# CVEs published 2022-01-14

147 CVEs were published on January 14, 2022: 9 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-23566](https://cve.now/CVE-2021-23566.md): Information Exposure (CVSS 4.0, nanoid)
- [CVE-2021-46171](https://cve.now/CVE-2021-46171.md): Modex v2.11 was discovered to contain a NULL pointer dereference in set\_create\_id() at xtract.c. (no CVSS)
- [CVE-2021-46170](https://cve.now/CVE-2021-46170.md): An issue was discovered in JerryScript commit a6ab5e9. (no CVSS)
- [CVE-2021-23567](https://cve.now/CVE-2021-23567.md): Denial of Service (DoS) (CVSS 7.5, colors)
- [CVE-2021-46169](https://cve.now/CVE-2021-46169.md): Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache. (no CVSS)
- [CVE-2021-46168](https://cve.now/CVE-2021-46168.md): Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c. (no CVSS)
- [CVE-2021-46021](https://cve.now/CVE-2021-46021.md): An Use-After-Free vulnerability in rec\_record\_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or… (no CVSS)
- [CVE-2021-46020](https://cve.now/CVE-2021-46020.md): An untrusted pointer dereference in mrb\_vm\_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash. (no CVSS)
- [CVE-2021-44828](https://cve.now/CVE-2021-44828.md): Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a… (no CVSS)
- [CVE-2021-45406](https://cve.now/CVE-2021-45406.md): In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating… (no CVSS)
- [CVE-2021-46195](https://cve.now/CVE-2021-46195.md): GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. (no CVSS)
- [CVE-2021-44530](https://cve.now/CVE-2021-44530.md): An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows… (no CVSS, UniFi Network application)
- [CVE-2021-3965](https://cve.now/CVE-2021-3965.md): Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews. (no CVSS, HP DesignJet Printer)
- [CVE-2021-36920](https://cve.now/CVE-2021-36920.md): WordPress plugin Download Monitor \<= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, WPChill Download Monitor)
- [CVE-2022-22290](https://cve.now/CVE-2022-22290.md): Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted… (CVSS 6.5, Samsung Mobile Samsung Internet)
- [CVE-2021-28500](https://cve.now/CVE-2021-28500.md): An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents… (CVSS 9.1, Arista Networks Arista EOS)
- [CVE-2022-0130](https://cve.now/CVE-2022-0130.md): Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote… (no CVSS, Tenable.sc)
- [CVE-2021-38127](https://cve.now/CVE-2021-38127.md): Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. (no CVSS, ArcSight Enterprise Security Manager)
- [CVE-2021-38126](https://cve.now/CVE-2021-38126.md): Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. (no CVSS, ArcSight Enterprise Security Manager)
- [CVE-2021-42067](https://cve.now/CVE-2021-42067.md): In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an… (no CVSS, SAP SE SAP NetWeaver AS for ABAP and ABAP Platform)
- [CVE-2022-22529](https://cve.now/CVE-2022-22529.md): SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized… (no CVSS, SAP SE SAP Enterprise Threat Detection)
- [CVE-2022-22531](https://cve.now/CVE-2022-22531.md): The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or… (no CVSS, SAP SE SAP S/4HANA)
- [CVE-2021-44234](https://cve.now/CVE-2021-44234.md): SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an… (no CVSS, SAP SE SAP Business One)
- [CVE-2022-22530](https://cve.now/CVE-2022-22530.md): The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or… (no CVSS, SAP SE SAP S/4HANA)
- [CVE-2021-1037](https://cve.now/CVE-2021-1037.md): The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to… (no CVSS, Android)
- [CVE-2021-1036](https://cve.now/CVE-2021-1036.md): In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-1035](https://cve.now/CVE-2021-1035.md): In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver… (no CVSS, Android)
- [CVE-2021-39684](https://cve.now/CVE-2021-39684.md): In target\_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-39683](https://cve.now/CVE-2021-39683.md): In copy\_from\_mbox of sss\_ice\_util.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-45773](https://cve.now/CVE-2021-45773.md): A NULL pointer dereference in CS104\_IPAddress\_setFromString at src/iec60870/cs104/cs104\_slave.c of lib60870 commit 0d5e76e can lead to a… (no CVSS)
- [CVE-2021-39682](https://cve.now/CVE-2021-39682.md): In mgm\_alloc\_page of memory\_group\_manager.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39681](https://cve.now/CVE-2021-39681.md): In delete\_protocol of main.c, there is a possible arbitrary code execution due to a use after free. (no CVSS, Android)
- [CVE-2021-39680](https://cve.now/CVE-2021-39680.md): In sec\_SHA256\_Transform of sha256\_core.c, there is a possible way to read heap data due to uninitialized data. (no CVSS, Android)
- [CVE-2021-39679](https://cve.now/CVE-2021-39679.md): In init of vendor\_graphicbuffer\_meta.cpp, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-39678](https://cve.now/CVE-2021-39678.md): In \<TBD\> of \<TBD\>, there is a possible bypass of Factory Reset Protection due to \<TBD\>. (no CVSS, Android)
- [CVE-2021-39659](https://cve.now/CVE-2021-39659.md): In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due… (no CVSS, Android)
- [CVE-2021-39634](https://cve.now/CVE-2021-39634.md): In fs/eventpoll.c, there is a possible use after free. (no CVSS, Android)
- [CVE-2021-39633](https://cve.now/CVE-2021-39633.md): In gre\_handle\_offloads of ip\_gre.c, there is a possible page fault due to an invalid memory access. (no CVSS, Android)
- [CVE-2021-39632](https://cve.now/CVE-2021-39632.md): In inotify\_cb of events.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39630](https://cve.now/CVE-2021-39630.md): In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a… (no CVSS, Android)
- [CVE-2021-39629](https://cve.now/CVE-2021-39629.md): In phTmlNfc\_Init and phTmlNfc\_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-39628](https://cve.now/CVE-2021-39628.md): In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-39627](https://cve.now/CVE-2021-39627.md): In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39626](https://cve.now/CVE-2021-39626.md): In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2021-39625](https://cve.now/CVE-2021-39625.md): In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider… (no CVSS, Android)
- [CVE-2021-39623](https://cve.now/CVE-2021-39623.md): In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39622](https://cve.now/CVE-2021-39622.md): In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39621](https://cve.now/CVE-2021-39621.md): In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39620](https://cve.now/CVE-2021-39620.md): In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free. (no CVSS, Android)
- [CVE-2021-39618](https://cve.now/CVE-2021-39618.md): In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an… (no CVSS, Android)
- [CVE-2021-1049](https://cve.now/CVE-2021-1049.md): Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722 (no CVSS, Android)
- [CVE-2021-0959](https://cve.now/CVE-2021-0959.md): In jit\_memory\_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code. (no CVSS, Android)
- [CVE-2022-21137](https://cve.now/CVE-2022-21137.md): Omron CX-One (CVSS 7.8, Omron CX-One)
- [CVE-2021-36199](https://cve.now/CVE-2021-36199.md): VideoEdge (CVSS 5.3, Johnson Controls VideoEdge)
- [CVE-2021-23138](https://cve.now/CVE-2021-23138.md): WECON LeviStudioU (CVSS 7.8, WECON LeviStudioU)
- [CVE-2021-23157](https://cve.now/CVE-2021-23157.md): WECON LeviStudioU (CVSS 7.8, WECON LeviStudioU)
- [CVE-2021-45769](https://cve.now/CVE-2021-45769.md): A NULL pointer dereference in AcseConnection\_parseMessage at src/mms/iso\_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation… (no CVSS)
- [CVE-2021-44714](https://cve.now/CVE-2021-44714.md): Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts (CVSS 2.5, Adobe Acrobat Reader)
- [CVE-2021-44710](https://cve.now/CVE-2021-44710.md): Adobe Acrobat Reader Use-after-free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44705](https://cve.now/CVE-2021-44705.md): Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44703](https://cve.now/CVE-2021-44703.md): Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45067](https://cve.now/CVE-2021-45067.md): Adobe Acrobat Reader Memory Corruption could lead to Information Disclosure (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44712](https://cve.now/CVE-2021-44712.md): Adobe Acrobat Reader Memory Corruption could lead to Application denial-of-service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44713](https://cve.now/CVE-2021-44713.md): Adobe Acrobat Reader DC Use After Free could lead to Application denial-of-service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44742](https://cve.now/CVE-2021-44742.md): Adobe Reader Out-of-bounds Read Remote Code Execution Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44704](https://cve.now/CVE-2021-44704.md): Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44708](https://cve.now/CVE-2021-44708.md): Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44739](https://cve.now/CVE-2021-44739.md): Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Auth leak vulnerability (CVSS 3.1, Adobe Acrobat Reader)
- [CVE-2021-44715](https://cve.now/CVE-2021-44715.md): Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44702](https://cve.now/CVE-2021-44702.md): Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) for Internet Explorer LoadFile NTLMv2 SSO Auth leak vulnerability (CVSS 3.1, Adobe Acrobat Reader)
- [CVE-2021-45064](https://cve.now/CVE-2021-45064.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45061](https://cve.now/CVE-2021-45061.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44706](https://cve.now/CVE-2021-44706.md): Adobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45060](https://cve.now/CVE-2021-45060.md): Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44707](https://cve.now/CVE-2021-44707.md): Adobe Acrobat Reader DC OTF Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45063](https://cve.now/CVE-2021-45063.md): Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44711](https://cve.now/CVE-2021-44711.md): Adobe Acrobat Reader DC annotation gestures integer overflow vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44741](https://cve.now/CVE-2021-44741.md): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44701](https://cve.now/CVE-2021-44701.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44709](https://cve.now/CVE-2021-44709.md): Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45068](https://cve.now/CVE-2021-45068.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44740](https://cve.now/CVE-2021-44740.md): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-45062](https://cve.now/CVE-2021-45062.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-43752](https://cve.now/CVE-2021-43752.md): Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-44700](https://cve.now/CVE-2021-44700.md): Adobe Illustrator JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-45051](https://cve.now/CVE-2021-45051.md): Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-45052](https://cve.now/CVE-2021-45052.md): Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-44743](https://cve.now/CVE-2021-44743.md): Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-28507](https://cve.now/CVE-2021-28507.md): An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and… (CVSS 5.5, Arista Networks EOS)
- [CVE-2021-28506](https://cve.now/CVE-2021-28506.md): An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could… (CVSS 9.1, Arista Networks EOS)
- [CVE-2021-28501](https://cve.now/CVE-2021-28501.md): An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents… (CVSS 9.1, Arista Networks Terminattr)
- [CVE-2021-20613](https://cve.now/CVE-2021-20613.md): Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior, FX3U-ENET-L Firmware version 1.16 and… (no CVSS, MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…)
- [CVE-2021-20612](https://cve.now/CVE-2021-20612.md): Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L… (no CVSS, MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…)
- [CVE-2022-0226](https://cve.now/CVE-2022-0226.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 4.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-45761](https://cve.now/CVE-2021-45761.md): ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function. (no CVSS)
- [CVE-2021-24046](https://cve.now/CVE-2021-24046.md): A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the… (no CVSS, Meta Platforms Ray-Ban® Stories Smart Glasses)
- [CVE-2021-45468](https://cve.now/CVE-2021-45468.md): Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade… (no CVSS)
- [CVE-2022-0224](https://cve.now/CVE-2022-0224.md): SQL Injection in dolibarr/dolibarr (CVSS 8.3, dolibarr/dolibarr)
- [CVE-2022-23227](https://cve.now/CVE-2022-23227.md): NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users (CVSS 9.8, KEV)
- [CVE-2021-39032](https://cve.now/CVE-2021-39032.md): IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local… (CVSS 4.0, IBM Sterling Gentran:Server for Microsoft Windows)
- [CVE-2022-21685](https://cve.now/CVE-2022-21685.md): Integer underflow in Frontier (CVSS 6.5, paritytech frontier · pallet-evm-precompile-modexp)
- [CVE-2022-21677](https://cve.now/CVE-2022-21677.md): Group advanced search option may leak group and group's members visibility (CVSS 4.3, discourse)
- [CVE-2021-32649](https://cve.now/CVE-2021-32649.md): Authenticated file write leads to remote code execution in october/system (CVSS 8.8, octobercms october · october/system)
- [CVE-2021-32650](https://cve.now/CVE-2021-32650.md): Arbitrary code execution in october/system (CVSS 8.8, octobercms october · october/system)
- [CVE-2022-0231](https://cve.now/CVE-2022-0231.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 5.7, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-33962](https://cve.now/CVE-2021-33962.md): China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface… (no CVSS)
- [CVE-2021-36781](https://cve.now/CVE-2021-36781.md): parsec: dangerous 777 permissions for /run/parsec (CVSS 5.9, openSUSE Factory)
- [CVE-2021-42551](https://cve.now/CVE-2021-42551.md): Reflected XSS in NetBiblio WebOPAC search functionality (CVSS 6.1, AlCoda NetBiblio WebOPAC)
- [CVE-2022-20698](https://cve.now/CVE-2022-20698.md): Clam AntiVirus (ClamAV) Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2022-20639](https://cve.now/CVE-2022-20639.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20638](https://cve.now/CVE-2022-20638.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20637](https://cve.now/CVE-2022-20637.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20636](https://cve.now/CVE-2022-20636.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20635](https://cve.now/CVE-2022-20635.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20660](https://cve.now/CVE-2022-20660.md): Cisco IP Phones Information Disclosure Vulnerability (CVSS 4.6, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2022-20658](https://cve.now/CVE-2022-20658.md): Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability (CVSS 9.6, Cisco Unified Contact Center Domain Manager)
- [CVE-2022-20647](https://cve.now/CVE-2022-20647.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20646](https://cve.now/CVE-2022-20646.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20645](https://cve.now/CVE-2022-20645.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20644](https://cve.now/CVE-2022-20644.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20643](https://cve.now/CVE-2022-20643.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20642](https://cve.now/CVE-2022-20642.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20641](https://cve.now/CVE-2022-20641.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20640](https://cve.now/CVE-2022-20640.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-22056](https://cve.now/CVE-2022-22056.md): Le-yan Co., Ltd. dental management system - Hard-coded Credentials (CVSS 9.8, Le-yan Co. Dental Management System)
- [CVE-2022-22055](https://cve.now/CVE-2022-22055.md): Le-yan Co., Ltd. dental management system - SQL Injection (CVSS 9.8, Le-yan Co. Dental Management System)
- [CVE-2022-22054](https://cve.now/CVE-2022-22054.md): ASUS RT-AX56U - Path Traversal (CVSS 6.5, ASUS RT-AX56U)
- [CVE-2021-46255](https://cve.now/CVE-2021-46255.md): eyouCMS V1.5.5-UTF8-SP3\_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename. (no CVSS)
- [CVE-2021-38692](https://cve.now/CVE-2021-38692.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38691](https://cve.now/CVE-2021-38691.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38690](https://cve.now/CVE-2021-38690.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38689](https://cve.now/CVE-2021-38689.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38682](https://cve.now/CVE-2021-38682.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38678](https://cve.now/CVE-2021-38678.md): Open Redirect Vulnerability in QcalAgent (CVSS 6.1, QNAP Systems QcalAgent)
- [CVE-2021-38677](https://cve.now/CVE-2021-38677.md): Reflected XSS Vulnerability in QcalAgent (CVSS 5.3, QNAP Systems QcalAgent)
- [CVE-2021-45762](https://cve.now/CVE-2021-45762.md): GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf\_sg\_vrml\_mf\_reset(). (no CVSS)
- [CVE-2021-45763](https://cve.now/CVE-2021-45763.md): GPAC v1.1.0 was discovered to contain an invalid call in the function gf\_node\_changed(). (no CVSS)
- [CVE-2021-45764](https://cve.now/CVE-2021-45764.md): GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift\_chunk\_offsets.isra(). (no CVSS)
- [CVE-2021-45767](https://cve.now/CVE-2021-45767.md): GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr\_read\_id(). (no CVSS)
- [CVE-2021-46019](https://cve.now/CVE-2021-46019.md): An untrusted pointer dereference in rec\_db\_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application… (no CVSS)
- [CVE-2021-46022](https://cve.now/CVE-2021-46022.md): An Use-After-Free vulnerability in rec\_mset\_elem\_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or… (no CVSS)
- [CVE-2022-0213](https://cve.now/CVE-2022-0213.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2022-21680](https://cve.now/CVE-2022-21680.md): Cubic catastrophic backtracking (ReDoS) in marked (CVSS 7.5, markedjs marked · marked)
- [CVE-2022-21681](https://cve.now/CVE-2022-21681.md): Exponential catastrophic backtracking (ReDoS) in marked (CVSS 7.5, markedjs marked · marked)
- [CVE-2022-23218](https://cve.now/CVE-2022-23218.md): The deprecated compatibility function svcunix\_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argu (CVSS 9.8)
- [CVE-2022-23219](https://cve.now/CVE-2022-23219.md): The deprecated compatibility function clnt\_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname arg (CVSS 9.8)
- [CVE-2022-23222](https://cve.now/CVE-2022-23222.md): kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2022-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.