CVEs published January 4, 2022
56 CVEs were published on January 4, 2022: 4 critical, 10 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 4
- High
- 10
- Medium
- 6
- Low
- 1
- Unrated
- 35
- Now in CISA KEV
- 1
- Fix available
- 26
Most affected products
- KONICA MINOLTA bizhub series
- 5
- Apache Software Foundation Apache James · org.apache.james:…
- 4
- django
- 3
- MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…
- 3
- MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- 3
- Aaron-Junker USOC
- 2
- convos-chat convos
- 2
- oroinc platform · oro/platform
- 2
- spinnaker
- 2
- Apache Software Foundation Apache Geode · org.apache.geode:…
- 1
Critical 4
- CVE-2022-21644 SQL Injection via search in USOCAaron-Junker USOC
- CVE-2022-21643 SQL Injection in USOCAaron-Junker USOC
- CVE-2021-43832Improper Access Control in spinnakerspinnaker
- CVE-2021-24042The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.Facebook WhatsApp Desktop · Facebook WhatsApp for KaiOS +4
High 10
- CVE-2021-45116An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.django
- CVE-2022-21649Stored XSS via attribute in convosconvos-chat convos
- CVE-2022-21650Stored XSS via html file upload in convosconvos-chat convos
- CVE-2022-21648Sandbox bypass in Latte templatesnette latte · latte/latte
- CVE-2022-21647Deserialization of Untrusted Data in Codeigniter4CodeIgniter4 · codeigniter4/framework
- CVE-2021-43852JavaScript Prototype Pollution in oro/platformoroinc platform · oro/platform
- CVE-2022-0086Server-Side Request Forgery (SSRF) in transloadit/uppytransloadit/uppy · @uppy/companion
- CVE-2021-3842Inefficient Regular Expression Complexity in nltk/nltknltk/nltk · nltk
- CVE-2021-31833Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally loggMcAfee Application and Change Control
- CVE-2022-0083Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
Medium, low and unrated 42
- CVE-2021-45115An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.django
- CVE-2021-45452Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directdjango
- CVE-2021-22045VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2.VMware ESXi, VMware Workstation and VMware Fusion
- CVE-2021-41388Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability.
- CVE-2021-43850Denial of Service in discoursediscourse
- CVE-2021-43677Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.
- CVE-2021-41236XSS vulnerability in oro/platformoroinc platform · oro/platform
- CVE-2021-39143Path Traversal in spinnakerspinnaker
- CVE-2021-3845External Control of File Name or Path in netristv/ws-scrcpynetristv/ws-scrcpy
- CVE-2022-20023In Bluetooth, there is a possible application crash due to bluetooth flooding a device with LMP_AU_rand packet.MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…
- CVE-2022-20022In Bluetooth, there is a possible link disconnection due to bluetooth does not properly handle a connection attempt from a host with the samMediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…
- CVE-2022-20021In Bluetooth, there is a possible application crash due to bluetooth does not properly handle the reception of multiple LMP_host_connection_MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…
- CVE-2022-20020In libvcodecdrv, there is a possible information disclosure due to a missing bounds check.MediaTek MT6739, MT6768, MT6779, MT6781, MT6785, MT6833, MT…
- CVE-2022-20019In libMtkOmxGsmDec, there is a possible information disclosure due to an incorrect bounds check.MediaTek MT6595, MT6735, MT6737, MT6739, MT6750, MT6750S, M…
- CVE-2022-20018In seninf driver, there is a possible information disclosure due to uninitialized data.MediaTek MT6580, MT6739, MT6757, MT6757C, MT6757CD, MT6757C…
- CVE-2022-20016In vow driver, there is a possible memory corruption due to improper locking.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20015In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data.MediaTek MT6739, MT6757, MT6757C, MT6757CD, MT6757CH, MT676…
- CVE-2022-20014In vow driver, there is a possible memory corruption due to improper input validation.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20013In vow driver, there is a possible memory corruption due to a race condition.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-20012In mdp driver, there is a possible memory corruption due to an integer overflow.MediaTek MT6580, MT6739, MT6750, MT6750S, MT6753, MT6755, M…
- CVE-2021-41789In wifi driver, there is a possible system crash due to a missing validation check.
- CVE-2021-40148In Modem EMM, there is a possible information disclosure due to a missing data encryption.
- CVE-2021-45389A flaw was found with the JWT token.
- CVE-2021-45912An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS command
- CVE-2021-45980Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API.
- CVE-2021-45979Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript AP
- CVE-2021-45978Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API.
- CVE-2021-45913A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel.
- CVE-2021-43711The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET paramete
- CVE-2021-44168A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local Fortinet FortiOS
- CVE-2021-40525Sieve file storage vulnerable to path traversal attacksApache Software Foundation Apache James · org.apache.james:…
- CVE-2021-40111Apache James IMAP parsing Denial Of ServiceApache Software Foundation Apache James · org.apache.james:…
- CVE-2021-40110Apache James IMAP vulnerable to a ReDoSApache Software Foundation Apache James · org.apache.james:…
- CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)Apache Software Foundation Apache James · org.apache.james:…
- CVE-2021-34797Apache Geode project log file redaction of sensitive information vulnerabilityApache Software Foundation Apache Geode · org.apache.geode:…
- CVE-2021-20872Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6KONICA MINOLTA bizhub series
- CVE-2021-20871Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bKONICA MINOLTA bizhub series
- CVE-2021-20870Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C55KONICA MINOLTA bizhub series
- CVE-2021-20869Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bKONICA MINOLTA bizhub series
- CVE-2021-20868Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and KONICA MINOLTA bizhub series
- CVE-2021-43942Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected CroAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-41141Missing release of locks in PJSIPpjsip pjproject