CVEs published January 7, 2022
102 CVEs were published on January 7, 2022: 3 critical, 8 high. 2 are now in CISA KEV.
- Published
- 102
- Critical
- 3
- High
- 8
- Medium
- 19
- Low
- 7
- Unrated
- 65
- Now in CISA KEV
- 2
- Fix available
- 28
Most affected products
- Huawei HarmonyOS
- 11
- Samsung Mobile Devices
- 10
- Huawei EMUI · Huawei Magic UI +1
- 8
- IBM Security Verify Access
- 5
- Huawei HarmonyOS · Huawei EMUI
- 4
- EMUI;Magic UI;HarmonyOS
- 3
- pillow
- 3
- chocobozzz/peertube
- 2
- FANUC R-30iA, R-30iA Mate · FANUC R-30iB, R-30iB Mate, R… +1
- 2
- PartKeepr
- 2
Critical 3
High 8
- CVE-2022-22288Improper authorization vulnerability in Galaxy Store prior to 4.5.36.5 allows remote app installation of the allowlist.Samsung Mobile Galaxy Store
- CVE-2022-22264Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary filSamsung Mobile Devices
- CVE-2021-32998The FANUC R-30iA and R-30iB series controllers are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbFANUC R-30iA, R-30iA Mate · FANUC R-30iB, R-30iB Mate, R… +1
- CVE-2021-32996The FANUC R-30iA and R-30iB series controllers are vulnerable to integer coercion errors, which cause the device to crash.FANUC R-30iA, R-30iA Mate · FANUC R-30iB, R-30iB Mate, R… +1
- CVE-2021-23568Prototype Pollutionextend2
- CVE-2021-38990IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the mount command which could lead to cIBM AIX · IBM VIOS
- CVE-2022-21667Denial of Service in soketisoketi · @soketi/soketi
- CVE-2021-22569Denial of Service of protobuf-java parsing procedureGoogle protobuf-java · Google protobuf-kotlin +4
Medium, low and unrated 91
- CVE-2021-30360Users have access to the directory where the installation repair occurs.Check Point Remote Access Client
- CVE-2021-22060In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious Spring Framework · org.springframework:spring-core
- CVE-2021-23173ICSMA-22-006-01 Philips Engage SoftwarePhilips Engage Software
- CVE-2022-21823A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attackeIvanti Workspace Control
- CVE-2021-35247Improper Input Validation Vulnerability in Serv-USolarWinds Serv-U
- CVE-2021-39996There is a Heap-based buffer overflow vulnerability with the NFC module in smartphones.EMUI;Magic UI;HarmonyOS
- CVE-2021-39993There is an Integer overflow vulnerability with ACPU in smartphones.EMUI;Magic UI
- CVE-2021-39998There is Vulnerability of APIs being concurrently called for multiple times in HwConnectivityExService a in smartphones.EMUI;Magic UI;HarmonyOS
- CVE-2021-40032The bone voice ID TA has a vulnerability in information management,Successful exploitation of this vulnerability may affect data confidentiaHuawei HarmonyOS · Huawei EMUI
- CVE-2021-40028The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data integrity.Huawei HarmonyOS
- CVE-2021-40027The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confHuawei HarmonyOS · Huawei EMUI
- CVE-2021-40022The weaver module has a vulnerability in parameter type verification,Successful exploitation of this vulnerability may affect data confidentHuawei HarmonyOS
- CVE-2021-40025The eID module has a vulnerability that causes the memory to be used without being initialized,Successful exploitation of this vulnerabilityHuawei HarmonyOS
- CVE-2021-40021The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data confidentialityHuawei HarmonyOS
- CVE-2021-40018The eID module has a null pointer reference vulnerability.Huawei HarmonyOS
- CVE-2021-40014The bone voice ID trusted application (TA) has a heap overflow vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-40010The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability may result in malicious code execution.HarmonyOS;EMUI;Magic UI
- CVE-2021-40039There is a Null pointer dereference vulnerability in the camera module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40038There is a Double free vulnerability in the AOD module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40037There is a Vulnerability of accessing resources using an incompatible type (type confusion) in the MPTCP subsystem in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40035There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40031There is a Null pointer dereference vulnerability in the camera module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40026There is a Heap-based buffer overflow vulnerability in the AOD module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40029There is a Buffer overflow vulnerability due to a boundary error with the Samba server in the file management module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40009There is an Out-of-bounds write vulnerability in the AOD module in smartphones.Huawei EMUI · Huawei Magic UI +1
- CVE-2021-40020There is an Out-of-bounds array read vulnerability in the security storage module in smartphones.Huawei EMUI · Huawei Magic UI
- CVE-2021-40011There is an uncontrolled resource consumption vulnerability in the display module.EMUI;Magic UI;HarmonyOS
- CVE-2021-40005The distributed data service component has a vulnerability in data access control.Huawei HarmonyOS
- CVE-2021-40006Vulnerability of design defects in the security algorithm component.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-40004The cellular module has a vulnerability in permission management.Huawei HarmonyOS
- CVE-2021-40003HwPCAssistant has a path traversal vulnerability.Huawei HarmonyOS
- CVE-2021-40002The Bluetooth module has an out-of-bounds write vulnerability.Huawei HarmonyOS
- CVE-2021-40000The Bluetooth module has an out-of-bounds write vulnerability.Huawei HarmonyOS
- CVE-2021-40001The CaasKit module has a path traversal vulnerability.Huawei HarmonyOS
- CVE-2021-40041There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI WS318n product when processing network settings.WS318n-21
- CVE-2022-22289Improper access control vulnerability in S Assistant prior to version 7.5 allows attacker to remotely get senstive information.Samsung Mobile S Assistant
- CVE-2022-22287Abitrary file access vulnerability in Samsung Email prior to 6.1.60.16 allows attacker to read isolated data in sandbox.Samsung Mobile Samsung Email
- CVE-2022-22286A vulnerability using PendingIntent in Bixby Routines prior to version 3.1.21.8 in Android R(11.0) and 2.6.30.5 in Android Q(10.0) allows atSamsung Mobile Bixby Routines
- CVE-2022-22285A vulnerability using PendingIntent in Reminder prior to version 12.2.05.0 in Android R(11.0) and 12.3.02.1000 in Android S(12.0) allows attSamsung Mobile Reminder
- CVE-2022-22283Improper session management vulnerability in Samsung Health prior to 6.20.1.005 prevents logging out from Samsung Health App.Samsung Mobile Samsung Health
- CVE-2022-22284Improper authentication vulnerability in Samsung Internet prior to 16.0.2.19 allows attackers to bypass secret mode password authenticationSamsung Mobile Samsung Internet
- CVE-2022-22271A missing input validation before memory copy in TIMA trustlet prior to SMR Jan-2022 Release 1 allows attackers to copy data from arbitrary Samsung Mobile Devices
- CVE-2022-22270An implicit Intent hijacking vulnerability in Dialer prior to SMR Jan-2022 Release 1 allows unprivileged applications to access contact infoSamsung Mobile Devices
- CVE-2022-22269Keeping sensitive data in unprotected BluetoothSettingsProvider prior to SMR Jan-2022 Release 1 allows untrusted applications to get a localSamsung Mobile Devices
- CVE-2022-22267Implicit Intent hijacking vulnerability in ActivityMetricsLogger prior to SMR Jan-2022 Release 1 allows attackers to get running applicationSamsung Mobile Devices
- CVE-2022-22272Improper authorization in TelephonyManager prior to SMR Jan-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE Samsung Mobile Devices
- CVE-2022-22268Incorrect implementation of Knox Guard prior to SMR Jan-2022 Release 1 allows physically proximate attackers to temporary unlock the Knox GuSamsung Mobile Devices
- CVE-2022-22263Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity.Samsung Mobile Devices
- CVE-2022-22266(Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allowSamsung Mobile Devices
- CVE-2022-22265An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and codeSamsung Mobile Devices
- CVE-2021-46055A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- CVE-2021-46054A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
- CVE-2021-46053A Denial of Service vulnerability exists in Binaryen 103.
- CVE-2021-46052A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
- CVE-2021-46050A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
- CVE-2021-46048A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
- CVE-2022-22702PartKeepr versions up to v1.4.0, in the functionality to upload attachments using a URL when creating a part does not validate that requestsPartKeepr
- CVE-2022-22701PartKeepr versions up to v1.4.0, loads attachments using a URL while creating a part and allows the use of the 'file://' URI scheme, allowinPartKeepr
- CVE-2021-42748In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.
- CVE-2021-42749In Beaver Themer, attackers can bypass conditional logic controls (for hiding content) when viewing the post archives.
- CVE-2021-38957IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive information due to hazardous input validation during QR code genIBM Security Verify Access
- CVE-2021-38956IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in fIBM Security Verify Access
- CVE-2021-38921IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypIBM Security Verify Access
- CVE-2021-38895IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting.IBM Security Verify Access
- CVE-2021-38894IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could allow a remote attacker to obtain sensitive information when a detailed technical eIBM Security Verify Access
- CVE-2022-0133Improper Access Control in chocobozzz/peertubechocobozzz/peertube
- CVE-2022-0132Server-Side Request Forgery (SSRF) in chocobozzz/peertubechocobozzz/peertube
- CVE-2020-29050SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql c
- CVE-2021-46147An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-46148An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-46149An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-46150An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-46146An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2020-9061Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10ZooZ ZST10 · Silicon Labs 500 series +4
- CVE-2020-9060Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZENZooZ ZEN25 · ZooZ ZEN20 +4
- CVE-2020-9059Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leadinSchlage BE468 · Silicon Labs 500 series
- CVE-2020-9058Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 Linear LB60Z-1 · Dome DM501 +2
- CVE-2020-9057Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range toLinear WADWAZ-1 · Linear WAPIRZ-1 +3
- CVE-2021-20048A Stack-based buffer overflow in the SonicOS SessionID HTTP response header allows a remote authenticated attacker to cause Denial of ServicSonicWall SonicOS
- CVE-2021-20046A Stack-based buffer overflow in the SonicOS HTTP Content-Length response header allows a remote authenticated attacker to cause Denial of SSonicWall SonicOS
- CVE-2021-38674Reflected XSS Vulnerability in TFTPQNAP Systems QuTS hero · QNAP Systems QTS +1
- CVE-2021-25743ANSI escape characters in kubectl output are not being filteredKubernetes · k8s.io/kubernetes
- CVE-2021-42392The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.h2database h2 · com.h2database:h2
- CVE-2021-44528A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combinatihttps://github.com/rails/rails · actionpack
- CVE-2021-46045GPAC 1.0.1 is affected by: Abort failed.
- CVE-2021-46046A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent)
- CVE-2021-46047A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
- CVE-2021-46049A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial of Service.
- CVE-2021-46051A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a Denial of Service.
- CVE-2022-22815path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.pillow
- CVE-2022-22816path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.pillow