December 2021
2,520 CVEs published, +49% on November 2021 and +56% on December 2020. CISA added 20 to KEV.
2021 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2021 | January 2021: 1,970 CVEs | February 2021: 1,557 CVEs | March 2021: no snapshot | April 2021: 1,970 CVEs | May 2021: 1,580 CVEs | June 2021: 1,985 CVEs | July 2021: 1,650 CVEs | August 2021: 2,317 CVEs | September 2021: 1,933 CVEs | October 2021: 1,759 CVEs | November 2021: 1,694 CVEs291 added to CISA KEV | December 2021: 2,520 CVEs20 added to CISA KEV | 20,93511 of 12 months11/12 |
- Critical
- 35818% of the 2,037 with a CVSS score
- Added to CISA KEV
- 2013 of this month's CVEs are in KEV, listed a median 503 days after publication
- Vendors
- 7953,092 products
- Top weakness
- XSSCWE-79 · 237 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1NetgearRBR850 Firmware, RBK852 Firmware, RBS850 Firmware20147nonenew
- 2GoogleAndroid, Google Chrome, Chrome19772new
- 3Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Vim117154new
- 4DebianDebian Linux108103new
- 5MicrosoftWindows Server 2016, Windows 10 Version 2004, Windows 10 20049693new
- 6Ао "нппкт"Осон Основа Оnyx9372new
- 7FedoraprojectFedora, Sssd, Extra Packages For Enterprise Linux9062new
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition77101new
- 9UnknownUser Registration, Login Form, User Profile & Membership – Profilepress (Formerly Wp User Avatar), Get Custom Field Values, Clickbank Affiliate Ads7410nonenew
- 10Ао «концерн Вниинс»Ос Он «стрелец»7351new
- 11HuaweiHarmonyos, Emui, Magic Ui6920nonenew
- 12PackagistYetiforce/yetiforce-crm, Showdoc/showdoc, Snipe/snipe-it6310nonenew
- 13Crates.ioRusqlite, Messagepack-rs, Ckb5528nonenew
- 14SiemensJt Utilities, Jt Open Toolkit, Jttk4942new
- 15IBMCognos Analytics, Spectrum Copy Data Management, DB2 For Linux, Unix and Windows424nonenew
- 16Ооо «ред Софт»Ред Ос4162new
- 17Advantech Co., LtdR-seenet, Wise-4060, Wise-4010398nonenew
- 18FortinetFortiweb, Fortinet Fortiweb, Fortios390nonenew
- 19Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Application Runtimes3743new
- 20ApplemacOS, Mac OS X, IOS3141new
- 21MavenIo.atomix:atomix, Org.ops4j.pax.logging:pax-logging-log4j2, Org.apache.logging.log4j:log4j-core3152new
- 22AdobePremiere Rush, Adobe Premiere Rush, Dimension290nonenew
- 23MozillaFirefox, Thunderbird, Firefox Esr282nonenew
- 24NetappOncommand Insight, H500E Firmware, H500S Firmware2741new
- 25AdvantechR-seenet260nonenew
Severity
How this month's CVEs score on CVSS; 483 have no score yet. Severity is not exploitation.
- Critical358
- High883
- Medium736
- Low60
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS237
- CWE-787Out-of-bounds Write184
- CWE-77Command Injection109
- CWE-89SQL Injection102
- CWE-125Out-of-bounds Read72
- CWE-22Path Traversal58
- CWE-78OS Command Injection58
- CWE-416Use After Free54
- CWE-352CSRF50
- CWE-20Improper Input Validation48
- CWE-120Buffer Overflow47
- CWE-862Missing Authorization45
- CWE-287Improper Authentication40
- CWE-200Information Exposure38
- CWE-476NULL Pointer Dereference31
- CWE-190Integer Overflow25
- CWE-502Deserialization25
- CWE-119Memory Buffer Bounds24
- CWE-20324
- CWE-269Improper Privilege Mgmt22
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- OSS Libraries36414% of sector-tagged CVEs
- Operating Systems36114% of sector-tagged CVEs
- Networking Infrastructure35013% of sector-tagged CVEs
- Mobile Apps30912% of sector-tagged CVEs
- Enterprise Software29511% of sector-tagged CVEs
- Web & CMS Plugins2269% of sector-tagged CVEs
- ICS / OT / IoT1666% of sector-tagged CVEs
- Security Products1205% of sector-tagged CVEs
- 7 smaller sectors335
- Not yet classified126
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 77Command Injection | 89SQL Injection | 125Out-of-bounds Read | 22Path Traversal | 78OS Command Injection | 416Use After Free | 352CSRF | 120Buffer Overflow |
|---|---|---|---|---|---|---|---|---|---|---|
| Netgear | 17 | 8 | 97 | 1 | 2 | 12 | ||||
| 26 | 17 | 1 | 22 | |||||||
| Сообщество Свободного Программного Обеспечения | 6 | 25 | 1 | 7 | 1 | 17 | 3 | |||
| Debian | 6 | 21 | 1 | 6 | 18 | 1 | ||||
| Microsoft Corp | 6 | 3 | 7 | |||||||
| Ао «нппкт» | 2 | 17 | 1 | 3 | 1 | 15 | 1 | |||
| Fedoraproject | 4 | 15 | 2 | 6 | 1 | 15 | 1 | |||
| Ооо «русбитех-астра» | 1 | 22 | 1 | 4 | 1 | 15 | 3 | |||
| Ао «концерн Вниинс» | 2 | 13 | 1 | 17 | ||||||
| Huawei | 5 | 7 | 4 | 1 | ||||||
| Microsoft | 2 | 3 | ||||||||
| Packagist | 23 | 4 | 3 | 1 | 13 |
CVEs published in December 2021
22 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsKEV10.0
- CVE-2021-20038A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthenticated attacker to potentially execute code as a 'nobody' u...KEV9.8
- CVE-2021-27860Arbitrary file upload vulnerability in FatPipe softwareKEV9.8
- CVE-2021-44515Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127....KEV9.8
- CVE-2021-44529A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).KEV9.8
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackKEV9.0
- CVE-2021-23758Deserialization of Untrusted DataKEV8.1
- CVE-2021-44207Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.KEV8.1
- CVE-2021-1048In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges nee...KEV7.8
- CVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2021-22054VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain an SSRF vulnerability. This issue may allow...KEV7.5
- CVE-2021-43798Grafana path traversalKEV7.5
- CVE-2021-43890Windows AppX Installer Spoofing VulnerabilityKEV7.1
- CVE-2021-39935An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. U...KEV6.8
- CVE-2021-0920In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User inter...KEV6.4
- CVE-2021-20158Trendnet AC2600 TEW-827DRU version 2.08B01 contains an authentication bypass vulnerability. It is possible for an unauthenticated, malicous actor to force the change of the admin password due to a ...9.8
- CVE-2021-24849WCFM - WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQL Injection9.8
- CVE-2021-43987mySCADA myPRO9.8
- CVE-2021-42125An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.8.8
- CVE-2021-20041An unauthenticated and remote adversary can consume all of the device's CPU due to crafted HTTP requests sent to SMA100 /fileshare/sonicfiles/sonicfiles resulting in a loop with unreachable exit co...7.5
- CVE-2021-45043HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.7.5
- CVE-2021-45098An issue was discovered in Suricata before 6.0.4. It is possible to bypass/evade any HTTP-based signature by faking an RST TCP packet with random TCP options of the md5header from the client side. ...7.5