CVEs published January 6, 2022
56 CVEs were published on January 6, 2022: 0 critical, 7 high.
- Published
- 56
- Critical
- 0
- High
- 7
- Medium
- 5
- Low
- 0
- Unrated
- 44
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Apache Software Foundation Apache Kylin · org.apache.kylin:…
- 6
- wordpress-develop
- 4
- Apache Software Foundation Apache Portals · org.apache.port…
- 3
- Linux
- 2
- Apache Software Foundation Apache Avro · Apache.Avro
- 1
- Atlassian Jira Server · Atlassian Jira Data Center
- 1
- bookstackapp/bookstack · ssddanbrown/bookstack
- 1
- digitalbazaar/forge · node-forge
- 1
- hoppscotch/hoppscotch
- 1
- org.pac4j:pac4j-oidc
- 1
High 7
- CVE-2022-21662Stored XSS in WordPresswordpress-develop
- CVE-2022-21664SQL injection in WordPresswordpress-develop
- CVE-2022-21661SQL injection in WordPresswordpress-develop
- CVE-2022-0128Out-of-bounds Read in vim/vimvim/vim
- CVE-2021-46143In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
- CVE-2022-0121Cross-site Scripting in hoppscotch/hoppscotchhoppscotch/hoppscotch
- CVE-2021-43947Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code viAtlassian Jira Server · Atlassian Jira Data Center
Medium, low and unrated 49
- CVE-2022-21663Authenticated Object Injection in Multisites in WordPresswordpress-develop
- CVE-2021-42841Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts.
- CVE-2021-43045Possible DOS vulnerabilities in C# Avro SDKApache Software Foundation Apache Avro · Apache.Avro
- CVE-2021-4194Improper Access Control in bookstackapp/bookstackbookstackapp/bookstack · ssddanbrown/bookstack
- CVE-2021-28715Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text eLinux
- CVE-2021-28714Guest can force Linux netback driver to hog large amounts of kernel memory T[his CNA information record relates to multiple CVEs; the text eLinux
- CVE-2021-46079An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0.
- CVE-2021-46078An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0.
- CVE-2021-46068A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
- CVE-2021-46067In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
- CVE-2021-45745A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.
- CVE-2021-45744A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.
- CVE-2021-46069A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login pan
- CVE-2021-46070A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login
- CVE-2021-46071A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login pan
- CVE-2021-46072A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login pane
- CVE-2021-46073A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section i
- CVE-2021-46074A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in
- CVE-2021-46075A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0.
- CVE-2021-46076Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload.
- CVE-2021-46080A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0.
- CVE-2021-44591In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks
- CVE-2021-44590In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c.
- CVE-2021-44878If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it wiorg.pac4j:pac4j-oidc
- CVE-2021-45458Hardcoded credentialsApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-45457Overly broad CORS configurationApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-45456Command injectionApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-36774Mysql JDBC Connector Deserialize RCEApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-31522Apache Kylin unsafe class loadingApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-27738Improper Access Control to Streaming Coordinator & SSRFApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2021-44584Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script o
- CVE-2021-44564A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an att
- CVE-2021-44351An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate_download.php id parameter.
- CVE-2021-36739XSS vulnerability in the MVCBean JSP portlet maven archetypeApache Software Foundation Apache Portals · org.apache.port…
- CVE-2021-36738XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletApache Software Foundation Apache Portals · org.apache.port…
- CVE-2021-36737XSS in V3 Demo PortletApache Software Foundation Apache Portals · org.apache.port…
- CVE-2022-22707In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 b
- CVE-2021-46145The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking.
- CVE-2022-0122Open Redirect in digitalbazaar/forgedigitalbazaar/forge · node-forge
- CVE-2022-22704The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expe
- CVE-2021-46144Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequenc
- CVE-2021-46141An issue was discovered in uriparser before 0.9.6.
- CVE-2021-46142An issue was discovered in uriparser before 0.9.6.
- CVE-2021-46039A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context
- CVE-2021-46040A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (
- CVE-2021-46041A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service.
- CVE-2021-46042A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service.
- CVE-2021-46043A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service.
- CVE-2021-46044A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).