# CVEs published 2022-01-14

147 CVEs were published on January 14, 2022: 9 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2021-23566](https://cve.now/CVE-2021-23566.md): Information Exposure (CVSS 4.0, nanoid)
- [CVE-2021-46171](https://cve.now/CVE-2021-46171.md): Modex v2.11 was discovered to contain a NULL pointer dereference in set\_create\_id() at xtract.c. (no CVSS)
- [CVE-2021-46170](https://cve.now/CVE-2021-46170.md): An issue was discovered in JerryScript commit a6ab5e9. (no CVSS)
- [CVE-2021-23567](https://cve.now/CVE-2021-23567.md): Denial of Service (DoS) (CVSS 7.5, colors)
- [CVE-2021-46169](https://cve.now/CVE-2021-46169.md): Modex v2.11 was discovered to contain an Use-After-Free vulnerability via the component tcache. (no CVSS)
- [CVE-2021-46168](https://cve.now/CVE-2021-46168.md): Spin v6.5.1 was discovered to contain an out-of-bounds write in lex() at spinlex.c. (no CVSS)
- [CVE-2021-46021](https://cve.now/CVE-2021-46021.md): An Use-After-Free vulnerability in rec\_record\_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or applicat (no CVSS)
- [CVE-2021-46020](https://cve.now/CVE-2021-46020.md): An untrusted pointer dereference in mrb\_vm\_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash. (no CVSS)
- [CVE-2021-44828](https://cve.now/CVE-2021-44828.md): Arm Mali GPU Kernel Driver (Midgard r26p0 through r30p0, Bifrost r0p0 through r34p0, and Valhall r19p0 through r34p0) allows a non-privilege (no CVSS)
- [CVE-2021-45406](https://cve.now/CVE-2021-45406.md): In SalonERP 3.0.1, a SQL injection vulnerability allows an attacker to inject payload using 'sql' parameter in SQL query while generating a (no CVSS)
- [CVE-2021-46195](https://cve.now/CVE-2021-46195.md): GCC v12.0 was discovered to contain an uncontrolled recursion via the component libiberty/rust-demangle.c. (no CVSS)
- [CVE-2021-44530](https://cve.now/CVE-2021-44530.md): An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a (no CVSS, UniFi Network application)
- [CVE-2021-3965](https://cve.now/CVE-2021-3965.md): Certain HP DesignJet products may be vulnerable to unauthenticated HTTP requests which allow viewing and downloading of print job previews. (no CVSS, HP DesignJet Printer)
- [CVE-2021-36920](https://cve.now/CVE-2021-36920.md): WordPress plugin Download Monitor \<= 4.4.6 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 4.8, WPChill Download Monitor)
- [CVE-2022-22290](https://cve.now/CVE-2022-22290.md): Incorrect download source UI in Downloads in Samsung Internet prior to 16.0.6.23 allows attackers to perform domain spoofing via a crafted H (CVSS 6.5, Samsung Mobile Samsung Internet)
- [CVE-2021-28500](https://cve.now/CVE-2021-28500.md): An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration. (CVSS 9.1, Arista Networks Arista EOS)
- [CVE-2022-0130](https://cve.now/CVE-2022-0130.md): Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenti (no CVSS, Tenable.sc)
- [CVE-2021-38127](https://cve.now/CVE-2021-38127.md): Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. (no CVSS, ArcSight Enterprise Security Manager)
- [CVE-2021-38126](https://cve.now/CVE-2021-38126.md): Potential vulnerabilities have been identified in Micro Focus ArcSight Enterprise Security Manager, affecting versions 7.4.x and 7.5.x. (no CVSS, ArcSight Enterprise Security Manager)
- [CVE-2021-42067](https://cve.now/CVE-2021-42067.md): In SAP NetWeaver AS for ABAP and ABAP Platform - versions 701, 702, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 786, an attacker (no CVSS, SAP SE SAP NetWeaver AS for ABAP and ABAP Platform)
- [CVE-2022-22529](https://cve.now/CVE-2022-22529.md): SAP Enterprise Threat Detection (ETD) - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized a (no CVSS, SAP SE SAP Enterprise Threat Detection)
- [CVE-2022-22531](https://cve.now/CVE-2022-22531.md): The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or download (no CVSS, SAP SE SAP S/4HANA)
- [CVE-2021-44234](https://cve.now/CVE-2021-44234.md): SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker (no CVSS, SAP SE SAP Business One)
- [CVE-2022-22530](https://cve.now/CVE-2022-22530.md): The F0743 Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, does not check uploaded or download (no CVSS, SAP SE SAP S/4HANA)
- [CVE-2021-1037](https://cve.now/CVE-2021-1037.md): The broadcast that DevicePickerFragment sends when a new device is paired doesn't have any permission checks, so any app can register to lis (no CVSS, Android)
- [CVE-2021-1036](https://cve.now/CVE-2021-1036.md): In LocationSettingsActivity of AndroidManifest.xml, there is a possible EoP due to a tapjacking/overlay attack. (no CVSS, Android)
- [CVE-2021-1035](https://cve.now/CVE-2021-1035.md): In setLaunchIntent of BluetoothDevicePickerPreferenceController.java, there is a possible way to invoke an arbitrary broadcast receiver due (no CVSS, Android)
- [CVE-2021-39684](https://cve.now/CVE-2021-39684.md): In target\_init of gs101/abl/target/slider/target.c, there is a possible allocation of RWX memory due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-39683](https://cve.now/CVE-2021-39683.md): In copy\_from\_mbox of sss\_ice\_util.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2021-45773](https://cve.now/CVE-2021-45773.md): A NULL pointer dereference in CS104\_IPAddress\_setFromString at src/iec60870/cs104/cs104\_slave.c of lib60870 commit 0d5e76e can lead to a seg (no CVSS)
- [CVE-2021-39682](https://cve.now/CVE-2021-39682.md): In mgm\_alloc\_page of memory\_group\_manager.c, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39681](https://cve.now/CVE-2021-39681.md): In delete\_protocol of main.c, there is a possible arbitrary code execution due to a use after free. (no CVSS, Android)
- [CVE-2021-39680](https://cve.now/CVE-2021-39680.md): In sec\_SHA256\_Transform of sha256\_core.c, there is a possible way to read heap data due to uninitialized data. (no CVSS, Android)
- [CVE-2021-39679](https://cve.now/CVE-2021-39679.md): In init of vendor\_graphicbuffer\_meta.cpp, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-39678](https://cve.now/CVE-2021-39678.md): In \<TBD\> of \<TBD\>, there is a possible bypass of Factory Reset Protection due to \<TBD\>. (no CVSS, Android)
- [CVE-2021-39659](https://cve.now/CVE-2021-39659.md): In sortSimPhoneAccountsForEmergency of CreateConnectionProcessor.java, there is a possible prevention of access to emergency calling due to (no CVSS, Android)
- [CVE-2021-39634](https://cve.now/CVE-2021-39634.md): In fs/eventpoll.c, there is a possible use after free. (no CVSS, Android)
- [CVE-2021-39633](https://cve.now/CVE-2021-39633.md): In gre\_handle\_offloads of ip\_gre.c, there is a possible page fault due to an invalid memory access. (no CVSS, Android)
- [CVE-2021-39632](https://cve.now/CVE-2021-39632.md): In inotify\_cb of events.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39630](https://cve.now/CVE-2021-39630.md): In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions (no CVSS, Android)
- [CVE-2021-39629](https://cve.now/CVE-2021-39629.md): In phTmlNfc\_Init and phTmlNfc\_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. (no CVSS, Android)
- [CVE-2021-39628](https://cve.now/CVE-2021-39628.md): In StatusBar.java, there is a possible disclosure of notification content on the lockscreen due to a logic error in the code. (no CVSS, Android)
- [CVE-2021-39627](https://cve.now/CVE-2021-39627.md): In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39626](https://cve.now/CVE-2021-39626.md): In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. (no CVSS, Android)
- [CVE-2021-39625](https://cve.now/CVE-2021-39625.md): In showCarrierAppInstallationNotification of EuiccNotificationManager.java, there is a possible way to gain an access to MediaProvider conte (no CVSS, Android)
- [CVE-2021-39623](https://cve.now/CVE-2021-39623.md): In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. (no CVSS, Android)
- [CVE-2021-39622](https://cve.now/CVE-2021-39622.md): In GBoard, there is a possible way to bypass Factory Reset Protection due to a missing permission check. (no CVSS, Android)
- [CVE-2021-39621](https://cve.now/CVE-2021-39621.md): In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsafe PendingIntent. (no CVSS, Android)
- [CVE-2021-39620](https://cve.now/CVE-2021-39620.md): In ipcSetDataReference of Parcel.cpp, there is a possible way to corrupt memory due to a use after free. (no CVSS, Android)
- [CVE-2021-39618](https://cve.now/CVE-2021-39618.md): In multiple methods of EuiccNotificationManager.java, there is a possible way to install existing packages without user consent due to an un (no CVSS, Android)
- [CVE-2021-1049](https://cve.now/CVE-2021-1049.md): Hacker one bug ID: 1343975Product: AndroidVersions: Android SoCAndroid ID: A-204256722 (no CVSS, Android)
- [CVE-2021-0959](https://cve.now/CVE-2021-0959.md): In jit\_memory\_region.cc, there is a possible bypass of memory restrictions due to a logic error in the code. (no CVSS, Android)
- [CVE-2022-21137](https://cve.now/CVE-2022-21137.md): Omron CX-One (CVSS 7.8, Omron CX-One)
- [CVE-2021-36199](https://cve.now/CVE-2021-36199.md): VideoEdge (CVSS 5.3, Johnson Controls VideoEdge)
- [CVE-2021-23138](https://cve.now/CVE-2021-23138.md): WECON LeviStudioU (CVSS 7.8, WECON LeviStudioU)
- [CVE-2021-23157](https://cve.now/CVE-2021-23157.md): WECON LeviStudioU (CVSS 7.8, WECON LeviStudioU)
- [CVE-2021-45769](https://cve.now/CVE-2021-45769.md): A NULL pointer dereference in AcseConnection\_parseMessage at src/mms/iso\_acse/acse.c of libiec61850 v1.5.0 can lead to a segmentation fault (no CVSS)
- [CVE-2021-44714](https://cve.now/CVE-2021-44714.md): Adobe Acrobat Reader Missing Custom Protocols in Warning Message Prompts (CVSS 2.5, Adobe Acrobat Reader)
- [CVE-2021-44710](https://cve.now/CVE-2021-44710.md): Adobe Acrobat Reader Use-after-free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44705](https://cve.now/CVE-2021-44705.md): Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44703](https://cve.now/CVE-2021-44703.md): Adobe Acrobat Pro DC Stack Overflow Vulnerability Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45067](https://cve.now/CVE-2021-45067.md): Adobe Acrobat Reader Memory Corruption could lead to Information Disclosure (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44712](https://cve.now/CVE-2021-44712.md): Adobe Acrobat Reader Memory Corruption could lead to Application denial-of-service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44713](https://cve.now/CVE-2021-44713.md): Adobe Acrobat Reader DC Use After Free could lead to Application denial-of-service (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-44742](https://cve.now/CVE-2021-44742.md): Adobe Reader Out-of-bounds Read Remote Code Execution Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44704](https://cve.now/CVE-2021-44704.md): Adobe Acrobat Reader Use-After-Free could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44708](https://cve.now/CVE-2021-44708.md): Adobe Acrobat Pro DC Heap Overflow could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44739](https://cve.now/CVE-2021-44739.md): Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Auth leak vulnerability (CVSS 3.1, Adobe Acrobat Reader)
- [CVE-2021-44715](https://cve.now/CVE-2021-44715.md): Adobe Acrobat Reader DC Out-of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44702](https://cve.now/CVE-2021-44702.md): Adobe Acrobat Reader DC add-on (AxAcroPDFLib.AxAcroPDF) for Internet Explorer LoadFile NTLMv2 SSO Auth leak vulnerability (CVSS 3.1, Adobe Acrobat Reader)
- [CVE-2021-45064](https://cve.now/CVE-2021-45064.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45061](https://cve.now/CVE-2021-45061.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44706](https://cve.now/CVE-2021-44706.md): Adobe Acrobat Reader Collab.registerReview Use-After-Free Remote Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45060](https://cve.now/CVE-2021-45060.md): Adobe Acrobat Reader DC TTF Font Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44707](https://cve.now/CVE-2021-44707.md): Adobe Acrobat Reader DC OTF Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45063](https://cve.now/CVE-2021-45063.md): Adobe Acrobat Reader DC JP2 File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44711](https://cve.now/CVE-2021-44711.md): Adobe Acrobat Reader DC annotation gestures integer overflow vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44741](https://cve.now/CVE-2021-44741.md): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-44701](https://cve.now/CVE-2021-44701.md): Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44709](https://cve.now/CVE-2021-44709.md): Adobe Acrobat Pro DC Heap Overflow Vulnerability could lead to Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-45068](https://cve.now/CVE-2021-45068.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-44740](https://cve.now/CVE-2021-44740.md): Adobe Acrobat Pro DC NULL Pointer Dereference could lead to Application-denial-of-service (CVSS 3.3, Adobe Acrobat Reader)
- [CVE-2021-45062](https://cve.now/CVE-2021-45062.md): Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-43752](https://cve.now/CVE-2021-43752.md): Adobe Illustrator TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-44700](https://cve.now/CVE-2021-44700.md): Adobe Illustrator JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Illustrator)
- [CVE-2021-45051](https://cve.now/CVE-2021-45051.md): Adobe Bridge JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-45052](https://cve.now/CVE-2021-45052.md): Adobe Bridge TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Bridge)
- [CVE-2021-44743](https://cve.now/CVE-2021-44743.md): Adobe Bridge JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2021-28507](https://cve.now/CVE-2021-28507.md): An issue has recently been discovered in Arista EOS where, under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent. (CVSS 5.5, Arista Networks EOS)
- [CVE-2021-28506](https://cve.now/CVE-2021-28506.md): An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device. (CVSS 9.1, Arista Networks EOS)
- [CVE-2021-28501](https://cve.now/CVE-2021-28501.md): An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration. (CVSS 9.1, Arista Networks Terminattr)
- [CVE-2021-20613](https://cve.now/CVE-2021-20613.md): Improper initialization vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.16 and prior, FX3U-ENET-L Firmware version 1.16 and pr (no CVSS, MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…)
- [CVE-2021-20612](https://cve.now/CVE-2021-20612.md): Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware (no CVSS, MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MEL…)
- [CVE-2022-0226](https://cve.now/CVE-2022-0226.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 4.3, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-45761](https://cve.now/CVE-2021-45761.md): ROPium v3.1 was discovered to contain an invalid memory address dereference via the find() function. (no CVSS)
- [CVE-2021-24046](https://cve.now/CVE-2021-24046.md): A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebo (no CVSS, Meta Platforms Ray-Ban® Stories Smart Glasses)
- [CVE-2021-45468](https://cve.now/CVE-2021-45468.md): Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WA (no CVSS)
- [CVE-2022-0224](https://cve.now/CVE-2022-0224.md): SQL Injection in dolibarr/dolibarr (CVSS 8.3, dolibarr/dolibarr)
- [CVE-2022-23227](https://cve.now/CVE-2022-23227.md): NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users (CVSS 9.8, KEV)
- [CVE-2021-39032](https://cve.now/CVE-2021-39032.md): IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local us (CVSS 4.0, IBM Sterling Gentran:Server for Microsoft Windows)
- [CVE-2022-21685](https://cve.now/CVE-2022-21685.md): Integer underflow in Frontier (CVSS 6.5, paritytech frontier · pallet-evm-precompile-modexp)
- [CVE-2022-21677](https://cve.now/CVE-2022-21677.md): Group advanced search option may leak group and group's members visibility (CVSS 4.3, discourse)
- [CVE-2021-32649](https://cve.now/CVE-2021-32649.md): Authenticated file write leads to remote code execution in october/system (CVSS 8.8, octobercms october · october/system)
- [CVE-2021-32650](https://cve.now/CVE-2021-32650.md): Arbitrary code execution in october/system (CVSS 8.8, octobercms october · october/system)
- [CVE-2022-0231](https://cve.now/CVE-2022-0231.md): Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat (CVSS 5.7, livehelperchat/livehelperchat · remdex/livehelperchat)
- [CVE-2021-33962](https://cve.now/CVE-2021-33962.md): China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop\_usb\_devi (no CVSS)
- [CVE-2021-36781](https://cve.now/CVE-2021-36781.md): parsec: dangerous 777 permissions for /run/parsec (CVSS 5.9, openSUSE Factory)
- [CVE-2021-42551](https://cve.now/CVE-2021-42551.md): Reflected XSS in NetBiblio WebOPAC search functionality (CVSS 6.1, AlCoda NetBiblio WebOPAC)
- [CVE-2022-20698](https://cve.now/CVE-2022-20698.md): Clam AntiVirus (ClamAV) Denial of Service Vulnerability (CVSS 7.5, Cisco ClamAV)
- [CVE-2022-20639](https://cve.now/CVE-2022-20639.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20638](https://cve.now/CVE-2022-20638.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20637](https://cve.now/CVE-2022-20637.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20636](https://cve.now/CVE-2022-20636.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20635](https://cve.now/CVE-2022-20635.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20660](https://cve.now/CVE-2022-20660.md): Cisco IP Phones Information Disclosure Vulnerability (CVSS 4.6, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2022-20658](https://cve.now/CVE-2022-20658.md): Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability (CVSS 9.6, Cisco Unified Contact Center Domain Manager)
- [CVE-2022-20647](https://cve.now/CVE-2022-20647.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20646](https://cve.now/CVE-2022-20646.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20645](https://cve.now/CVE-2022-20645.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20644](https://cve.now/CVE-2022-20644.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20643](https://cve.now/CVE-2022-20643.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20642](https://cve.now/CVE-2022-20642.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20641](https://cve.now/CVE-2022-20641.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-20640](https://cve.now/CVE-2022-20640.md): Cisco Security Manager Cross-Site Scripting Vulnerabilities (CVSS 6.1, Cisco Security Manager)
- [CVE-2022-22056](https://cve.now/CVE-2022-22056.md): Le-yan Co., Ltd. dental management system - Hard-coded Credentials (CVSS 9.8, Le-yan Co. Dental Management System)
- [CVE-2022-22055](https://cve.now/CVE-2022-22055.md): Le-yan Co., Ltd. dental management system - SQL Injection (CVSS 9.8, Le-yan Co. Dental Management System)
- [CVE-2022-22054](https://cve.now/CVE-2022-22054.md): ASUS RT-AX56U - Path Traversal (CVSS 6.5, ASUS RT-AX56U)
- [CVE-2021-46255](https://cve.now/CVE-2021-46255.md): eyouCMS V1.5.5-UTF8-SP3\_1 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename. (no CVSS)
- [CVE-2021-38692](https://cve.now/CVE-2021-38692.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38691](https://cve.now/CVE-2021-38691.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38690](https://cve.now/CVE-2021-38690.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38689](https://cve.now/CVE-2021-38689.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38682](https://cve.now/CVE-2021-38682.md): Stack Overflow Vulnerability in QVR Elite, QVR Pro and QVR Guard (CVSS 8.1, QNAP Systems QVR Elite · QNAP Systems QVR Pro +1)
- [CVE-2021-38678](https://cve.now/CVE-2021-38678.md): Open Redirect Vulnerability in QcalAgent (CVSS 6.1, QNAP Systems QcalAgent)
- [CVE-2021-38677](https://cve.now/CVE-2021-38677.md): Reflected XSS Vulnerability in QcalAgent (CVSS 5.3, QNAP Systems QcalAgent)
- [CVE-2021-45762](https://cve.now/CVE-2021-45762.md): GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function gf\_sg\_vrml\_mf\_reset(). (no CVSS)
- [CVE-2021-45763](https://cve.now/CVE-2021-45763.md): GPAC v1.1.0 was discovered to contain an invalid call in the function gf\_node\_changed(). (no CVSS)
- [CVE-2021-45764](https://cve.now/CVE-2021-45764.md): GPAC v1.1.0 was discovered to contain an invalid memory address dereference via the function shift\_chunk\_offsets.isra(). (no CVSS)
- [CVE-2021-45767](https://cve.now/CVE-2021-45767.md): GPAC 1.1.0 was discovered to contain an invalid memory address dereference via the function lsr\_read\_id(). (no CVSS)
- [CVE-2021-46019](https://cve.now/CVE-2021-46019.md): An untrusted pointer dereference in rec\_db\_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application cra (no CVSS)
- [CVE-2021-46022](https://cve.now/CVE-2021-46022.md): An Use-After-Free vulnerability in rec\_mset\_elem\_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or applica (no CVSS)
- [CVE-2022-0213](https://cve.now/CVE-2022-0213.md): Heap-based Buffer Overflow in vim/vim (CVSS 6.8, vim/vim)
- [CVE-2022-21680](https://cve.now/CVE-2022-21680.md): Cubic catastrophic backtracking (ReDoS) in marked (CVSS 7.5, markedjs marked · marked)
- [CVE-2022-21681](https://cve.now/CVE-2022-21681.md): Exponential catastrophic backtracking (ReDoS) in marked (CVSS 7.5, markedjs marked · marked)
- [CVE-2022-23218](https://cve.now/CVE-2022-23218.md): The deprecated compatibility function svcunix\_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argu (CVSS 9.8)
- [CVE-2022-23219](https://cve.now/CVE-2022-23219.md): The deprecated compatibility function clnt\_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname arg (CVSS 9.8)
- [CVE-2022-23222](https://cve.now/CVE-2022-23222.md): kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arith (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.