CVEs published January 5, 2022
32 CVEs were published on January 5, 2022: 1 critical, 4 high.
- Published
- 32
- Critical
- 1
- High
- 4
- Medium
- 8
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- Bottelet DaybydayCRM · Bottelet flarepoint +1
- 5
- Linux
- 3
- shopware · shopware/shopware
- 2
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- containerd · github.com/containerd/containerd
- 1
- discourse
- 1
- Fortinet FortiMail
- 1
- Google Dart SDK
- 1
- IBM PowerVM Hypervisor
- 1
- pluginsGLPI addressing
- 1
Critical 1
High 4
- CVE-2021-43816Improper Preservation of Permissions in containerdcontainerd · github.com/containerd/containerd
- CVE-2021-38918IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation ofIBM PowerVM Hypervisor
- CVE-2022-22111DayByDay CRM - Missing Authorization when Changing PasswordBottelet DaybydayCRM · Bottelet flarepoint +1
- CVE-2022-22110DayByDay CRM - Weak Password Requirements in Update UserBottelet DaybydayCRM · Bottelet flarepoint +1
Medium, low and unrated 27
- CVE-2020-27428A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTMscratch-svg-renderer
- CVE-2020-23986Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulner
- CVE-2021-45971An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 b
- CVE-2021-41842An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.
- CVE-2021-45969An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 bef
- CVE-2021-45970An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 befo
- CVE-2020-5956An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5.
- CVE-2022-21653Hash collision in typelevel jawntypelevel jawn · org.typelevel:jawn-parser_0.25 +17
- CVE-2021-45833A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D__create_chunk_file_map_hyper function in /hdf5/src/H5Dchunk.
- CVE-2021-45832A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of Service (context-depen
- CVE-2021-45830A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c, which could cause a Denial
- CVE-2022-21652Insufficient Session Expiration in shopwareshopware · shopware/shopware
- CVE-2022-21651Open redirect in shopwareshopware · shopware/shopware
- CVE-2022-21642Exposure of whisper participants in discoursediscourse
- CVE-2021-28713Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whLinux
- CVE-2021-28712Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whLinux
- CVE-2021-28711Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains whLinux
- CVE-2022-22109DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task TitleBottelet DaybydayCRM · Bottelet flarepoint +1
- CVE-2022-22108DayByDay CRM - Missing Authorization when Viewing AbsencesBottelet DaybydayCRM · Bottelet flarepoint +1
- CVE-2022-22107DayByDay CRM - Missing Authorization when Viewing AppointmentsBottelet DaybydayCRM · Bottelet flarepoint +1
- CVE-2021-41043Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact.The Tcpdump Group tcpslice
- CVE-2020-15933A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and beFortinet FortiMail
- CVE-2021-31589A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1
- CVE-2021-22567Bidirectional Override in Dart SDKGoogle Dart SDK
- CVE-2021-43946Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscrAtlassian Jira Server · Atlassian Jira Data Center
- CVE-2021-45831A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2, which causes a Denial of Service.
- CVE-2021-46038A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent).