CVEs published January 11, 2022
135 CVEs were published on January 11, 2022: 9 critical, 74 high. 2 are now in CISA KEV.
- Published
- 135
- Critical
- 9
- High
- 74
- Medium
- 33
- Low
- 1
- Unrated
- 18
- Now in CISA KEV
- 2
- Fix available
- 107
Most affected products
- Microsoft Windows
- 79
- Microsoft Edge
- 5
- Siemens COMOS
- 4
- Apache Software Foundation Apache Guacamole
- 2
- Cisco Adaptive Security Appliance Software · Cisco Firepowe…
- 2
- Microsoft Exchange Server 2013 Cumulative Update · Micro… +1
- 2
- Microsoft Windows · Microsoft Remote Desktop client for Win…
- 2
- Microsoft Windows Server
- 2
- Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C · Sieme… +2
- 2
- TIBCO Software TIBCO eFTL - Community Edition · TIBCO So… +1
- 2
Critical 9
- CVE-2022-21969Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-21907HTTP Protocol Stack Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21901Windows Hyper-V Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2022-21849Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21846Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2021-43052TIBCO FTL Secret Generation VulnerabilityTIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- CVE-2022-0173Out-of-bounds Read in radareorg/radare2radareorg/radare2
- CVE-2022-21669Bot token exposed in main.pyPuddingBot pudding-bot
High 74
- CVE-2022-0087Cross-site Scripting (XSS) - Reflected in keystonejs/keystonekeystonejs/keystone · @keystone-6/auth +1
- CVE-2022-21646Lookup operations do not take into account wildcards in SpiceDBauthzed spicedb · github.com/authzed/spicedb
- CVE-2022-21932Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting VulnerabilityMicrosoft Dynamics 365 Customer Engagement
- CVE-2022-21922Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21920Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21919Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21917HEVC Video Extensions Remote Code Execution VulnerabilityMicrosoft HEVC Video Extensions
- CVE-2022-21916Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21914Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21912DirectX Graphics Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21911.NET Framework Denial of Service VulnerabilityMicrosoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +1
- CVE-2022-21910Microsoft Cluster Port Driver Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2022-21908Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21904Windows GDI Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21903Windows GDI Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21902Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21898DirectX Graphics Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21897Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21896Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21895Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21893Remote Desktop Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21891Microsoft Dynamics 365 (on-premises) Spoofing VulnerabilityMicrosoft Dynamics 365 Sales
- CVE-2022-21889Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21890Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21888Windows Modern Execution Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21887Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21884Local Security Authority Subsystem Service Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2022-21885Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21883Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21882Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21881Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21880Windows GDI+ Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21878Windows Geolocation Service Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21875Windows Storage Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21873Tile Data Repository Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21874Windows Security Center API Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21872Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21871Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Visual Studio
- CVE-2022-21869Clipboard User Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21870Tablet Windows User Interface Application Core Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21868Windows Devices Human Interface Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21867Windows Push Notifications Apps Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21866Windows System Launcher Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21865Connected Devices Platform Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21863Windows StateRepository API Server file Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21864Windows UI Immersive Server API Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21862Windows Application Model Core API Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21861Task Flow Data Engine Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21860Windows AppContracts API Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21859Windows Accounts Control Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21857Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21858Windows Bind Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21852Windows DWM Core Library Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21851Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop client for Win…
- CVE-2022-21850Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop client for Win…
- CVE-2022-21848Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21842Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Word
- CVE-2022-21843Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21841Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2022-21840Microsoft Office Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +4
- CVE-2022-21837Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2022-21836Windows Certificate Spoofing VulnerabilityMicrosoft Windows
- CVE-2022-21835Microsoft Cryptographic Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21834Windows User-mode Driver Framework Reflector Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21833Virtual Machine IDE Drive Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1573Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityCisco Adaptive Security Appliance Software · Cisco Firepowe…
- CVE-2021-34704Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service VulnerabilityCisco Adaptive Security Appliance Software · Cisco Firepowe…
- CVE-2021-43054TIBCO eFTL Token Generation VulnerabilityTIBCO Software TIBCO eFTL - Community Edition · TIBCO So… +1
- CVE-2021-43053TIBCO FTL Secret Exposure VulnerabilityTIBCO Software TIBCO FTL - Community Edition · TIBCO Sof… +1
- CVE-2022-0129DLL Highjack vulnerability in McAfee TechCheck utilityMcAfee TechCheck
- CVE-2021-38991IBM AIX 7.0, 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the lscore command which could leaIBM AIX · IBM VIOS
- CVE-2022-21671Potential exposure of Replit tokens to an Unauthorized Actor in @replit/crosisreplit crosis · @replit/crosis
- CVE-2021-37198A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlSiemens COMOS
- CVE-2022-0144Improper Privilege Management in shelljs/shelljsshelljs/shelljs · shelljs
Medium, low and unrated 52
- CVE-2021-43999Improper validation of SAML responsesApache Software Foundation Apache Guacamole
- CVE-2021-41767Private tunnel identifier may be included in the non-private details of active connectionsApache Software Foundation Apache Guacamole
- CVE-2021-46283nf_tables_newset in net/netfilter/nf_tables_api.c in the Linux kernel before 5.12.13 allows local users to cause a denial of service (NULL p
- CVE-2022-21970Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-21964Remote Desktop Licensing Diagnoser Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21963Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21961Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21962Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21960Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21959Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21958Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21954Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-21931Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2022-21930Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2022-21929Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2022-21928Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21924Workstation Service Remote Protocol Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21925Windows BackupKey Remote Protocol Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21921Windows Defender Credential Guard Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21918DirectX Graphics Kernel File Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21915Windows GDI+ Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21913Local Security Authority (Domain Policy) Remote Protocol Security Feature BypassMicrosoft Windows
- CVE-2022-21906Windows Defender Application Control Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21905Windows Hyper-V Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21900Windows Hyper-V Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21899Windows Extensible Firmware Interface Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21894Secure Boot Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-21892Windows Resilient File System (ReFS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-21879Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21877Storage Spaces Controller Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21876Win32k Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2022-21847Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2022-21838Windows Cleanup Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21839Windows Event Tracing Discretionary Access Control List Denial of Service VulnerabilityMicrosoft Windows
- CVE-2021-43974An issue was discovered in SysAid ITIL 20.4.74 b10.
- CVE-2021-43973An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload a
- CVE-2021-43972An unrestricted file copy vulnerability in /UserSelfServiceSettings.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to
- CVE-2021-43971A SQL injection vulnerability in /mobile/SelectUsers.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to execute arbitr
- CVE-2021-43055TIBCO eFTL Token Caching VulnerabilityTIBCO Software TIBCO eFTL - Community Edition · TIBCO So… +1
- CVE-2021-29701IBM Engineering Workflow Management 7.0, 7.0.1, and 7.0.2 as well as IBM Rational Team Concert 6.0.6 and 6.0.6.1 could allow an authneticateIBM Engineering Workflow Management · IBM Rational Team Con…
- CVE-2020-28103cscms v4.1 allows for SQL injection via the "page_del" function.
- CVE-2020-28102cscms v4.1 allows for SQL injection via the "js_del" function.
- CVE-2022-0170Improper Access Control in chocobozzz/peertubechocobozzz/peertube
- CVE-2021-43566All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in
- CVE-2021-45460A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18).Siemens SICAM PQ Analyzer
- CVE-2021-45033A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C · Sieme… +2
- CVE-2021-45034A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C · Sieme… +2
- CVE-2021-41769A vulnerability has been identified in SIPROTEC 5 6MD85 devices (CPU variant CP300) (All versions < V8.83), SIPROTEC 5 6MD86 devices (CPU vaSiemens SIPROTEC 5 6MD85 devices · Siemens SIPROTEC 5 6… +29
- CVE-2021-37197A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlSiemens COMOS
- CVE-2021-37195A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlSiemens COMOS
- CVE-2021-37196A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All versions < V10.3.3.3 onlSiemens COMOS
- CVE-2021-44647Lua v5.4.3 and above are affected by SEGV by type confusion in funcnamefromcode function in ldebug.c which can cause a local denial of servi