CVEs published in January 2022
2,262 vulnerabilities, 204 critical, 13 exploited.
- multi restaurant table reservation system project restaurant table reservation systemA Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table...5.4 Medium
- jadx project jadx, skylot skylot/jadx +1 moreImproper Restriction of XML External Entity Reference in skylot/jadx5.5 Medium
- afi-solutions webacmsCross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via...6.1 Medium
- lexmark 6500e firmware, b2236 firmware, b2338 firmware +231 more +233 moreEmbedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which...9.8 Critical
- lexmark mc3224i firmwareThe initial admin account setup wizard on Lexmark devices allow unauthenticated access to the ...9.8 Critical
- lexmark b2236 firmware, b2338 firmware, b2442 firmware +115 more +117 moreEmbedded web server command injection vulnerability in Lexmark devices through 2021-12-07.9.8 Critical
- lexmark 6500e firmware, b2236 firmware, b2338 firmware +231 more +233 morePJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged...8.8 High
- lexmark 6500e firmware, b2236 firmware, b2338 firmware +231 more +233 moreBuffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in...9.8 Critical
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore6.6 Medium
- mongodb, mongodb inc. for vs code +1 moreMongoDB Extension for VS Code may unexpectedly store credentials locally in clear text5.5 Medium
webkit2gtk3SUSESecurity update for webkit2gtk3No scorepermissionsSUSESecurity update for permissionsNo scorepermissionsopenSUSE,autotraceopenSUSE +1 moreSecurity update for permissionsNo score- line corporation for windows, linecorp line +1 moreDue to the lack of media file checks before rendering, it was possible for an attacker to cause...5.5 Medium
- telenot compasxTelenot complex: Insecure AES Key Generation5.5 Medium
- microweber, microweber microweber/microweber +1 moreCross-site Scripting in microweber/microweber4.3 Medium
- microweber, microweber microweber/microweber +1 moreExposure of Sensitive Information to an Unauthorized Actor in microweber/microweber7.5 High
- zulip, zulip zulip/zulip +1 moreCross-site Scripting (XSS) - Stored in zulip/zulip6.8 Medium
- apache shardingsphere elasticjob-uiAccess-Token in ElasticJob UI causes password disclosure6.5 Medium
- apache airflowApache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver6.5 Medium
- microweber, microweber microweber/microweber +1 moreCross-site Scripting (XSS) - Stored in microweber/microweber7.2 High
- code42In Code42 app before 8.8.0, eval injection allows an attacker to change a device’s proxy...8.8 High
- apple macos, rust-lang rust, apple ipados +4 more +6 moreRace condition in std::fs::remove_dir_all in rustlang7.3 High
- microweber, microweber microweber/microweber +1 moreIncorrect Permission Assignment for Critical Resource in microweber/microweber6.5 Medium
- duktape project duktapeDuktape v2.99.99 was discovered to contain a SEGV vulnerability via the component duk_push_tval...5.5 Medium
- advanced intrusion detection environment project intrusion detection environment, canonical ubuntu linux, debian linux +4 more +6 moreAIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such...7.8 High
- mblog project mblogIn mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The...4.3 Medium
- wangl1989 mysiteformemysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag...5.4 Medium
- wangl1989 mysiteformemysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The...6.5 Medium
- oneblog project oneblogA Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in...5.4 Medium
- bigbluebutton, bigbluebutton bigbluebutton/bigbluebutton +1 moreCross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton8.1 High
- istioPrivileged Escalation in Istio5.0 Medium
- istioAuthorization Policy bypass in Istio6.8 Medium
- ipython, debian linux, fedoraproject fedora +2 moreExecution with Unnecessary Privileges in ipython8.2 High
- email tracker project tracker, prashant baldha email tracker (wordpress plugin) +1 moreWordPress Email Tracker plugin <= 5.2.6 - Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion5.4 Medium
- phpipamPhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the...4.8 Medium
- phpipamPhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet"...7.2 High
- bosch amc2, access management system, access professional edition +5 more +7 moreLack of authentication mechanisms on the device8.8 High
- bosch amc2, access management system, access professional edition +5 more +7 moreUse of Hard-coded Cryptographic Key5.7 Medium
- cactiAs an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=...6.1 Medium
- cacti, debian linux +1 moreCacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary web...5.4 Medium
- cactiCacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML...5.4 Medium
- tibco ebx, ebx add-ons, product and service catalog powered by tibco ebx +2 moreTIBCO EBX vulnerabilities8.0 High
- orchardcms orchardcms/orchardcore, orchardcore +1 moreCross-site Scripting (XSS) - Stored in orchardcms/orchardcore7.4 High
- allwinnertech android q sdkAllwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability...7.5 High
- orchardcms orchardcms/orchardcore, orchardcore +1 moreCross-site Scripting (XSS) - Stored in orchardcms/orchardcore6.8 Medium
- naviwebs navigate cmsA reflected cross-site scripting (XSS) vulnerability in \lib\packages\themes\themes.php of...5.4 Medium
- taogogo taocmsTaocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path...9.8 Critical
- taogogo taocmsTaocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter.6.5 Medium
drupal/corePackagistjQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life. Late in 2021, jQuery UI announced that they would be continuing development, and released a jQ…No score- Show moreLoading…