CVEs published in December 2021
2,574 vulnerabilities, 311 critical, 14 exploited.
- qibosoftQibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin...5.4 Medium
- qibosoftA Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft...8.8 High
- qibosoftAn issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily...9.1 Critical
- qibosoftA Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7...4.3 Medium
- netgen tags bundleCross-site Scripting in Netgen Tags Bundle6.1 Medium
- authguard project authguardbasic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive...9.8 Critical
- zte zxin10 cmsZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency...8.1 High
- zte zxin10 cmsZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper...7.8 High
- oppo colorosColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default...7.8 High
- philips efficia cm series, patient information center ix (pic ix), patient information center ix +1 more +3 morePhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of a Broken or Risky Cryptographic Algorithm5.9 Medium
- philips patient information center ix (pic ix), patient information center ix +1 morePhilips Patient Information Center iX (PIC iX) and Efficia CM Series Use of Hard-coded Cryptographic Key6.1 Medium
- philips patient information center ix (pic ix), patient information center ix +1 morePhilips Patient Information Center iX (PIC iX) and Efficia CM Series Improper Input Validation6.5 Medium
- philips intellibridge ec 40 hub, intellibridge ec 80 hub, intellibridge ec40 firmware +1 more +3 morePhilips IntelliBridge EC 40 and EC 80 Hub Authentication Bypass Using an Alternate Path or Channel8.1 High
- philips intellibridge ec 40 hub, intellibridge ec 80 hub, intellibridge ec40 firmware +1 more +3 morePhilips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded Credentials8.1 High
- moxa mgate mb3180 series, mgate mb3280 series, mgate mb3480 series +3 more +5 moreICSA-21-357-01 Moxa MGate Protocol Gateways9.8 Critical
- solarwinds web help desk, webhelpdesk +1 moreHard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries6.8 Medium
- gerapyGerapy may contain remote code execution vulnerability9.8 Critical
- requarks wiki, wiki.js +1 moreStored XSS via SVG in Requarks/wiki8.2 High
- requarks wiki, wiki.js +1 moreStored XSS in non-image uploads in Requarks/wiki8.2 High
- ibm openbmc, power system ac922 \(8335-gtc\) firmware, power system ac922 \(8335-gtg\) firmware +1 more +3 moreIBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed...6.1 Medium
- apache apisix dashboardsecurity vulnerability on unauthorized access.9.8 Critical
- avast antivirusPrivilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain...7.8 High
- avast antivirusMultiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user...7.8 High
- avast antivirusPrivilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8...8.8 High
- avast antivirusPrivilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4...8.8 High
- avast antivirusSandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be...8.8 High
- vim, vim vim/vim, apple mac os x +2 more +4 moreUse After Free in vim/vim6.8 Medium
rentalcrates.iorental is unmaintained, author has moved onNo score- metersphereAn arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users...9.8 Critical
- metersphereAn arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users...6.5 Medium
- metersphereTime-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders"...8.8 High
- glfusionglFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The...6.1 Medium
- nicu micle simple jwt login, simple jwt login project jwt login +1 moreSimple JWT Login < 3.3.0 - Insecure Password Creation7.5 High
- amentotech wp guppyWP Guppy < 1.3 - Sensitive Information Disclosure6.5 Medium
- buttonizer, buttonizer smart floating / sticky buttons – call, sharing, chat widgets & more – buttonizer +1 moreButtonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting4.8 Medium
- wprssaggregator wp rss aggregator, unknown wp rss aggregator – news feeds, autoblogging, youtube video feeds and more +1 moreWP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- syam mohan wpfront user role editor, wpfront user role editor +1 moreWPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting6.1 Medium
- gwolle guestbook project guestbook, mpol gwolle guestbook +1 moreGwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting6.1 Medium
- strangerstudios paid memberships proPaid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting6.1 Medium
- unknown wordpress download manager, w3eden download manager +1 moreDownload Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- themehunk contact form & lead form elementor builder, contact form \& lead form elementor builder +1 moreContact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- typebot, unknown typebot | build beautiful conversational forms +1 moreTypebot < 1.4.3 - Admin+ Stored Cross Site Scripting4.8 Medium
- tickera, tickera – wordpress event ticketing, unknown tickera – wordpress event ticketing +2 moreTickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- starfish rich review, unknown rich reviews by starfish +1 moreRich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection7.2 High
KernelLinuxxen/blkfront: harden blkfront against event channel stormsNo scoreKernelLinuxxen/netfront: harden netfront against event channel stormsNo scoreKernelLinuxxen/console: harden hvc_xen against event channel stormsNo scoreKernelLinuxscsi: scsi_debug: Sanity check block descriptor length in resp_mode_select()No scoreKernelLinuxio-wq: check for wq exit after adding new worker task_workNo scoreKernelLinuxscsi: scsi_debug: Don't call kcalloc() if size arg is zeroNo score- Show moreLoading…