Skip to content
OpenAdvisories

Archive

December 2021

Vulnerabilities first published in this month (UTC), newest first.

← November 2021 2021 / December January 2022 →
  1. 176
  2. 238
  3. 331
  4. 41
  5. 57
  6. 655
  7. 7135
  8. 8138
  9. 954
  10. 1033
  11. 112
  12. 123
  13. 13108
  14. 14116
  15. 15255
  16. 1644
  17. 1766
  18. 183
  19. 193
  20. 2073
  21. 2166
  22. 22117
  23. 2394
  24. 2417
  25. 2532
  26. 26244
  27. 2755
  28. 2828
  29. 2921
  30. 3050
  31. 3134
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2021-43857 Public exploit EPSS 56%

    Gerapy may contain remote code execution vulnerability

    Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8.

    Gerapy Gerapy gerapy PyPI
  • Critical 9.9
    CVE-2021-43821 Public exploit

    Files Accessible to External Parties in Opencast

    Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and maki…

    opencast opencast org.opencastproject:opencast-ingest-service-impl Maven
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023
  • Critical 9.8
    CVE-2021-23639 Public exploit

    Remote Code Execution (RCE)

    The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.

    md-to-pdf npm
  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Critical 9.8
    CVE-2021-3817 Public exploit EPSS 38%

    SQL Injection in wbce/wbce_cms

    wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

    WBCE wbce/wbce_cms
  • Critical 9.8
    CVE-2021-20038 Exploited · Ransomware Public exploit EPSS 100%

    A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows…

    SonicWall SonicWall SMA100 Network devices
    KEV Jan 28, 2022
  • Critical 9.8
    CVE-2021-44529 Exploited · Ransomware Public exploit EPSS 99%

    A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execu…

    KEV Mar 25, 2024
  • Critical 10.0
    CVE-2021-43936 Public exploit EPSS 36%

    Distributed Data Systems WebHM

    The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.

    Distributed Data Systems WebHMI