CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- fortinet fortiwebA improper neutralization of input during web page generation ('cross-site scripting') in...6.1 Medium
- fortinet fortiwebA improper neutralization of input during web page generation ('cross-site scripting') in...6.1 Medium
- fortinet fortiwebA unintended proxy or intermediary ('confused deputy') in Fortinet FortiWeb version 6.4.1 and...5.5 Medium
- fortinet fortiwebA uncontrolled resource consumption in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and...7.5 High
- fortinet fortiwebA url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and...4.1 Medium
- fortinet fortiwebA stack-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, allows an...7.3 High
- fortinet fortiwebA improper neutralization of input during web page generation ('cross-site scripting') in...6.1 Medium
- fortinet fortiwebA url redirection to untrusted site ('open redirect') in Fortinet FortiWeb version 6.4.1 and 6.4...4.3 Medium
- fortinet fortiosAn integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS...8.1 High
- fortinet fortiosA use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may...7.5 High
- fortinet fortios, fortiproxy +1 moreA relative path traversal [CWE-23] vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and...7.5 High
- fortinet fortiproxy, fortios +1 moreAn insufficient verification of data authenticity vulnerability (CWE-345) in the user interface...6.3 Medium
- fortinet fortiadc, fortimail, fortisandbox +1 more +3 moreA missing cryptographic steps vulnerability in the function that encrypts users' LDAP and RADIUS...5.3 Medium
- fortinet fortiwlmA improper neutralization of input during web page generation ('cross-site scripting') in...5.4 Medium
- fortinet fortiwlmA improper neutralization of special elements used in an sql command ('sql injection') in...8.8 High
- fortinet fortiwlmA improper neutralization of input during web page generation ('cross-site scripting') in...6.4 Medium
- fortinet fortiauthenticatorA exposure of sensitive information to an unauthorized actor in Fortinet FortiAuthenticator...8.3 High
- kb multinerNational Library of the Netherlands multiNER <= c0440948057afc6e3d6b4903a7c05e666b94a3bc is...9.1 Critical
- kb diggerNational Library of the Netherlands digger < 6697d1269d981e35e11f240725b16401b5ce3db5 is affected...9.1 Critical
- fortinet fortios, fortiadc, fortianalyzer +13 more +15 moreA buffer overflow [CWE-121] in the TFTP client library of FortiOS before 6.4.7 and FortiOS 7.0.0...6.3 Medium
- mcafee database security, mcafee,llc mcafee database security (dbsec) +1 moreDenial of Service in Database Security on Windows6.1 Medium
- fortinet fortiwlcAn improper access control vulnerability [CWE-284] in FortiWLC 8.6.1 and below may allow an...8.8 High
- fortinet fortiwebMultiple improper neutralization of special elements used in a command vulnerabilities [CWE-77]...8.1 High
- livehelperchat livehelperchat/livehelperchat, live helper chat +1 moreCross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat6.1 Medium
- fortinet fortios, fortiproxy, fortios, fortiproxy +2 moreAn improper access control vulnerability [CWE-284] in FortiOS autod daemon 7.0.0, 6.4.6 and below...7.8 High
- sonicwall global vpn clientSonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search...7.8 High
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreA buffer overflow vulnerability in SMA100 sonicfiles RAC_COPY_TO (RacNumber 36) method allows a...9.8 Critical
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreA post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote...8.8 High
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreA Heap-based buffer overflow vulnerability in SonicWall SMA100 getBookmarks method allows a...8.8 High
- sonicwall sma 200 firmware, sma 210 firmware, sma 400 firmware +3 more +5 moreAn unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary...9.8 Critical
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreAn unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP...7.5 High
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreA relative path traversal vulnerability in the SMA100 upload funtion allows a remote...7.5 High
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreImproper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert...8.8 High
- sonicwall sma100, sma 100 appliances, sma 200 firmware +4 more +6 moreA Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreMozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson...9.8 Critical
- linux kernel, netapp cloud backup, h300e firmware +7 more +9 moreThe BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an...7.8 High
- douco douphpDouPHP v1.6 was discovered to contain a cross-site scripting (XSS) vulnerability via /admin/cloud...6.1 Medium
- 74cms74CMS v6.0.4 was discovered to contain a cross-site scripting (XSS) vulnerability via /index.php...6.1 Medium
- atlassian jira server, jira data center, jira software data center +2 moreAffected versions of Atlassian Jira Server and Data Center allow attackers with access to an...7.5 High
- atlassian jira server, jira data center, jira software data center +2 moreAffected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira...5.3 Medium
nssDebiannss - regression updateNo score- knime serverKNIME Server before 4.13.4 allows XSS via the old WebPortal login page.8.8 High
- knime serverKNIME Server before 4.13.4 allows directory traversal in a request for a client profile.7.5 High
- ivanti endpoint manager cloud service appliance (epm csa), endpoint manager cloud services appliance +1 moreA code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an...9.8 Critical
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreIt was possible to recreate previous cursor spoofing attacks against users with a zoomed native...4.3 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreUsing the Location API in a loop could have caused severe application hangs and crashes. This...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreDocuments loaded with the CSP sandbox directive could have escaped the sandbox's script...6.1 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreUsing XMLHttpRequest, an attacker could have identified installed applications by probing error...6.5 Medium
- mozilla firefox, firefox esr, thunderbird +1 more +3 moreWhen invoking protocol handlers for external protocols, a supplied parameter URL containing...6.5 Medium
- mozilla firefoxWebExtensions with the correct permissions were able to create and install ServiceWorkers for...6.5 Medium
- Show moreLoading…