CVEs published in January 2022

2,262 vulnerabilities, 204 critical, 13 exploited.

• cuppacms Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator... CVE-2022-24266 7.5 HighJanuary 31, 2022
• cuppacms Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator... CVE-2022-24265 7.5 HighJanuary 31, 2022
• cuppacms Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator... CVE-2022-24264 7.5 HighJanuary 31, 2022
• phpgurukul hospital management system Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in ... CVE-2022-24263 Public exploit 9.8 CriticalJanuary 31, 2022
• emlog Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in... CVE-2022-23872 4.8 MediumJanuary 31, 2022
• dpgaspar flask-appbuilder Observable Response Discrepancy in Flask-AppBuilder CVE-2022-21659 Fix available 5.3 MediumJanuary 31, 2022
• victor cms project cms Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component... CVE-2021-46459 7.5 HighJanuary 31, 2022
• printerlogic web stack PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to... CVE-2021-42635 8.1 HighJanuary 31, 2022
• printerlogic web stack, virtual appliance +1 more PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading... CVE-2021-42631 8.1 HighJanuary 31, 2022
• stock management system project management system Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP... CVE-2021-44114 4.8 MediumJanuary 31, 2022
• huawei cloudengine 12800 firmware, cloudengine 5800 firmware, cloudengine 6800 firmware +1 more +3 more There is an information exposure vulnerability on several Huawei Products. The vulnerability is... CVE-2021-40033 5.5 MediumJanuary 31, 2022
• huawei cloudengine 12800 firmware, cloudengine 5800 firmware, cloudengine 6800 firmware +1 more +3 more There is a release of invalid pointer vulnerability in some Huawei products, successful exploit... CVE-2021-40042 6.5 MediumJanuary 31, 2022
• linux kernel, oracle communications cloud native core binding support function, communications cloud native core network exposure function +1 more +3 more A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead... CVE-2022-0286 Fix available 5.5 MediumJanuary 31, 2022
• victor cms project cms Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin... CVE-2021-46458 7.5 HighJanuary 31, 2022
• stormshield network security In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0... CVE-2021-31617 9.8 CriticalJanuary 31, 2022
• linux kernel, netapp hci baseboard management controller, redhat enterprise linux +1 more +3 more A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux... CVE-2021-4154 Public exploitFix available 8.8 HighJanuary 31, 2022
• stormshield network security Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain... CVE-2021-28962 7.2 HighJanuary 31, 2022
• beetel 777vr1 firmware Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to... CVE-2020-36056 5.4 MediumJanuary 31, 2022
• online course registration project course registration Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source... CVE-2020-36064 9.8 CriticalJanuary 31, 2022
• gitforwindows git In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can... CVE-2021-46101 7.5 HighJanuary 31, 2022
• motioneye project motioneye, motioneyeos project motioneyeos +1 more Unrestricted Upload of File with Dangerous Type in motionEye CVE-2021-44255 Public exploit 7.2 HighJanuary 31, 2022
• juce Arbitrary File Write via Archive Extraction (Zip Slip) CVE-2021-23520 Fix available 5.5 MediumJanuary 31, 2022
• juce Link Following CVE-2021-23521 Fix available 5.5 MediumJanuary 31, 2022
• aspnetcore-runtime-3.1 AlmaLinux, aspnetcore-targeting-pack-3.1 AlmaLinux, dotnet-apphost-pack-3.1 AlmaLinux +7 more +9 more .NET Core 3.1 bugfix and enhancement update ALEA-2022:0322 Fix available No scoreJanuary 31, 2022
• land-software faust iserver An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses... CVE-2021-34805 EPSS 26.8% 7.5 HighJanuary 31, 2022
• alpsalpine touchpad driver Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection. CVE-2021-27971 7.8 HighJanuary 31, 2022
• ethercreative logs Duplicate Advisory: Path Traversal in the Logs plugin for Craft CMS CVE-2022-23409 Public exploit EPSS 13.8% 4.9 MediumJanuary 31, 2022
• invisible-island xterm, debian linux, fedoraproject fedora +2 more xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer... CVE-2022-24130 Fix available 5.5 MediumJanuary 31, 2022
• harfbuzz OSS-Fuzz Heap-buffer-overflow in void apply_string<GSUBProxy> OSV-2022-108 Fix available No scoreJanuary 31, 2022
• libplist OSS-Fuzz Heap-buffer-overflow in parse_object OSV-2022-105 Fix available No scoreJanuary 31, 2022
• harfbuzz OSS-Fuzz Heap-use-after-free in hb_bit_set_invertible_t::intersects OSV-2022-104 Fix available No scoreJanuary 31, 2022
• dolibarr dolibarr/dolibarr, erp\/crm +1 more Improper Validation of Specified Quantity in Input in dolibarr/dolibarr CVE-2022-0414 Fix available 4.1 MediumJanuary 31, 2022
• samba, fedoraproject fedora +1 more The Samba AD DC includes checks when adding service principals names (SPNs) to an account to... CVE-2022-0336 Fix available 8.8 HighJanuary 31, 2022
• samba, canonical ubuntu linux, debian linux +20 more +22 more The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced... CVE-2021-44142 Public exploitFix available EPSS 73.6% 8.8 HighJanuary 31, 2022
• samba, fedoraproject fedora, redhat storage +2 more All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink... CVE-2021-44141 Fix available 4.3 MediumJanuary 31, 2022
• vim, vim vim/vim +1 more Heap-based Buffer Overflow in vim/vim CVE-2022-0407 Fix available 5.7 MediumJanuary 30, 2022
• janeczku calibre-web, janeczku/calibre-web +1 more Improper Access Control in janeczku/calibre-web CVE-2022-0273 Fix available 4.3 MediumJanuary 30, 2022
• janeczku calibre-web, janeczku/calibre-web +1 more Server-Side Request Forgery (SSRF) in janeczku/calibre-web CVE-2022-0339 Fix available 6.5 MediumJanuary 30, 2022
• adenza axiomsl controllerview Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. CVE-2022-22919 6.1 MediumJanuary 30, 2022
• adenza axiomsl controllerview Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can... CVE-2022-24032 5.3 MediumJanuary 30, 2022
• ghostscript OSS-Fuzz Segv on unknown address in pdfi_array_get OSV-2022-102 Fix available No scoreJanuary 30, 2022
• fluent-bit OSS-Fuzz Heap-double-free in flb_sds_destroy OSV-2022-101 Fix available No scoreJanuary 30, 2022
• ghostscript OSS-Fuzz Stack-buffer-overflow in sgets OSV-2022-100 Fix available No scoreJanuary 30, 2022
• vim, vim vim/vim, debian linux +1 more +3 more Use After Free in vim/vim CVE-2022-0413 Fix available 8.4 HighJanuary 30, 2022
• vim, vim vim/vim, debian linux +1 more +3 more Stack-based Buffer Overflow in vim/vim CVE-2022-0408 Fix available 8.4 HighJanuary 30, 2022
• signiant manager\+agents Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks. CVE-2021-46660 9.8 CriticalJanuary 29, 2022
• marktext MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This... CVE-2022-24123 9.0 CriticalJanuary 29, 2022
• casbin casdoor SQL Injection in Casdoor CVE-2022-24124 Public exploitFix available EPSS 55.3% 7.5 HighJanuary 29, 2022
• mariadb get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses... CVE-2021-46657 Fix available 5.5 MediumJanuary 29, 2022
• mariadb save_window_function_values in MariaDB before 10.6.3 allows an application crash because of... CVE-2021-46658 Fix available 5.5 MediumJanuary 29, 2022
• Show olderLoading…