CVEs published January 14, 2022
147 CVEs were published on January 14, 2022: 9 critical, 31 high. 1 is now in CISA KEV.
- Published
- 147
- Critical
- 9
- High
- 31
- Medium
- 33
- Low
- 12
- Unrated
- 62
- Now in CISA KEV
- 1
- Fix available
- 25
Most affected products
- Android
- 27
- Adobe Acrobat Reader
- 26
- Cisco Security Manager
- 13
- QNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- 5
- Adobe Bridge
- 3
- Adobe Illustrator
- 2
- ArcSight Enterprise Security Manager
- 2
- Arista Networks EOS
- 2
- Le-yan Co. Dental Management System
- 2
- livehelperchat/livehelperchat · remdex/livehelperchat
- 2
Critical 9
- CVE-2021-28500An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.Arista Networks Arista EOS
- CVE-2021-28506An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.Arista Networks EOS
- CVE-2021-28501An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.Arista Networks Terminattr
- CVE-2022-23227NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users
- CVE-2022-20658Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation VulnerabilityCisco Unified Contact Center Domain Manager
- CVE-2022-22056Le-yan Co., Ltd. dental management system - Hard-coded CredentialsLe-yan Co. Dental Management System
- CVE-2022-22055Le-yan Co., Ltd. dental management system - SQL InjectionLe-yan Co. Dental Management System
- CVE-2022-23218The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argu
- CVE-2022-23219The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname arg
High 31
- CVE-2021-23567Denial of Service (DoS)colors
- CVE-2022-21137Omron CX-OneOmron CX-One
- CVE-2021-23138WECON LeviStudioUWECON LeviStudioU
- CVE-2021-23157WECON LeviStudioUWECON LeviStudioU
- CVE-2021-44710Adobe Acrobat Reader Use-after-free could lead to Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-44705Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-44703Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-44704Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-44708Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-45064Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-45061Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44706Adobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-45060Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44707Adobe Acrobat Reader DC OTF Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44711Adobe Acrobat Reader DC annotation gestures integer overflow vulnerabilityAdobe Acrobat Reader
- CVE-2021-44701Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44709Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code executionAdobe Acrobat Reader
- CVE-2021-45068Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-45062Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44743Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Bridge
- CVE-2022-0224SQL Injection in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2021-32649Authenticated file write leads to remote code execution in october/systemoctobercms october · october/system
- CVE-2021-32650Arbitrary code execution in october/systemoctobercms october · october/system
- CVE-2022-20698Clam AntiVirus (ClamAV) Denial of Service VulnerabilityCisco ClamAV
- CVE-2021-38692Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardQNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- CVE-2021-38691Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardQNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- CVE-2021-38690Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardQNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- CVE-2021-38689Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardQNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- CVE-2021-38682Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR GuardQNAP Systems QVR Elite · QNAP Systems QVR Pro +1
- CVE-2022-21680Cubic catastrophic backtracking (ReDoS) in markedmarkedjs marked · marked
- CVE-2022-21681Exponential catastrophic backtracking (ReDoS) in markedmarkedjs marked · marked
Medium, low and unrated 107
- CVE-2021-23566Information Exposurenanoid
- CVE-2021-46171Modex v2.11 was discovered to contain a NULL pointer dereference in set_create_id() at xtract.c.
- CVE-2021-46170An issue was discovered in JerryScript commit a6ab5e9.
- CVE-2021-46169Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache.
- CVE-2021-46168Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c.
- CVE-2021-46021An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or applicat
- CVE-2021-46020An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
- CVE-2021-44828Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privilege
- CVE-2021-45406In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a
- CVE-2021-46195GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c.
- CVE-2021-44530An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a UniFi Network application
- CVE-2021-3965Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews.HP DesignJet Printer
- CVE-2021-36920WordPress plugin Download Monitor <= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilityWPChill Download Monitor
- CVE-2022-22290Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted HSamsung Mobile Samsung Internet
- CVE-2022-0130Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthentiTenable.sc
- CVE-2021-38127Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x.ArcSight Enterprise Security Manager
- CVE-2021-38126Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x.ArcSight Enterprise Security Manager
- CVE-2021-42067In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker SAP SE SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2022-22529SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized aSAP SE SAP Enterprise Threat Detection
- CVE-2022-22531The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloadSAP SE SAP S/4HANA
- CVE-2021-44234SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attackerSAP SE SAP Business One
- CVE-2022-22530The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or downloadSAP SE SAP S/4HANA
- CVE-2021-1037The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to lisAndroid
- CVE-2021-1036In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack.Android
- CVE-2021-1035In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due Android
- CVE-2021-39684In target_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code.Android
- CVE-2021-39683In copy_from_mbox of sss_ice_util.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2021-45773A NULL pointer dereference in CS104_IPAddress_setFromString at src/iec60870/cs104/cs104_slave.c of lib60870 commit 0d5e76e can lead to a seg
- CVE-2021-39682In mgm_alloc_page of memory_group_manager.c, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-39681In delete_protocol of main.c, there is a possible arbitrary code execution due to a use after free.Android
- CVE-2021-39680In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data.Android
- CVE-2021-39679In init of vendor_graphicbuffer_meta.cpp, there is a possible use after free due to a race condition.Android
- CVE-2021-39678In <TBD> of <TBD>, there is a possible bypass of Factory Reset Protection due to <TBD>.Android
- CVE-2021-39659In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to Android
- CVE-2021-39634In fs/eventpoll.c, there is a possible use after free.Android
- CVE-2021-39633In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access.Android
- CVE-2021-39632In inotify_cb of events.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-39630In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions Android
- CVE-2021-39629In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition.Android
- CVE-2021-39628In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code.Android
- CVE-2021-39627In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent.Android
- CVE-2021-39626In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy.Android
- CVE-2021-39625In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider conteAndroid
- CVE-2021-39623In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2021-39622In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check.Android
- CVE-2021-39621In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent.Android
- CVE-2021-39620In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2021-39618In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an unAndroid
- CVE-2021-1049Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722Android
- CVE-2021-0959In jit_memory_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code.Android
- CVE-2021-36199VideoEdgeJohnson Controls VideoEdge
- CVE-2021-45769A NULL pointer dereference in AcseConnection_parseMessage at src/mms/iso_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault
- CVE-2021-44714Adobe Acrobat Reader Missing Custom Protocols in Warning Message PromptsAdobe Acrobat Reader
- CVE-2021-45067Adobe Acrobat Reader Memory Corruption could lead to Information DisclosureAdobe Acrobat Reader
- CVE-2021-44712Adobe Acrobat Reader Memory Corruption could lead to Application denial-of-serviceAdobe Acrobat Reader
- CVE-2021-44713Adobe Acrobat Reader DC Use After Free could lead to Application denial-of-serviceAdobe Acrobat Reader
- CVE-2021-44742Adobe Reader Out-of-bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2021-44739Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Auth leak vulnerabilityAdobe Acrobat Reader
- CVE-2021-44715Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2021-44702Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) for Internet Explorer LoadFile NTLMv2 SSO Auth leak vulnerabilityAdobe Acrobat Reader
- CVE-2021-45063Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2021-44741Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceAdobe Acrobat Reader
- CVE-2021-44740Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-serviceAdobe Acrobat Reader
- CVE-2021-43752Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Illustrator
- CVE-2021-44700Adobe Illustrator JPEG File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Illustrator
- CVE-2021-45051Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-45052Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2021-28507An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.Arista Networks EOS
- CVE-2021-20613Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior, FX3U-ENET-L Firmware version 1.16 and prMELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…
- CVE-2021-20612Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L FirmwareMELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…
- CVE-2022-0226Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-45761ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function.
- CVE-2021-24046A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the FaceboMeta Platforms Ray-Ban® Stories Smart Glasses
- CVE-2021-45468Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WA
- CVE-2021-39032IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local usIBM Sterling Gentran:Server for Microsoft Windows
- CVE-2022-21685Integer underflow in Frontierparitytech frontier · pallet-evm-precompile-modexp
- CVE-2022-21677Group advanced search option may leak group and group's members visibility discourse
- CVE-2022-0231Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchatlivehelperchat/livehelperchat · remdex/livehelperchat
- CVE-2021-33962China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_devi
- CVE-2021-36781parsec: dangerous 777 permissions for /run/parsecopenSUSE Factory
- CVE-2021-42551Reflected XSS in NetBiblio WebOPAC search functionalityAlCoda NetBiblio WebOPAC
- CVE-2022-20639Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20638Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20637Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20636Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20635Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20660Cisco IP Phones Information Disclosure VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2022-20647Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20646Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20645Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20644Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20643Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20642Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20641Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-20640Cisco Security Manager Cross-Site Scripting VulnerabilitiesCisco Security Manager
- CVE-2022-22054ASUS RT-AX56U - Path TraversalASUS RT-AX56U
- CVE-2021-46255eyouCMS V1.5.5-UTF8-SP3_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename.
- CVE-2021-38678Open Redirect Vulnerability in QcalAgentQNAP Systems QcalAgent
- CVE-2021-38677Reflected XSS Vulnerability in QcalAgentQNAP Systems QcalAgent
- CVE-2021-45762GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf_sg_vrml_mf_reset().
- CVE-2021-45763GPAC v1.1.0 was discovered to contain an invalid call in the function gf_node_changed().
- CVE-2021-45764GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift_chunk_offsets.isra().
- CVE-2021-45767GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr_read_id().
- CVE-2021-46019An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application cra
- CVE-2021-46022An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or applica
- CVE-2022-0213Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2022-23222kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arith