# CVEs published 2022-01-15

15 CVEs were published on January 15, 2022: 0 critical, 1 high. Days are UTC.

- [CVE-2021-33827](https://cve.now/CVE-2021-33827.md): The files\_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings. (no CVSS)
- [CVE-2021-33828](https://cve.now/CVE-2021-33828.md): The files\_antivirus component before 1.0.0 for ownCloud mishandles the protection mechanism by which malicious files (that have been uploade (no CVSS)
- [CVE-2021-44537](https://cve.now/CVE-2021-44537.md): ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execut (no CVSS)
- [CVE-2020-28919](https://cve.now/CVE-2020-28919.md): A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbi (no CVSS)
- [CVE-2021-42555](https://cve.now/CVE-2021-42555.md): Pexip Infinity before 26.2 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. (no CVSS)
- [CVE-2021-35969](https://cve.now/CVE-2021-35969.md): Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation. (no CVSS)
- [CVE-2021-33499](https://cve.now/CVE-2021-33499.md): Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 2 of 2). (no CVSS)
- [CVE-2021-33498](https://cve.now/CVE-2021-33498.md): Pexip Infinity before 26 allows remote denial of service because of missing H.264 input validation (issue 1 of 2). (no CVSS)
- [CVE-2021-32545](https://cve.now/CVE-2021-32545.md): Pexip Infinity before 26 allows remote denial of service because of missing RTMP input validation. (no CVSS)
- [CVE-2022-23178](https://cve.now/CVE-2022-23178.md): An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. (no CVSS)
- [CVE-2022-23095](https://cve.now/CVE-2022-23095.md): Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. (CVSS 7.8)
- [CVE-2021-44049](https://cve.now/CVE-2021-44049.md): CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan (no CVSS)
- [CVE-2021-33963](https://cve.now/CVE-2021-33963.md): China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac\_addr\_clone receives parameters by POST request, and the (no CVSS)
- [CVE-2022-23094](https://cve.now/CVE-2022-23094.md): Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKE (no CVSS)
- [CVE-2021-24044](https://cve.now/CVE-2021-24044.md): By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would (no CVSS, Facebook Hermes · hermes-engine)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.