Archive

15 December 2021

Vulnerabilities first published on this day (UTC), newest first.

← November 2021 2021 / December /15 January 2022 →

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

Critical 9.1

CVE-2021-43834

Incorrect Authentication in elabftw

eLabFTW is an electronic lab notebook manager for research teams. In versions prior to 4.2.0 there is a vulnerability which allows an attacker to authenticate as an existing user, if that user was created using a single sign-on authentication option such as L…

elabftw elabftw

Dec 15, 2021
Critical 9.8

CVE-2021-44350

ThinkPHP5 SQL Injection vulnerability

SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.

topthink/framework Packagist

Dec 15, 2021
Critical 9.8

CVE-2021-36888 Scanner template

WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

oxilab Image Hover Effects Ultimate (WordPress plugin) Web / CMS

Dec 15, 2021
Critical 9.8

CVE-2021-27856 Scanner template

FatPipe software administrative account with no password

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 includes an account named "cmuser" that has administrative privileges and no password. Older versions of FatPipe software may also be vulnerable. The FatPipe advisory identif…

FatPipe IPVPN WARP MPVPN

Dec 15, 2021
Critical 9.8

CVE-2021-43907

Visual Studio Code WSL Extension Remote Code Execution Vulnerability

Visual Studio Code WSL Extension Remote Code Execution Vulnerability

Microsoft Visual Studio Code WSL Extension

Dec 15, 2021
Critical 9.6

CVE-2021-43905

Microsoft Office app Remote Code Execution Vulnerability

Microsoft Office app Remote Code Execution Vulnerability

Microsoft Office app

Dec 15, 2021
Critical 9.8

CVE-2021-43899

Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability

Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability

Microsoft Microsoft 4K Wireless Display Adapter

Dec 15, 2021
Critical 9.0

CVE-2021-43882

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Microsoft Defender for IoT

Dec 15, 2021
Critical 9.8

CVE-2021-43215

iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution

iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Dec 15, 2021
Critical 10.0

CVE-2021-42313

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Microsoft Defender for IoT

Dec 15, 2021
Critical 10.0

CVE-2021-42311

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Defender for IoT Remote Code Execution Vulnerability

Microsoft Microsoft Defender for IoT

Dec 15, 2021
Critical 9.1

CVE-2021-4110

NULL Pointer Dereference in mruby/mruby

mruby is vulnerable to NULL Pointer Dereference

mruby mruby/mruby mruby mruby Debian Ubuntu Alpine

Dec 15, 2021
Critical 9.8

CVE-2021-43113

Command injection in itext7-core

iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

com.itextpdf:itext7-core libitext5-java com.itextpdf:itextpdf libitext5-java Debian Ubuntu Maven

Dec 15, 2021