CVEs published January 17 to January 23, 2022
509 CVEs were published Jan 17 to Jan 23, 2022, 11 of them critical. CISA added 17 vulnerabilities to its Known Exploited Vulnerabilities catalog.
- CVEs published
- 509
- Critical
- 11
- Added to CISA KEV
- 17
- Busiest day
- Wed, Jan 19 (231)
- Quietest day
- Sat, Jan 22 (3)
- January 17, 202235 CVEs
- January 18, 202285 CVEs · 1 critical
- January 19, 2022231 CVEs · 9 critical
- January 20, 202272 CVEs
- January 21, 202279 CVEs · 1 critical
- January 22, 20223 CVEs
- January 23, 20224 CVEs
Added to CISA KEV 17
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2020-13671Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extenDrupal Core · drupal/core +1
- CVE-2020-13927The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security riApache Airflow · apache-airflow
- CVE-2020-14864Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation).Oracle Business Intelligence Enterprise Edition
- CVE-2021-21315Command Injection Vulnerabilitysebhildebrandt systeminformation · systeminformation
- CVE-2021-21975Server Side Request Forgery in vRealize Operations Manager API (CVE-2021-21975) prior to 8.4 may allow a malicious actor with network accessVMware vRealize Operations
- CVE-2021-22991On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3,BIG-IP
- CVE-2021-25296Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25297Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-25298Nagios XI version xi-5.7.5 is affected by OS command injection.
- CVE-2021-32648Account Takeover in Octobercmsoctobercms october · october/system
- CVE-2021-33766Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-40870An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922.
- CVE-2006-1547ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service vstruts:struts
- CVE-2012-0391The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception haorg.apache.struts:struts2-core · org.apache.struts.xwork:xw…
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2021-35247Improper Input Validation Vulnerability in Serv-USolarWinds Serv-U