# CVEs published 2022-01-05 32 CVEs were published on January 5, 2022: 1 critical, 4 high. Days are UTC. - [CVE-2020-27428](https://cve.now/CVE-2020-27428.md): A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTM (no CVSS, scratch-svg-renderer) - [CVE-2020-23986](https://cve.now/CVE-2020-23986.md): Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulner (no CVSS) - [CVE-2021-45971](https://cve.now/CVE-2021-45971.md): An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 b (no CVSS) - [CVE-2021-41842](https://cve.now/CVE-2021-41842.md): An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5. (no CVSS) - [CVE-2021-45969](https://cve.now/CVE-2021-45969.md): An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 bef (no CVSS) - [CVE-2021-45970](https://cve.now/CVE-2021-45970.md): An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 befo (no CVSS) - [CVE-2020-5956](https://cve.now/CVE-2020-5956.md): An issue was discovered in SdLegacySmm in Insyde InsydeH2O with kernel 5.1 before 05.15.11, 5.2 before 05.25.11, 5.3 before 05.34.11, and 5. (no CVSS) - [CVE-2022-21653](https://cve.now/CVE-2022-21653.md): Hash collision in typelevel jawn (CVSS 5.9, typelevel jawn · org.typelevel:jawn-parser\_0.25 +17) - [CVE-2021-45833](https://cve.now/CVE-2021-45833.md): A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 via the H5D\_\_create\_chunk\_file\_map\_hyper function in /hdf5/src/H5Dchunk. (no CVSS) - [CVE-2021-45832](https://cve.now/CVE-2021-45832.md): A Stack-based Buffer Overflow Vulnerability exists in HDF5 1.13.1-1 at at hdf5/src/H5Eint.c, which causes a Denial of Service (context-depen (no CVSS) - [CVE-2021-45830](https://cve.now/CVE-2021-45830.md): A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F\_addr\_decode\_len in /hdf5/src/H5Fint.c, which could cause a Denial (no CVSS) - [CVE-2022-21652](https://cve.now/CVE-2022-21652.md): Insufficient Session Expiration in shopware (CVSS 3.5, shopware · shopware/shopware) - [CVE-2022-21651](https://cve.now/CVE-2022-21651.md): Open redirect in shopware (CVSS 6.8, shopware · shopware/shopware) - [CVE-2022-21642](https://cve.now/CVE-2022-21642.md): Exposure of whisper participants in discourse (CVSS 4.3, discourse) - [CVE-2021-43816](https://cve.now/CVE-2021-43816.md): Improper Preservation of Permissions in containerd (CVSS 8.0, containerd · github.com/containerd/containerd) - [CVE-2021-43779](https://cve.now/CVE-2021-43779.md): Remote Command Execution vulnerability (CVSS 9.9, pluginsGLPI addressing) - [CVE-2021-38918](https://cve.now/CVE-2021-38918.md): IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM management operations could lead to a violation of (CVSS 8.6, IBM PowerVM Hypervisor) - [CVE-2021-28713](https://cve.now/CVE-2021-28713.md): Rogue backends can cause DoS of guests via high frequency events T\[his CNA information record relates to multiple CVEs; the text explains wh (no CVSS, Linux) - [CVE-2021-28712](https://cve.now/CVE-2021-28712.md): Rogue backends can cause DoS of guests via high frequency events T\[his CNA information record relates to multiple CVEs; the text explains wh (no CVSS, Linux) - [CVE-2021-28711](https://cve.now/CVE-2021-28711.md): Rogue backends can cause DoS of guests via high frequency events T\[his CNA information record relates to multiple CVEs; the text explains wh (no CVSS, Linux) - [CVE-2022-22111](https://cve.now/CVE-2022-22111.md): DayByDay CRM - Missing Authorization when Changing Password (CVSS 8.8, Bottelet DaybydayCRM · Bottelet flarepoint +1) - [CVE-2022-22110](https://cve.now/CVE-2022-22110.md): DayByDay CRM - Weak Password Requirements in Update User (CVSS 7.5, Bottelet DaybydayCRM · Bottelet flarepoint +1) - [CVE-2022-22109](https://cve.now/CVE-2022-22109.md): DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title (CVSS 5.4, Bottelet DaybydayCRM · Bottelet flarepoint +1) - [CVE-2022-22108](https://cve.now/CVE-2022-22108.md): DayByDay CRM - Missing Authorization when Viewing Absences (CVSS 4.3, Bottelet DaybydayCRM · Bottelet flarepoint +1) - [CVE-2022-22107](https://cve.now/CVE-2022-22107.md): DayByDay CRM - Missing Authorization when Viewing Appointments (CVSS 4.3, Bottelet DaybydayCRM · Bottelet flarepoint +1) - [CVE-2021-41043](https://cve.now/CVE-2021-41043.md): Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact. (no CVSS, The Tcpdump Group tcpslice) - [CVE-2020-15933](https://cve.now/CVE-2020-15933.md): A exposure of sensitive information to an unauthorized actor in Fortinet FortiMail versions 6.0.9 and below, FortiMail versions 6.2.4 and be (CVSS 5.3, Fortinet FortiMail) - [CVE-2021-31589](https://cve.now/CVE-2021-31589.md): A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 (no CVSS) - [CVE-2021-22567](https://cve.now/CVE-2021-22567.md): Bidirectional Override in Dart SDK (CVSS 4.6, Google Dart SDK) - [CVE-2021-43946](https://cve.now/CVE-2021-43946.md): Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscr (no CVSS, Atlassian Jira Server · Atlassian Jira Data Center) - [CVE-2021-45831](https://cve.now/CVE-2021-45831.md): A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via \_\_strlen\_avx2, which causes a Denial of Service. (no CVSS) - [CVE-2021-46038](https://cve.now/CVE-2021-46038.md): A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink\_chunk.isra, which causes a Denial of Service (context-dependent). (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2022-01-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.