2021-38876.md): IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. (CVSS 6.1, IBM i)
- [CVE-2020-29292](https://cve.now/CVE-2020-29292.md): iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range (no CVSS)
- [CVE-2021-43862](https://cve.now/CVE-2021-43862.md): Self XSS on user input (CVSS 3.7, jcubic jquery.terminal · jquery.terminal)
- [CVE-2021-43861](https://cve.now/CVE-2021-43861.md): Incorrect sanitisation function leads to \`XSS\` (CVSS 7.2, mermaid-js mermaid · mermaid)
- [CVE-2021-45815](https://cve.now/CVE-2021-45815.md): Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-45818](https://cve.now/CVE-2021-45818.md): SAFARI Montage 8.7.32 is affected by a CRLF injection vulnerability which can lead to HTTP response splitting. (no CVSS)
- [CVE-2021-45427](https://cve.now/CVE-2021-45427.md): Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. (no CVSS)
- [CVE-2021-4188](https://cve.now/CVE-2021-4188.md): NULL Pointer Dereference in mruby/mruby (CVSS 6.8, mruby/mruby)
- [CVE-2021-4181](https://cve.now/CVE-2021-4181.md): Crash in the Sysdig Event dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture (CVSS 7.5, Wireshark Foundation Wireshark)
- [CVE-2021-4182](https://cve.now/CVE-2021-4182.md): Crash in the RFC 7468 dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file (CVSS 7.5, Wireshark Foundation Wireshark)
- [CVE-2021-4183](https://cve.now/CVE-2021-4183.md): Crash in the pcapng file parser in Wireshark 3.6.0 allows denial of service via crafted capture file (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2021-4184](https://cve.now/CVE-2021-4184.md): Infinite loop in the BitTorrent DHT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafte (CVSS 7.5, Wireshark Foundation Wireshark)
- [CVE-2021-4185](https://cve.now/CVE-2021-4185.md): Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture (CVSS 7.5, Wireshark Foundation Wireshark)
- [CVE-2021-4186](https://cve.now/CVE-2021-4186.md): Crash in the Gryphon dissector in Wireshark 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2021-4190](https://cve.now/CVE-2021-4190.md): Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file (CVSS 7.5, Wireshark Foundation Wireshark)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.