CVEs published January 12, 2022
64 CVEs were published on January 12, 2022: 1 critical, 5 high.
- Published
- 64
- Critical
- 1
- High
- 5
- Medium
- 6
- Low
- 0
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- 5
- Palo Alto Networks Cortex XDR Agent
- 4
- Jenkins project Jenkins Bitbucket Branch Source Plugin · or…
- 2
- Jenkins project Jenkins Conjur Secrets Plugin · org.conjur.…
- 2
- Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…
- 2
- crater-invoice/crater · bytefury/crater
- 1
- django-cms
- 1
- flatpak
- 1
- Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- 1
- Jenkins project Jenkins Active Directory Plugin · org.jenki…
- 1
Critical 1
High 5
- CVE-2022-21676Uncaught Exception in engine.iosocketio engine.io · engine.io
- CVE-2022-0015Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks Cortex XDR Agent
- CVE-2021-4080Unrestricted Upload of File with Dangerous Type in crater-invoice/cratercrater-invoice/crater · bytefury/crater
- CVE-2022-0159Cross-site Scripting (XSS) - Stored in orchardcms/orchardcoreorchardcms/orchardcore · OrchardCore
- CVE-2021-43860Permissions granted to applications can be hidden from the user at install timeflatpak
Medium, low and unrated 58
- CVE-2021-37530A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.
- CVE-2021-37529A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a
- CVE-2021-46225A buffer overflow in the GmfOpenMesh() function of libMeshb v7.61 allows attackers to cause a Denial of Service (DoS) via a crafted MESH fil
- CVE-2021-45449Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during
- CVE-2021-41597SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is
- CVE-2021-42559An issue was discovered in CALDERA 2.8.1.
- CVE-2021-42558An issue was discovered in CALDERA 2.8.1.
- CVE-2022-23118Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attaJenkins project Jenkins Debian Package Builder Plugin · ru.…
- CVE-2022-23117Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve aJenkins project Jenkins Conjur Secrets Plugin · org.conjur.…
- CVE-2022-23116Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt seJenkins project Jenkins Conjur Secrets Plugin · org.conjur.…
- CVE-2022-23115Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access toJenkins project Jenkins batch task Plugin · org.jenkins-ci.…
- CVE-2022-23114Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller wherJenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- CVE-2022-23113Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting iJenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- CVE-2022-23112A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an atJenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- CVE-2022-23111A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attaJenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- CVE-2022-23110Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulneJenkins project Jenkins Publish Over SSH Plugin · org.jenki…
- CVE-2022-23109Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions wheJenkins project Jenkins HashiCorp Vault Plugin · com.datapi…
- CVE-2022-23108Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resultiJenkins project Jenkins Badge Plugin · org.jenkins-ci.plugi…
- CVE-2022-23107Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackeJenkins project Jenkins Warnings Next Generation Plugin · i…
- CVE-2022-23105Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active DirectoJenkins project Jenkins Active Directory Plugin · org.jenki…
- CVE-2022-20621Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller whereJenkins project Jenkins Metrics Plugin · org.jenkins-ci.plu…
- CVE-2022-20620Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials IDJenkins project Jenkins SSH Agent Plugin · org.jenkins-ci.p…
- CVE-2022-20619A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers tJenkins project Jenkins Bitbucket Branch Source Plugin · or…
- CVE-2022-20618A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read accessJenkins project Jenkins Bitbucket Branch Source Plugin · or…
- CVE-2022-20617Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulneraJenkins project Jenkins Docker Commons Plugin · org.jenkins…
- CVE-2022-20616Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing aJenkins project Jenkins Credentials Binding Plugin · org.je…
- CVE-2022-20615Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultinJenkins project Jenkins Matrix Project Plugin · org.jenkins…
- CVE-2022-20612A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build ofJenkins project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2021-42560An issue was discovered in CALDERA 2.9.0.
- CVE-2021-42561An issue was discovered in CALDERA 2.8.1.
- CVE-2021-42562An issue was discovered in CALDERA 2.8.1.
- CVE-2021-35500TIBCO Data Virtualization Arbitrary File Download vulnerabilityTIBCO Software TIBCO Data Virtualization
- CVE-2021-43960Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability.
- CVE-2021-28376ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.
- CVE-2021-28377ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.
- CVE-2021-45445Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.
- CVE-2022-0014Cortex XDR Agent: Unintended Program Execution When Using Live Terminal SessionPalo Alto Networks Cortex XDR Agent
- CVE-2022-0013Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support FilePalo Alto Networks Cortex XDR Agent
- CVE-2022-0012Cortex XDR Agent: Local Arbitrary File Deletion VulnerabilityPalo Alto Networks Cortex XDR Agent
- CVE-2021-43436MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt.
- CVE-2021-45411In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage
- CVE-2021-44652Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component.
- CVE-2021-44651Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an
- CVE-2021-44650Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySe
- CVE-2021-44649Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Crosdjango-cms
- CVE-2021-44648GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF f
- CVE-2021-3852Authorization Bypass Through User-Controlled Key in weseek/growiweseek/growi
- CVE-2021-36417A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of
- CVE-2021-40559A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx_parse_nal_avc function in reframe_nalu, which allows a d
- CVE-2021-40562A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx_enqueue_or_dispatch func
- CVE-2021-40563A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx_create_avc_decoder_config functi
- CVE-2021-40564A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc_parse_slice function in av_par
- CVE-2021-40565A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf_avc_parse_nalu function in a
- CVE-2021-40566A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx_process function in reframe_
- CVE-2022-0179Missing Authorization in snipe/snipe-itsnipe/snipe-it
- CVE-2022-20613A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers to use the DNS Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…
- CVE-2022-20614A missing permission check in Jenkins Mailer Plugin 391.ve4a_38c1b_cf4b_ and earlier allows attackers with Overall/Read access to use the DNJenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…
- CVE-2022-23106Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token aJenkins project Jenkins Configuration as Code Plugin · io.j…