# CVEs published 2022-01-06

56 CVEs were published on January 6, 2022: 0 critical, 7 high. Days are UTC.

- [CVE-2022-21662](https://cve.now/CVE-2022-21662.md): Stored XSS in WordPress (CVSS 8.0, wordpress-develop)
- [CVE-2022-21663](https://cve.now/CVE-2022-21663.md): Authenticated Object Injection in Multisites in WordPress (CVSS 6.6, wordpress-develop)
- [CVE-2022-21664](https://cve.now/CVE-2022-21664.md): SQL injection in WordPress (CVSS 7.4, wordpress-develop)
- [CVE-2022-21661](https://cve.now/CVE-2022-21661.md): SQL injection in WordPress (CVSS 8.0, wordpress-develop)
- [CVE-2021-42841](https://cve.now/CVE-2021-42841.md): Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. (no CVSS)
- [CVE-2021-43045](https://cve.now/CVE-2021-43045.md): Possible DOS vulnerabilities in C# Avro SDK (no CVSS, Apache Software Foundation Apache Avro · Apache.Avro)
- [CVE-2021-4194](https://cve.now/CVE-2021-4194.md): Improper Access Control in bookstackapp/bookstack (CVSS 4.3, bookstackapp/bookstack · ssddanbrown/bookstack)
- [CVE-2021-28715](https://cve.now/CVE-2021-28715.md): Guest can force Linux netback driver to hog large amounts of kernel memory T\[his CNA information record relates to multiple CVEs; the text e (CVSS 6.5, Linux)
- [CVE-2021-28714](https://cve.now/CVE-2021-28714.md): Guest can force Linux netback driver to hog large amounts of kernel memory T\[his CNA information record relates to multiple CVEs; the text e (no CVSS, Linux)
- [CVE-2022-0128](https://cve.now/CVE-2022-0128.md): Out-of-bounds Read in vim/vim (CVSS 7.1, vim/vim)
- [CVE-2021-46079](https://cve.now/CVE-2021-46079.md): An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. (no CVSS)
- [CVE-2021-46078](https://cve.now/CVE-2021-46078.md): An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. (no CVSS)
- [CVE-2021-46068](https://cve.now/CVE-2021-46068.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel. (no CVSS)
- [CVE-2021-46067](https://cve.now/CVE-2021-46067.md): In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover. (no CVSS)
- [CVE-2021-45745](https://cve.now/CVE-2021-45745.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. (no CVSS)
- [CVE-2021-45744](https://cve.now/CVE-2021-45744.md): A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel. (no CVSS)
- [CVE-2021-46069](https://cve.now/CVE-2021-46069.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login pan (no CVSS)
- [CVE-2021-46070](https://cve.now/CVE-2021-46070.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login (no CVSS)
- [CVE-2021-46071](https://cve.now/CVE-2021-46071.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login pan (no CVSS)
- [CVE-2021-46072](https://cve.now/CVE-2021-46072.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login pane (no CVSS)
- [CVE-2021-46073](https://cve.now/CVE-2021-46073.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section i (no CVSS)
- [CVE-2021-46074](https://cve.now/CVE-2021-46074.md): A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in (no CVSS)
- [CVE-2021-46075](https://cve.now/CVE-2021-46075.md): A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. (no CVSS)
- [CVE-2021-46076](https://cve.now/CVE-2021-46076.md): Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. (no CVSS)
- [CVE-2021-46080](https://cve.now/CVE-2021-46080.md): A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. (no CVSS)
- [CVE-2021-44591](https://cve.now/CVE-2021-44591.md): In libming 0.4.8, the parseSWF\_DEFINELOSSLESS2 function in util/parser.c lacks a boundary check that would lead to denial-of-service attacks (no CVSS)
- [CVE-2021-44590](https://cve.now/CVE-2021-44590.md): In libming 0.4.8, a memory exhaustion vulnerability exist in the function cws2fws in util/main.c. (no CVSS)
- [CVE-2021-44878](https://cve.now/CVE-2021-44878.md): If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it wi (no CVSS, org.pac4j:pac4j-oidc)
- [CVE-2021-45458](https://cve.now/CVE-2021-45458.md): Hardcoded credentials (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-45457](https://cve.now/CVE-2021-45457.md): Overly broad CORS configuration (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-45456](https://cve.now/CVE-2021-45456.md): Command injection (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-36774](https://cve.now/CVE-2021-36774.md): Mysql JDBC Connector Deserialize RCE (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-31522](https://cve.now/CVE-2021-31522.md): Apache Kylin unsafe class loading (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-27738](https://cve.now/CVE-2021-27738.md): Improper Access Control to Streaming Coordinator & SSRF (no CVSS, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2021-44584](https://cve.now/CVE-2021-44584.md): Cross-site scripting (XSS) vulnerability in index.php in emlog version \<= pro-1.0.7 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2021-44564](https://cve.now/CVE-2021-44564.md): A security vulnerability originally reported in the SYNC2101 product, and applicable to specific sub-families of SYNC devices, allows an att (no CVSS)
- [CVE-2021-44351](https://cve.now/CVE-2021-44351.md): An arbitrary file read vulnerability exists in NavigateCMS 2.9 via /navigate/navigate\_download.php id parameter. (no CVSS)
- [CVE-2021-36739](https://cve.now/CVE-2021-36739.md): XSS vulnerability in the MVCBean JSP portlet maven archetype (CVSS 6.1, Apache Software Foundation Apache Portals · org.apache.port…)
- [CVE-2021-36738](https://cve.now/CVE-2021-36738.md): XSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet (no CVSS, Apache Software Foundation Apache Portals · org.apache.port…)
- [CVE-2021-36737](https://cve.now/CVE-2021-36737.md): XSS in V3 Demo Portlet (no CVSS, Apache Software Foundation Apache Portals · org.apache.port…)
- [CVE-2022-22707](https://cve.now/CVE-2022-22707.md): In lighttpd 1.4.46 through 1.4.63, the mod\_extforward\_Forwarded function of the mod\_extforward plugin has a stack-based buffer overflow (4 b (no CVSS)
- [CVE-2021-46145](https://cve.now/CVE-2021-46145.md): The keyfob subsystem in Honda Civic 2012 vehicles allows a replay attack for unlocking. (no CVSS)
- [CVE-2022-0122](https://cve.now/CVE-2022-0122.md): Open Redirect in digitalbazaar/forge (CVSS 5.3, digitalbazaar/forge · node-forge)
- [CVE-2022-22704](https://cve.now/CVE-2022-22704.md): The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expe (no CVSS)
- [CVE-2021-46144](https://cve.now/CVE-2021-46144.md): Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequenc (no CVSS)
- [CVE-2021-46141](https://cve.now/CVE-2021-46141.md): An issue was discovered in uriparser before 0.9.6. (no CVSS)
- [CVE-2021-46142](https://cve.now/CVE-2021-46142.md): An issue was discovered in uriparser before 0.9.6. (no CVSS)
- [CVE-2021-46143](https://cve.now/CVE-2021-46143.md): In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m\_groupSize. (CVSS 8.1)
- [CVE-2022-0121](https://cve.now/CVE-2022-0121.md): Cross-site Scripting in hoppscotch/hoppscotch (CVSS 8.0, hoppscotch/hoppscotch)
- [CVE-2021-43947](https://cve.now/CVE-2021-43947.md): Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code vi (CVSS 7.2, Atlassian Jira Server · Atlassian Jira Data Center)
- [CVE-2021-46039](https://cve.now/CVE-2021-46039.md): A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift\_chunk\_offsets.part function, which causes a Denial of Service (context (no CVSS)
- [CVE-2021-46040](https://cve.now/CVE-2021-46040.md): A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace\_shift\_moov\_meta\_offsets function, which causes a Denial of Servie ( (no CVSS)
- [CVE-2021-46041](https://cve.now/CVE-2021-46041.md): A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64\_box\_new function, which causes a Denial of Service. (no CVSS)
- [CVE-2021-46042](https://cve.now/CVE-2021-46042.md): A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the \_fseeko function, which causes a Denial of Service. (no CVSS)
- [CVE-2021-46043](https://cve.now/CVE-2021-46043.md): A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf\_list\_count function, which causes a Denial of Service. (no CVSS)
- [CVE-2021-46044](https://cve.now/CVE-2021-46044.md): A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.