CVEs published in January 2022
2,262 vulnerabilities, 204 critical, 13 exploited.
- mi xiaomi mirror screenA stack overflow in the HTTP server of Cast can be exploited to make the app crash in LAN.7.5 High
- gitlabIn all versions of GitLab CE/EE since version 12.0, a lower privileged user can import users from...4.3 Medium
- gitlabA denial of service vulnerability in GitLab CE/EE affecting all versions starting from 12.0...4.3 Medium
- gitlabImproper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6, 14.4 to 14.4.4,...8.7 High
- gitlabAn issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3...6.5 Medium
- gitlabAn issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3...3.5 Low
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5,...4.3 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5,...7.5 High
- gitlabAn issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3...4.3 Medium
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary...8.6 High
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5,...6.5 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5,...6.5 Medium
- gitlabServer side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.x, between...3.5 Low
- gitlabAn issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under...5.3 Medium
- m-files serverIn M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.2.0 Low
- m-files server, web +1 moreLack of rate limiting in M-Files Server and M-Files Web products with versions before 21.12.10873.0, allows brute-forcing of certain type of user accounts.7.5 High
- m-files serverSSRF vulnerability in M-Files Server products with versions before 22.1.11017.1, allows requests from server.3.5 Low
- mattermostServer-side Denial of Service while processing a specifically crafted GIF file4.3 Medium
- freebsdIn FreeBSD 13.0-STABLE before n247428-9352de39c3dc, 12.2-STABLE before r370674, 13.0-RELEASE...7.5 High
- mi ax3600 firmwareAX3600 router sensitive information leaked.There is an unauthorized interface through luci to...7.8 High
- ibm cloud pak for automationIBM Cloud Pak for Automation 21.0.1 and 21.0.2 - Business Automation Studio Component is...5.4 Medium
- pimcore, pimcore pimcore/pimcore +1 moreUnrestricted Upload of File with Dangerous Type in pimcore/pimcore6.6 Medium
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore6.6 Medium
- pimcore, pimcore pimcore/pimcore +1 moreBusiness Logic Errors in pimcore/pimcore4.3 Medium
- apache chainsaw, log4j, apache software foundation log4j 1.x +24 more +26 moreA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.8.8 High
- apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +26 more +28 moreSQL injection in JDBC Appender in Apache Log4j V19.8 Critical
- apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +24 more +26 moreDeserialization of untrusted data in JMSSink in Apache Log4j 1.x8.8 High
- ericsson codecheckerCross-site Scripting in Ericsson CodeChecker6.1 Medium
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore6.5 Medium
- leostream connection brokerLeostream Connection Broker 9.0.40.17 allows administrator to upload and execute Perl code.7.2 High
- leostream connection brokerLeostream Connection Broker 9.0.40.17 allows administrators to conduct directory traversal...4.9 Medium
- softvibe sarabanSoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows...9.8 Critical
- softvibe sarabanSoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers...7.5 High
- google fuchsiaIncorrect mapping of Executable bits in Fuchsia Kernel5.1 Medium
- softvibe sarabanSoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows...5.4 Medium
- softvibe sarabanSoftVibe SARABAN for INFOMA 1.1 allows SQL Injection.7.5 High
- allwinnertech android q sdkThere is a NULL pointer deference in the Allwinner R818 SoC Android Q SDK V1.0 camera driver /dev...7.5 High
- allwinnertech android q sdkThere is a NULL pointer dereference in the syscall open_exec function of Allwinner R818 SoC...7.5 High
- allwinnertech android q sdkThere is a Out-of-Bound Write in the Allwinner R818 SoC Android Q SDK V1.0 camera driver "/dev...7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA race condition could have allowed bypassing the fullscreen notification which could have lead...5.9 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped...8.8 High
- chinamobile an lianbao wf-1 firmwareChina Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which...8.8 High
- chinamobile an lianbao wf-1 firmwareChina Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter...8.8 High
- html2pdf project html2pdfCross-site Scripting in HTML2PDF8.8 High
- microsoft virglrenderer, redhat enterprise linux +1 moreA flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly...5.5 Medium
- zohocorp manageengine desktop central, manageengine desktop central managed service providers +1 moreZoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9...9.1 Critical
- nodejs node, node.js, debian linux +9 more +11 moreDue to the formatting logic of the "console.table()" function it was not safe to allow user...8.2 High
- nodejs node, node.js, debian linux +7 more +9 moreModerate: nodejs:14 security update5.3 Medium
- nodejs node, node.js, debian linux +7 more +9 moreNode.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)...5.3 Medium
- nodejs node, node.js, oracle graalvm +6 more +8 moreAccepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to...7.4 High
- Show moreLoading…