# CVEs published 2022-01-04

56 CVEs were published on January 4, 2022: 4 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-45115](https://cve.now/CVE-2021-45115.md): An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. (no CVSS, django)
- [CVE-2021-45116](https://cve.now/CVE-2021-45116.md): An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. (CVSS 7.5, django)
- [CVE-2021-45452](https://cve.now/CVE-2021-45452.md): Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are direct (no CVSS, django)
- [CVE-2021-22045](https://cve.now/CVE-2021-22045.md): VMware ESXi (7.0, 6.7 before ESXi670-202111101-SG and 6.5 before ESXi650-202110101-SG), VMware Workstation (16.2.0) and VMware Fusion (12.2. (no CVSS, VMware ESXi, VMware Workstation and VMware Fusion)
- [CVE-2021-41388](https://cve.now/CVE-2021-41388.md): Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. (no CVSS)
- [CVE-2022-21649](https://cve.now/CVE-2022-21649.md): Stored XSS via attribute in convos (CVSS 7.6, convos-chat convos)
- [CVE-2022-21650](https://cve.now/CVE-2022-21650.md): Stored XSS via html file upload in convos (CVSS 7.6, convos-chat convos)
- [CVE-2022-21648](https://cve.now/CVE-2022-21648.md): Sandbox bypass in Latte templates (CVSS 8.2, nette latte · latte/latte)
- [CVE-2022-21647](https://cve.now/CVE-2022-21647.md): Deserialization of Untrusted Data in Codeigniter4 (CVSS 7.7, CodeIgniter4 · codeigniter4/framework)
- [CVE-2022-21644](https://cve.now/CVE-2022-21644.md): SQL Injection via search in USOC (CVSS 9.1, Aaron-Junker USOC)
- [CVE-2022-21643](https://cve.now/CVE-2022-21643.md): SQL Injection in USOC (CVSS 10.0, Aaron-Junker USOC)
- [CVE-2021-43852](https://cve.now/CVE-2021-43852.md): JavaScript Prototype Pollution in oro/platform (CVSS 8.8, oroinc platform · oro/platform)
- [CVE-2021-43850](https://cve.now/CVE-2021-43850.md): Denial of Service in discourse (CVSS 6.8, discourse)
- [CVE-2021-43832](https://cve.now/CVE-2021-43832.md): Improper Access Control in spinnaker (CVSS 10.0, spinnaker)
- [CVE-2021-43677](https://cve.now/CVE-2021-43677.md): Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. (no CVSS)
- [CVE-2021-41236](https://cve.now/CVE-2021-41236.md): XSS vulnerability in oro/platform (CVSS 6.9, oroinc platform · oro/platform)
- [CVE-2021-24042](https://cve.now/CVE-2021-24042.md): The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2. (CVSS 9.8, Facebook WhatsApp Desktop · Facebook WhatsApp for KaiOS +4)
- [CVE-2021-39143](https://cve.now/CVE-2021-39143.md): Path Traversal in spinnaker (CVSS 6.6, spinnaker)
- [CVE-2022-0086](https://cve.now/CVE-2022-0086.md): Server-Side Request Forgery (SSRF) in transloadit/uppy (CVSS 8.2, transloadit/uppy · @uppy/companion)
- [CVE-2021-3845](https://cve.now/CVE-2021-3845.md): External Control of File Name or Path in netristv/ws-scrcpy (no CVSS, netristv/ws-scrcpy)
- [CVE-2022-20023](https://cve.now/CVE-2022-20023.md): In Bluetooth, there is a possible application crash due to bluetooth flooding a device with LMP\_AU\_rand packet. (no CVSS, MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…)
- [CVE-2022-20022](https://cve.now/CVE-2022-20022.md): In Bluetooth, there is a possible link disconnection due to bluetooth does not properly handle a connection attempt from a host with the sam (no CVSS, MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…)
- [CVE-2022-20021](https://cve.now/CVE-2022-20021.md): In Bluetooth, there is a possible application crash due to bluetooth does not properly handle the reception of multiple LMP\_host\_connection\_ (no CVSS, MediaTek MT6580, MT6630, MT6735, MT6737, MT6739, MT6750S, M…)
- [CVE-2022-20020](https://cve.now/CVE-2022-20020.md): In libvcodecdrv, there is a possible information disclosure due to a missing bounds check. (no CVSS, MediaTek MT6739, MT6768, MT6779, MT6781, MT6785, MT6833, MT…)
- [CVE-2022-20019](https://cve.now/CVE-2022-20019.md): In libMtkOmxGsmDec, there is a possible information disclosure due to an incorrect bounds check. (CVSS 5.5, MediaTek MT6595, MT6735, MT6737, MT6739, MT6750, MT6750S, M…)
- [CVE-2022-20018](https://cve.now/CVE-2022-20018.md): In seninf driver, there is a possible information disclosure due to uninitialized data. (no CVSS, MediaTek MT6580, MT6739, MT6757, MT6757C, MT6757CD, MT6757C…)
- [CVE-2022-20016](https://cve.now/CVE-2022-20016.md): In vow driver, there is a possible memory corruption due to improper locking. (no CVSS, MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-20015](https://cve.now/CVE-2022-20015.md): In kd\_camera\_hw driver, there is a possible information disclosure due to uninitialized data. (no CVSS, MediaTek MT6739, MT6757, MT6757C, MT6757CD, MT6757CH, MT676…)
- [CVE-2022-20014](https://cve.now/CVE-2022-20014.md): In vow driver, there is a possible memory corruption due to improper input validation. (CVSS 6.7, MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-20013](https://cve.now/CVE-2022-20013.md): In vow driver, there is a possible memory corruption due to a race condition. (no CVSS, MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-20012](https://cve.now/CVE-2022-20012.md): In mdp driver, there is a possible memory corruption due to an integer overflow. (no CVSS, MediaTek MT6580, MT6739, MT6750, MT6750S, MT6753, MT6755, M…)
- [CVE-2021-41789](https://cve.now/CVE-2021-41789.md): In wifi driver, there is a possible system crash due to a missing validation check. (no CVSS)
- [CVE-2021-40148](https://cve.now/CVE-2021-40148.md): In Modem EMM, there is a possible information disclosure due to a missing data encryption. (no CVSS)
- [CVE-2021-45389](https://cve.now/CVE-2021-45389.md): A flaw was found with the JWT token. (no CVSS)
- [CVE-2021-45912](https://cve.now/CVE-2021-45912.md): An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS command (no CVSS)
- [CVE-2021-3842](https://cve.now/CVE-2021-3842.md): Inefficient Regular Expression Complexity in nltk/nltk (CVSS 7.5, nltk/nltk · nltk)
- [CVE-2021-45980](https://cve.now/CVE-2021-45980.md): Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via getURL in the JavaScript API. (no CVSS)
- [CVE-2021-45979](https://cve.now/CVE-2021-45979.md): Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via app.launchURL in the JavaScript AP (no CVSS)
- [CVE-2021-45978](https://cve.now/CVE-2021-45978.md): Foxit PDF Reader and PDF Editor before 11.1 on macOS allow remote attackers to execute arbitrary code via xfa.host.gotoURL in the XFA API. (no CVSS)
- [CVE-2021-45913](https://cve.now/CVE-2021-45913.md): A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel. (no CVSS)
- [CVE-2021-43711](https://cve.now/CVE-2021-43711.md): The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646\_B20201211 has a command injection vulnerability when receiving GET paramete (no CVSS)
- [CVE-2021-44168](https://cve.now/CVE-2021-44168.md): A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local (CVSS 3.3, KEV, Fortinet FortiOS)
- [CVE-2021-31833](https://cve.now/CVE-2021-31833.md): Potential product security bypass vulnerability in McAfee Application and Change Control (MACC) prior to version 8.3.4 allows a locally logg (CVSS 7.1, McAfee Application and Change Control)
- [CVE-2021-40525](https://cve.now/CVE-2021-40525.md): Sieve file storage vulnerable to path traversal attacks (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2021-40111](https://cve.now/CVE-2021-40111.md): Apache James IMAP parsing Denial Of Service (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2021-40110](https://cve.now/CVE-2021-40110.md): Apache James IMAP vulnerable to a ReDoS (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2021-38542](https://cve.now/CVE-2021-38542.md): Apache James vulnerable to STARTTLS command injection (IMAP and POP3) (no CVSS, Apache Software Foundation Apache James · org.apache.james:…)
- [CVE-2021-34797](https://cve.now/CVE-2021-34797.md): Apache Geode project log file redaction of sensitive information vulnerability (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2022-0083](https://cve.now/CVE-2022-0083.md): Generation of Error Message Containing Sensitive Information in livehelperchat/livehelperchat (CVSS 7.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-20872](https://cve.now/CVE-2021-20872.md): Protection mechanism failure vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 (no CVSS, KONICA MINOLTA bizhub series)
- [CVE-2021-20871](https://cve.now/CVE-2021-20871.md): Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, b (no CVSS, KONICA MINOLTA bizhub series)
- [CVE-2021-20870](https://cve.now/CVE-2021-20870.md): Improper handling of exceptional conditions vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C55 (no CVSS, KONICA MINOLTA bizhub series)
- [CVE-2021-20869](https://cve.now/CVE-2021-20869.md): Exposure of sensitive information to an unauthorized actor vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, b (no CVSS, KONICA MINOLTA bizhub series)
- [CVE-2021-20868](https://cve.now/CVE-2021-20868.md): Incorrect authorization vulnerability in KONICA MINOLTA bizhub series (bizhub C750i G00-35 and earlier, bizhub C650i/C550i/C450i G00-B6 and (no CVSS, KONICA MINOLTA bizhub series)
- [CVE-2021-43942](https://cve.now/CVE-2021-43942.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cro (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-41141](https://cve.now/CVE-2021-41141.md): Missing release of locks in PJSIP (CVSS 5.9, pjsip pjproject)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.