CVEs published January 10, 2022
47 CVEs were published on January 10, 2022: 2 critical, 7 high.
- Published
- 47
- Critical
- 2
- High
- 7
- Medium
- 11
- Low
- 0
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Atlassian Jira Service Management Server · Atlassian Jira S…
- 2
- directus
- 2
- Mirantis Lens
- 2
- nocodb
- 2
- sismics docs
- 2
- smarty-php smarty · smarty/smarty
- 2
- The Plus Addons for Elementor - Pro
- 2
- vim/vim
- 2
- 10Web Social Photo Feed
- 1
- Aaron-Junker USOC
- 1
Critical 2
High 7
- CVE-2022-21668Pipenv's requirements.txt parsing allows malicious index url in commentspypa pipenv · pipenv
- CVE-2022-21666 SQL Injection in useredit.phpAaron-Junker USOC
- CVE-2022-0155Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirectsfollow-redirects/follow-redirects · follow-redirects
- CVE-2022-22121NocoDB - CSV Injection in User Managementnocodb
- CVE-2021-44458Lack of websocket authentication in Lens causes remote code execution when visiting a malicious websiteMirantis Lens
- CVE-2021-21408Access to restricted PHP code by dynamic static class access in smartysmarty-php smarty · smarty/smarty
- CVE-2021-29454Sandbox Escape by math function in smartysmarty-php smarty · smarty/smarty
Medium, low and unrated 38
- CVE-2020-25427A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf_isom_get_track_id function
- CVE-2022-21672/etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-calfs-book make-ca
- CVE-2022-21670Uncontrolled Resource Consumption in markdown-itmarkdown-it
- CVE-2020-28679A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to exe
- CVE-2022-0174Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2021-25054WPcalc <= 2.1 - Authenticated SQL InjectionWPcalc – create any online calculators
- CVE-2021-25052Button Generator < 2.3.3 - RFI leading to RCE via CSRFButton Generator – easily Button Builder
- CVE-2021-25053WP Coder < 2.5.2 - RFI leading to RCE via CSRFWP Coder – add custom html, css and js code
- CVE-2021-25051Modal Window < 5.2.2 - RFI leading to RCE via CSRFModal Window – create popup modal window
- CVE-2021-2504710Web Social Photo Feed < 1.4.29 - Reflected Cross-Site Scripting (XSS)10Web Social Photo Feed
- CVE-2021-25043WOOCS < 1.3.7.3 - Reflected Cross-Site ScriptingWOOCS – Currency Switcher for WooCommerce. Professional and…
- CVE-2021-24948The Plus Addons for Elementor Pro < 5.0.7 - Sensitive Data DisclosureThe Plus Addons for Elementor - Pro
- CVE-2021-24949The Plus Addons for Elementor Pro < 5.0.7 - Unauthenticated SQL InjectionThe Plus Addons for Elementor - Pro
- CVE-2021-24862RegistrationMagic < 5.0.1.6 - Admin+ SQL InjectionRegistrationMagic – Custom Registration Forms, User Registr…
- CVE-2022-22117Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Imagedirectus
- CVE-2022-22116Directus - Stored Cross-Site Scripting (XSS) via SVG File Uploaddirectus
- CVE-2022-0156Use After Free in vim/vimvim/vim
- CVE-2021-43949Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2021-43951Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import conAtlassian Jira Service Management Server · Atlassian Jira S…
- CVE-2021-43297Dubbo Hessian cause RCE when parse errorApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2022-0157Cross-site Scripting (XSS) - Stored in phoronix-test-suite/phoronix-test-suitephoronix-test-suite/phoronix-test-suite
- CVE-2022-0158Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-22120NocoDB - Observable Discrepancy in the password-reset featurenocodb
- CVE-2021-23154Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration providedMirantis Lens
- CVE-2021-23218Memory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of ServiceMirantis Container Runtime
- CVE-2021-44586An issue was discovered in dst-admin v1.3.0.
- CVE-2021-45003Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.
- CVE-2022-22847Formpipe Lasernet before 9.13.3 allows file inclusion in Client Web Services (either by an authenticated attacker, or in a configuration tha
- CVE-2021-34086In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web
- CVE-2021-34087In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web
- CVE-2021-25032PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog CompromisePublishPress Capabilities – User Role Access, Editor Permis…
- CVE-2021-35452An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.
- CVE-2021-36408An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.
- CVE-2021-36409There is an Assertion `scaling_list_pred_matrix_id_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attack
- CVE-2021-36410A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put_epel_hv_fallback when running program dec265.
- CVE-2021-36411An issue has been found in libde265 v1.0.8 due to incorrect access control.
- CVE-2021-36412A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows atta
- CVE-2021-36414A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service o