# CVEs published 2022-01-10

47 CVEs were published on January 10, 2022: 2 critical, 7 high. Days are UTC.

- [CVE-2020-25427](https://cve.now/CVE-2020-25427.md): A Null pointer dereference vulnerability exits in MP4Box - GPAC version 0.8.0-rev177-g51a8ef874-master via the gf\_isom\_get\_track\_id function (no CVSS)
- [CVE-2022-21672](https://cve.now/CVE-2022-21672.md): /etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca (CVSS 6.5, lfs-book make-ca)
- [CVE-2022-21670](https://cve.now/CVE-2022-21670.md): Uncontrolled Resource Consumption in markdown-it (CVSS 5.3, markdown-it)
- [CVE-2022-21668](https://cve.now/CVE-2022-21668.md): Pipenv's requirements.txt parsing allows malicious index url in comments (CVSS 8.0, pypa pipenv · pipenv)
- [CVE-2022-21666](https://cve.now/CVE-2022-21666.md): SQL Injection in useredit.php (CVSS 7.2, Aaron-Junker USOC)
- [CVE-2022-0155](https://cve.now/CVE-2022-0155.md): Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects (CVSS 8.0, follow-redirects/follow-redirects · follow-redirects)
- [CVE-2020-28679](https://cve.now/CVE-2020-28679.md): A vulnerability in the showReports module of Zoho ManageEngine Applications Manager before build 14550 allows authenticated attackers to exe (no CVSS)
- [CVE-2022-0174](https://cve.now/CVE-2022-0174.md): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (CVSS 4.3, dolibarr/dolibarr)
- [CVE-2021-25054](https://cve.now/CVE-2021-25054.md): WPcalc \<= 2.1 - Authenticated SQL Injection (no CVSS, WPcalc – create any online calculators)
- [CVE-2021-25052](https://cve.now/CVE-2021-25052.md): Button Generator \< 2.3.3 - RFI leading to RCE via CSRF (no CVSS, Button Generator – easily Button Builder)
- [CVE-2021-25053](https://cve.now/CVE-2021-25053.md): WP Coder \< 2.5.2 - RFI leading to RCE via CSRF (no CVSS, WP Coder – add custom html, css and js code)
- [CVE-2021-25051](https://cve.now/CVE-2021-25051.md): Modal Window \< 5.2.2 - RFI leading to RCE via CSRF (no CVSS, Modal Window – create popup modal window)
- [CVE-2021-25047](https://cve.now/CVE-2021-25047.md): 10Web Social Photo Feed \< 1.4.29 - Reflected Cross-Site Scripting (XSS) (no CVSS, 10Web Social Photo Feed)
- [CVE-2021-25043](https://cve.now/CVE-2021-25043.md): WOOCS \< 1.3.7.3 - Reflected Cross-Site Scripting (no CVSS, WOOCS – Currency Switcher for WooCommerce. Professional and…)
- [CVE-2021-24948](https://cve.now/CVE-2021-24948.md): The Plus Addons for Elementor Pro \< 5.0.7 - Sensitive Data Disclosure (no CVSS, The Plus Addons for Elementor - Pro)
- [CVE-2021-24949](https://cve.now/CVE-2021-24949.md): The Plus Addons for Elementor Pro \< 5.0.7 - Unauthenticated SQL Injection (no CVSS, The Plus Addons for Elementor - Pro)
- [CVE-2021-24862](https://cve.now/CVE-2021-24862.md): RegistrationMagic \< 5.0.1.6 - Admin+ SQL Injection (no CVSS, RegistrationMagic – Custom Registration Forms, User Registr…)
- [CVE-2022-22115](https://cve.now/CVE-2022-22115.md): Teedy - Stored Cross-Site Scripting (XSS) in Tag Name (CVSS 9.0, sismics docs)
- [CVE-2022-22114](https://cve.now/CVE-2022-22114.md): Teedy - Reflected Cross-Site Scripting (XSS) in the Search Functionality (CVSS 9.6, sismics docs)
- [CVE-2022-22117](https://cve.now/CVE-2022-22117.md): Directus - Stored Cross-Site Scripting (XSS) in Profile Avatar Image (CVSS 5.4, directus)
- [CVE-2022-22116](https://cve.now/CVE-2022-22116.md): Directus - Stored Cross-Site Scripting (XSS) via SVG File Upload (CVSS 5.4, directus)
- [CVE-2022-0156](https://cve.now/CVE-2022-0156.md): Use After Free in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2021-43949](https://cve.now/CVE-2021-43949.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects v (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2021-43951](https://cve.now/CVE-2021-43951.md): Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view object import con (no CVSS, Atlassian Jira Service Management Server · Atlassian Jira S…)
- [CVE-2021-43297](https://cve.now/CVE-2021-43297.md): Dubbo Hessian cause RCE when parse error (no CVSS, Apache Software Foundation Apache Dubbo · org.apache.dubbo:…)
- [CVE-2022-0157](https://cve.now/CVE-2022-0157.md): Cross-site Scripting (XSS) - Stored in phoronix-test-suite/phoronix-test-suite (CVSS 5.2, phoronix-test-suite/phoronix-test-suite)
- [CVE-2022-0158](https://cve.now/CVE-2022-0158.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2022-22121](https://cve.now/CVE-2022-22121.md): NocoDB - CSV Injection in User Management (CVSS 8.0, nocodb)
- [CVE-2022-22120](https://cve.now/CVE-2022-22120.md): NocoDB - Observable Discrepancy in the password-reset feature (CVSS 5.3, nocodb)
- [CVE-2021-23154](https://cve.now/CVE-2021-23154.md): Command injection in Lens causes arbitrary shell command execution when malicious custom helm chart configuration provided (CVSS 6.3, Mirantis Lens)
- [CVE-2021-23218](https://cve.now/CVE-2021-23218.md): Memory Leak in Mirantis Container Runtime (MCR) running in FIPS mode causes a Denial of Service (CVSS 5.3, Mirantis Container Runtime)
- [CVE-2021-44458](https://cve.now/CVE-2021-44458.md): Lack of websocket authentication in Lens causes remote code execution when visiting a malicious website (CVSS 8.3, Mirantis Lens)
- [CVE-2021-44586](https://cve.now/CVE-2021-44586.md): An issue was discovered in dst-admin v1.3.0. (no CVSS)
- [CVE-2021-45003](https://cve.now/CVE-2021-45003.md): Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile. (no CVSS)
- [CVE-2022-22847](https://cve.now/CVE-2022-22847.md): Formpipe Lasernet before 9.13.3 allows file inclusion in Client Web Services (either by an authenticated attacker, or in a configuration tha (no CVSS)
- [CVE-2021-34086](https://cve.now/CVE-2021-34086.md): In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web (no CVSS)
- [CVE-2021-34087](https://cve.now/CVE-2021-34087.md): In Ultimaker S3 3D printer, Ultimaker S5 3D printer, Ultimaker 3 3D printer S-line through 6.3 and Ultimaker 3 through 5.2.16, the local web (no CVSS)
- [CVE-2021-21408](https://cve.now/CVE-2021-21408.md): Access to restricted PHP code by dynamic static class access in smarty (CVSS 8.8, smarty-php smarty · smarty/smarty)
- [CVE-2021-25032](https://cve.now/CVE-2021-25032.md): PublishPress Capabilities \< 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise (no CVSS, PublishPress Capabilities – User Role Access, Editor Permis…)
- [CVE-2021-29454](https://cve.now/CVE-2021-29454.md): Sandbox Escape by math function in smarty (CVSS 8.1, smarty-php smarty · smarty/smarty)
- [CVE-2021-35452](https://cve.now/CVE-2021-35452.md): An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc. (no CVSS)
- [CVE-2021-36408](https://cve.now/CVE-2021-36408.md): An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265. (no CVSS)
- [CVE-2021-36409](https://cve.now/CVE-2021-36409.md): There is an Assertion \`scaling\_list\_pred\_matrix\_id\_delta==1' failed at sps.cc:925 in libde265 v1.0.8 when decoding file, which allows attack (no CVSS)
- [CVE-2021-36410](https://cve.now/CVE-2021-36410.md): A stack-buffer-overflow exists in libde265 v1.0.8 via fallback-motion.cc in function put\_epel\_hv\_fallback when running program dec265. (no CVSS)
- [CVE-2021-36411](https://cve.now/CVE-2021-36411.md): An issue has been found in libde265 v1.0.8 due to incorrect access control. (no CVSS)
- [CVE-2021-36412](https://cve.now/CVE-2021-36412.md): A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp\_rtp\_builder\_do\_mpeg12\_video function, which allows atta (no CVSS)
- [CVE-2021-36414](https://cve.now/CVE-2021-36414.md): A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service o (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.