CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- apereo opencastFiles Accessible to External Parties in Opencast9.9 Critical
- seafile server, haiwen seafile-server +1 morePermissions check bypass in Seafile7.4 High
- limesurveyCross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey...6.1 Medium
- apereo opencastHTTP Method Spoofing in Opencast7.5 High
- emlogA Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.9.8 Critical
- unisys cargo mobileUnisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information,...7.5 High
- piwigoA Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and...6.1 Medium
- uipath app studioAn issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in...5.4 Medium
- uipath assistantUiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path...9.8 Critical
- uipath assistantAn issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the -...9.8 Critical
- apache log4j, log4j2, cvat computer vision annotation tool +53 more +55 moreApache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack9.0 Critical
- ibm mq for hpe nonstopIBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when...7.4 High
- duogeek simple image gallery, simple image gallery image gallery +1 moreSimple Image Gallery <= 1.0.6 Reflected Cross-Site Scripting6.1 Medium
- optimizza true ranker, true ranker ranker +1 moreTrue Ranker <= 2.2.2 Directory Traversal/Arbitrary File Read7.5 High
- real wysiwyg wysiwyg, windyroad real wysiwyg +1 moreReal WYSIWYG <= 0.0.2 Reflected Cross-Site Scripting6.1 Medium
- woocommerce myghpay payment gateway myghpay payment gateway, woo-myghpay-payment-gateway project woo-myghpay-payment-gateway +1 moreWooCommerce myghpay Payment Gateway <= 3.0 Reflected Cross-Site Scripting6.1 Medium
- metagauss registrationmagicRegistrationMagic <= 5.0.1.7 Authentication Bypass9.8 Critical
- .htaccess redirect redirect, htaccess-redirect project htaccess-redirect +1 more.htaccess Redirect <= 0.3.1 Reflected Cross-Site Scripting6.1 Medium
- link-list-managerlink-list-manager <= 1.0 Reflected Cross-Site Scripting6.1 Medium
- dpsoft parsian bank gateway for woocommerce, parsian bank gateway for woocommerce bank gateway for woocommerce +1 moreParsian Bank Gateway for Woocommerce <= 1.0 Reflected Cross-Site Scripting6.1 Medium
- woocommerce enviopack enviopack, wanderlust-webdesign woo-enviopack +1 moreWooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting6.1 Medium
- h5p css editor css editor, h5p-css-editor project h5p-css-editor +1 moreH5P CSS Editor <= 1.0 Reflected Cross-Site Scripting6.1 Medium
- variation swatches for woocommerce swatches for woocommerceVariation Swatches for WooCommerce <= 2.1.1 Authenticated Stored Cross-Site Scripting6.4 Medium
- conva fathom analytics, fathom analytics analytics +1 moreFathom Analytics <= 3.0.4 Authenticated Stored Cross-Site Scripting4.8 Medium
- duofaq - responsive, flat, simple faq - responsive, flat, simple faq, duogeek duofaq-responsive-flat-simple-faq +1 moreduoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site Scripting6.1 Medium
- magic post voice post voice, magic-post-voice project magic-post-voice +1 moreMagic Post Voice <= 1.2 Reflected Cross-Site Scripting6.1 Medium
- sap businessobjects business intelligence platformSAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not...5.4 Medium
- sap 3d visual enterprise viewerWhen a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual...3.3 Low
- sap 3d visual enterprise viewerWhen a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in...3.3 Low
- sap commerceIf configured to use an Oracle database and if a query is created using the flexible search java...9.8 Critical
- kyma-project kymaDue to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privileges which can completely compromise the cluster.8.8 High
- sap 3d visual enterprise viewerWhen a user opens manipulated Tagged Image File Format (.tif) file received from untrusted...3.3 Low
- sap business oneSAP Business One - version 10.0, allows an admin user to view DB password in plain text over the...4.4 Medium
- sap knowledge warehouseA security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31...6.1 Medium
- sap saf-t frameworkSAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path...7.7 High
- sap se netweaver as abap, sap netweaver application server abap +1 moreTwo methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730,...6.7 Medium
- sap access control, sap se grc access control +1 moreSAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary...8.8 High
- sap abap platform, netweaver application server abap, sap se abap server & abap platform (translation tools) +2 moreInternally used text extraction reports allow an attacker to inject code that can be executed by...9.8 Critical
- bopsoft listaryAn issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary...7.3 High
- bopsoft listaryAn issue was discovered in Listary through 6. When Listary is configured as admin, Listary will...7.5 High
- listaryAn issue was discovered in Listary through 6. Improper implementation of the update process leads...7.5 High
- dbeaver, dbeaver dbeaver/dbeaver +1 moreImproper Restriction of XML External Entity Reference in dbeaver/dbeaver9.8 Critical
- apache sling commons messaging mailSMTPS server hostname not checked when making TLS connection to SMTPS server7.4 High
- rapid7 insight agentRapid7 Insight Agent Privilege Escalation7.8 High
- yetiforcecompany yetiforcecompany/yetiforcecrm, yetiforce customer relationship management +1 moreCross-site Scripting (XSS) - Reflected in yetiforcecompany/yetiforcecrm5.3 Medium
- abantecartAn issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload...5.4 Medium
- glfusionglFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.9.8 Critical
- abantecartAn issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.6.1 Medium
- sysaid api, application programming interface +1 moreSysaid - Sysaid API User Enumeration4.4 Medium
- taogogo taocmstaocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line...9.1 Critical
- Show moreLoading…