CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- pluck-cms pluckMissing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could...4.8 Medium
- ibm powervm hypervisorIBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the...6.3 Medium
- ibm powervm hypervisorIBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access...7.4 High
- pluck-cms pluckZip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted...9.8 Critical
- pluck-cms pluckSession Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to...7.5 High
- grafanaDirectory Traversal in Grafana4.3 Medium
- comment engine pro project engine pro, @rex1989 comment engine pro (wordpress plugin) +1 moreWordPress Comment Engine Pro plugin <= 1.0 - Stored Cross-Site Scripting (XSS) vulnerability4.8 Medium
- hp storeserv management consoleA security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An...7.2 High
- huntflow enterpriseDue to insufficient server-side login-attempt limit enforcement, a vulnerability in /account...9.8 Critical
- huntflow enterpriseAn information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4...7.5 High
- openwhyd, openwhyd openwhyd/openwhyd +1 moreOpen Redirect in openwhyd/openwhyd7.3 High
- f-secure safe, mobile security +1 moreUser interface Spoofing in F-Secure SAFE browser for Android4.3 Medium
- digi transport wr11 firmware, transport wr11 xt firmware, transport wr21 firmware +3 more +5 moreAn issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the...7.5 High
- digi transport dr64 firmware, transport vc74 firmware, transport wr11 firmware +5 more +7 moreAn issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker...8.8 High
- digi transport dr64 firmware, transport vc74 firmware, transport wr11 firmware +5 more +7 moreAn issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker...6.5 Medium
- digi transport dr64 firmware, transport sr44 firmware, transport vc74 firmware +6 more +8 moreAn issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows...9.8 Critical
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore7.4 High
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Reflected in pimcore/pimcore5.5 Medium
- pimcore, pimcore pimcore/pimcore +1 moreCross-Site Request Forgery (CSRF) in pimcore/pimcore4.3 Medium
c-blosc2OSS-FuzzHeap-buffer-overflow in ndlz4_decompressNo score- apache log4j, log4j2, apple xcode +141 more +143 moreApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints10.0 Critical
- etherpad, ether etherpad-lite +1 moreAdmin privilege escalation and arbitrary code execution via malicious *.etherpad imports9.9 Critical
- delta electronics cncsoftDelta Electronics CNCSoft7.8 High
- mattermostMattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when...5.8 Medium
- kevinpapst kevinpapst/kimai2, kimai 2 +1 moreCross-Site Request Forgery (CSRF) in kevinpapst/kimai26.5 Medium
- zohocorp manageengine opmanagerManageEngine's OpUtils 12.5.556 and prior allow access to a few audit directories without...9.8 Critical
- smartbear swagger-ui-distSpoofing attack in swagger-ui-dist6.1 Medium
- zzzcmsA Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.5.4 Medium
- zzzcmsA Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user...8.8 High
- dart software development kit, google llc dart sdk +1 moreDart - Publishing to third-party package repositories may expose pub.dev credentials8.8 High
- ibm db2, db2 for linux, unix and windows, netapp oncommand insight +2 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5...5.9 Medium
- ibm websphere application serverIBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service,...7.5 High
- ibm db2, db2 for linux, unix and windows, netapp oncommand insight +2 moreIBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to...6.5 Medium
- ibm db2, db2 for linux, unix and windows, netapp oncommand insight +2 moreIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5...5.5 Medium
- ibm db2, db2 for linux, unix and windows, netapp oncommand insight +2 moreIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5...8.7 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using...5.9 Medium
- dpgaspar flask-appbuilderImproper Authentication in Flask-AppBuilder8.1 High
- zzcmsAn Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin...9.8 Critical
- zzcmsAn SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php....8.8 High
- zzcmsAn SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when...8.8 High
- zzcmsAn SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in...7.2 High
- mcafee network security manager, mcafee,llc mcafee network security manager (nsm) +1 moreNSM vulnerable to XSS4.8 Medium
- auth0 express-openid-connect, express openid connect +1 moreSession fixation in express-openid-connect4.6 Medium
- zzcmsAn SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in...7.2 High
- globaldatingsoftware premiumdatingscriptA reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via...6.1 Medium
- globaldatingsoftware premiumdatingscriptAn authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7...6.5 Medium
- anker eufy homebase 2 firmwareAn authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of...7.7 High
- anker eufy homebase 2 firmwareA command execution vulnerability exists in the wifi_country_code_update functionality of the...9.9 Critical
- globaldatingsoftware premiumdatingscriptAn SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in...9.8 Critical
- gryphonconnect gryphon tower firmwareAn unauthenticated command injection vulnerability exists in the parameters of operation 3 in the...8.8 High
- Show moreLoading…