# CVEs published 2022-01-08

14 CVEs were published on January 8, 2022: 3 critical, 3 high. Days are UTC.

- [CVE-2022-22836](https://cve.now/CVE-2022-22836.md): CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request. (no CVSS)
- [CVE-2021-45442](https://cve.now/CVE-2021-45442.md): A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to (no CVSS, Trend Micro Worry-Free Business Security)
- [CVE-2021-45441](https://cve.now/CVE-2021-45441.md): A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specia (no CVSS, Trend Micro Apex One)
- [CVE-2021-45440](https://cve.now/CVE-2021-45440.md): A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-45231](https://cve.now/CVE-2021-45231.md): A link following privilege escalation vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2021-44024](https://cve.now/CVE-2021-44024.md): A link following denial-of-service vulnerability in Trend Micro Apex One (on-prem and SaaS) and Trend Micro Worry-Free Business Security (10 (no CVSS, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2022-22822](https://cve.now/CVE-2022-22822.md): addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 9.8, platform/external/expat)
- [CVE-2022-22823](https://cve.now/CVE-2022-22823.md): build\_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 9.8)
- [CVE-2022-22824](https://cve.now/CVE-2022-22824.md): defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 9.8)
- [CVE-2022-22825](https://cve.now/CVE-2022-22825.md): lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 8.8)
- [CVE-2022-22826](https://cve.now/CVE-2022-22826.md): nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 8.8)
- [CVE-2022-22827](https://cve.now/CVE-2022-22827.md): storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. (CVSS 8.8)
- [CVE-2022-22821](https://cve.now/CVE-2022-22821.md): NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admi (CVSS 2.0, nemo-toolkit)
- [CVE-2022-22844](https://cve.now/CVE-2022-22844.md): LibTIFF 4.3.0 has an out-of-bounds read in \_TIFFmemcpy in tif\_unix.c in certain situations involving a custom tag and 0x0200 as the second w (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.