# CVEs published 2022-01-12

64 CVEs were published on January 12, 2022: 1 critical, 5 high. Days are UTC.

- [CVE-2021-37530](https://cve.now/CVE-2021-37530.md): A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open\_stream function in readpics.c. (no CVSS)
- [CVE-2021-37529](https://cve.now/CVE-2021-37529.md): A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free\_stream function in readpics.c, which could cause a (no CVSS)
- [CVE-2021-46225](https://cve.now/CVE-2021-46225.md): A buffer overflow in the GmfOpenMesh() function of libMeshb v7.61 allows attackers to cause a Denial of Service (DoS) via a crafted MESH fil (no CVSS)
- [CVE-2021-45449](https://cve.now/CVE-2021-45449.md): Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during (no CVSS)
- [CVE-2021-41597](https://cve.now/CVE-2021-41597.md): SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is (no CVSS)
- [CVE-2021-42559](https://cve.now/CVE-2021-42559.md): An issue was discovered in CALDERA 2.8.1. (no CVSS)
- [CVE-2021-42558](https://cve.now/CVE-2021-42558.md): An issue was discovered in CALDERA 2.8.1. (no CVSS)
- [CVE-2022-23118](https://cve.now/CVE-2022-23118.md): Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line \`git\` at an atta (no CVSS, Jenkins project Jenkins Debian Package Builder Plugin · ru.…)
- [CVE-2022-23117](https://cve.now/CVE-2022-23117.md): Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve a (no CVSS, Jenkins project Jenkins Conjur Secrets Plugin · org.conjur.…)
- [CVE-2022-23116](https://cve.now/CVE-2022-23116.md): Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt se (no CVSS, Jenkins project Jenkins Conjur Secrets Plugin · org.conjur.…)
- [CVE-2022-23115](https://cve.now/CVE-2022-23115.md): Cross-site request forgery (CSRF) vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to (no CVSS, Jenkins project Jenkins batch task Plugin · org.jenkins-ci.…)
- [CVE-2022-23114](https://cve.now/CVE-2022-23114.md): Jenkins Publish Over SSH Plugin 1.22 and earlier stores password unencrypted in its global configuration file on the Jenkins controller wher (no CVSS, Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…)
- [CVE-2022-23113](https://cve.now/CVE-2022-23113.md): Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting i (no CVSS, Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…)
- [CVE-2022-23112](https://cve.now/CVE-2022-23112.md): A missing permission check in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers with Overall/Read access to connect to an at (no CVSS, Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…)
- [CVE-2022-23111](https://cve.now/CVE-2022-23111.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an atta (no CVSS, Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…)
- [CVE-2022-23110](https://cve.now/CVE-2022-23110.md): Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulne (no CVSS, Jenkins project Jenkins Publish Over SSH Plugin · org.jenki…)
- [CVE-2022-23109](https://cve.now/CVE-2022-23109.md): Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions whe (no CVSS, Jenkins project Jenkins HashiCorp Vault Plugin · com.datapi…)
- [CVE-2022-23108](https://cve.now/CVE-2022-23108.md): Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulti (no CVSS, Jenkins project Jenkins Badge Plugin · org.jenkins-ci.plugi…)
- [CVE-2022-23107](https://cve.now/CVE-2022-23107.md): Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attacke (no CVSS, Jenkins project Jenkins Warnings Next Generation Plugin · i…)
- [CVE-2022-23105](https://cve.now/CVE-2022-23105.md): Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directo (no CVSS, Jenkins project Jenkins Active Directory Plugin · org.jenki…)
- [CVE-2022-20621](https://cve.now/CVE-2022-20621.md): Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where (no CVSS, Jenkins project Jenkins Metrics Plugin · org.jenkins-ci.plu…)
- [CVE-2022-20620](https://cve.now/CVE-2022-20620.md): Missing permission checks in Jenkins SSH Agent Plugin 1.23 and earlier allows attackers with Overall/Read access to enumerate credentials ID (no CVSS, Jenkins project Jenkins SSH Agent Plugin · org.jenkins-ci.p…)
- [CVE-2022-20619](https://cve.now/CVE-2022-20619.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers t (no CVSS, Jenkins project Jenkins Bitbucket Branch Source Plugin · or…)
- [CVE-2022-20618](https://cve.now/CVE-2022-20618.md): A missing permission check in Jenkins Bitbucket Branch Source Plugin 737.vdf9dc06105be and earlier allows attackers with Overall/Read access (no CVSS, Jenkins project Jenkins Bitbucket Branch Source Plugin · or…)
- [CVE-2022-20617](https://cve.now/CVE-2022-20617.md): Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnera (no CVSS, Jenkins project Jenkins Docker Commons Plugin · org.jenkins…)
- [CVE-2022-20616](https://cve.now/CVE-2022-20616.md): Jenkins Credentials Binding Plugin 1.27 and earlier does not perform a permission check in a method implementing form validation, allowing a (no CVSS, Jenkins project Jenkins Credentials Binding Plugin · org.je…)
- [CVE-2022-20615](https://cve.now/CVE-2022-20615.md): Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resultin (no CVSS, Jenkins project Jenkins Matrix Project Plugin · org.jenkins…)
- [CVE-2022-20612](https://cve.now/CVE-2022-20612.md): A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of (no CVSS, Jenkins project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2021-42560](https://cve.now/CVE-2021-42560.md): An issue was discovered in CALDERA 2.9.0. (no CVSS)
- [CVE-2021-42561](https://cve.now/CVE-2021-42561.md): An issue was discovered in CALDERA 2.8.1. (no CVSS)
- [CVE-2021-42562](https://cve.now/CVE-2021-42562.md): An issue was discovered in CALDERA 2.8.1. (no CVSS)
- [CVE-2021-35500](https://cve.now/CVE-2021-35500.md): TIBCO Data Virtualization Arbitrary File Download vulnerability (CVSS 6.3, TIBCO Software TIBCO Data Virtualization)
- [CVE-2022-21676](https://cve.now/CVE-2022-21676.md): Uncaught Exception in engine.io (CVSS 7.5, socketio engine.io · engine.io)
- [CVE-2022-21675](https://cve.now/CVE-2022-21675.md): Bytecode Viewer v2.10.x Zip Slip (CVSS 9.9, Konloch bytecode-viewer)
- [CVE-2021-43960](https://cve.now/CVE-2021-43960.md): Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. (no CVSS)
- [CVE-2021-28376](https://cve.now/CVE-2021-28376.md): ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files. (no CVSS)
- [CVE-2021-28377](https://cve.now/CVE-2021-28377.md): ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files. (no CVSS)
- [CVE-2021-45445](https://cve.now/CVE-2021-45445.md): Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop. (no CVSS)
- [CVE-2022-0015](https://cve.now/CVE-2022-0015.md): Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability (CVSS 7.8, Palo Alto Networks Cortex XDR Agent)
- [CVE-2022-0014](https://cve.now/CVE-2022-0014.md): Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session (CVSS 6.7, Palo Alto Networks Cortex XDR Agent)
- [CVE-2022-0013](https://cve.now/CVE-2022-0013.md): Cortex XDR Agent: File Information Exposure Vulnerability When Generating Support File (CVSS 5.0, Palo Alto Networks Cortex XDR Agent)
- [CVE-2022-0012](https://cve.now/CVE-2022-0012.md): Cortex XDR Agent: Local Arbitrary File Deletion Vulnerability (CVSS 6.1, Palo Alto Networks Cortex XDR Agent)
- [CVE-2021-43436](https://cve.now/CVE-2021-43436.md): MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. (no CVSS)
- [CVE-2021-45411](https://cve.now/CVE-2021-45411.md): In Sourcecodetester Printable Staff ID Card Creator System 1.0 after compromising the database via SQLi, an attacker can log in and leverage (no CVSS)
- [CVE-2021-44652](https://cve.now/CVE-2021-44652.md): Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component. (no CVSS)
- [CVE-2021-44651](https://cve.now/CVE-2021-44651.md): Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an (no CVSS)
- [CVE-2021-4080](https://cve.now/CVE-2021-4080.md): Unrestricted Upload of File with Dangerous Type in crater-invoice/crater (CVSS 8.8, crater-invoice/crater · bytefury/crater)
- [CVE-2021-44650](https://cve.now/CVE-2021-44650.md): Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySe (no CVSS)
- [CVE-2021-44649](https://cve.now/CVE-2021-44649.md): Django CMS 3.7.3 does not validate the plugin\_type parameter while generating error messages for an invalid plugin type, resulting in a Cros (no CVSS, django-cms)
- [CVE-2021-44648](https://cve.now/CVE-2021-44648.md): GNOME gdk-pixbuf 2.42.6 is vulnerable to a heap-buffer overflow vulnerability when decoding the lzw compressed stream of image data in GIF f (no CVSS)
- [CVE-2021-3852](https://cve.now/CVE-2021-3852.md): Authorization Bypass Through User-Controlled Key in weseek/growi (CVSS 6.3, weseek/growi)
- [CVE-2022-0159](https://cve.now/CVE-2022-0159.md): Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore (CVSS 7.4, orchardcms/orchardcore · OrchardCore)
- [CVE-2021-36417](https://cve.now/CVE-2021-36417.md): A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf\_isom\_dovi\_config\_get function in MP4Box, which causes a denial of (no CVSS)
- [CVE-2021-40559](https://cve.now/CVE-2021-40559.md): A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmx\_parse\_nal\_avc function in reframe\_nalu, which allows a d (no CVSS)
- [CVE-2021-40562](https://cve.now/CVE-2021-40562.md): A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmx\_enqueue\_or\_dispatch func (no CVSS)
- [CVE-2021-40563](https://cve.now/CVE-2021-40563.md): A Segmentation fault exists casued by null pointer dereference exists in Gpac through 1.0.1 via the naludmx\_create\_avc\_decoder\_config functi (no CVSS)
- [CVE-2021-40564](https://cve.now/CVE-2021-40564.md): A Segmentation fault caused by null pointer dereference vulnerability eists in Gpac through 1.0.2 via the avc\_parse\_slice function in av\_par (no CVSS)
- [CVE-2021-40565](https://cve.now/CVE-2021-40565.md): A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gf\_avc\_parse\_nalu function in a (no CVSS)
- [CVE-2021-40566](https://cve.now/CVE-2021-40566.md): A Segmentation fault casued by heap use after free vulnerability exists in Gpac through 1.0.1 via the mpgviddmx\_process function in reframe\_ (no CVSS)
- [CVE-2021-43860](https://cve.now/CVE-2021-43860.md): Permissions granted to applications can be hidden from the user at install time (CVSS 8.2, flatpak)
- [CVE-2022-0179](https://cve.now/CVE-2022-0179.md): Missing Authorization in snipe/snipe-it (CVSS 6.3, snipe/snipe-it)
- [CVE-2022-20613](https://cve.now/CVE-2022-20613.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Mailer Plugin 391.ve4a\_38c1b\_cf4b\_ and earlier allows attackers to use the DNS (no CVSS, Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…)
- [CVE-2022-20614](https://cve.now/CVE-2022-20614.md): A missing permission check in Jenkins Mailer Plugin 391.ve4a\_38c1b\_cf4b\_ and earlier allows attackers with Overall/Read access to use the DN (no CVSS, Jenkins project Jenkins Mailer Plugin · org.jenkins-ci.plug…)
- [CVE-2022-23106](https://cve.now/CVE-2022-23106.md): Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token a (no CVSS, Jenkins project Jenkins Configuration as Code Plugin · io.j…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.